JPH01312638A - Retry controller for abnormality supervisory of micro processor - Google Patents

Abstract

PURPOSE:To discriminate the runaway of a program by means of a cause which cannot immediately be restored and the runaway of the program by means of the temporary cause of noise and the like by continuously stopping a system when the count value of re-start has exceeded a set point. CONSTITUTION:Since the output of a watch dog timer reset signal WDTR is again stopped in the process of program execution when the runaway of the program is due to the cause which cannot immediately be restored such as the fault of hardware, bug of software or the like, a micro processor system 2 executes an abnormality processing. A counter circuit 5 adds one to the count value, and the micro processor system 2 stops and initializes the system. Since said action is repeated at the runaway time of the program, the count value of the counter circuit 5 reaches the number of setting times N, and the counter circuit 5 outputs a circuit output signal CTUP. Thus, the runaway of the program can be discriminated whether it is the temporary one or the unrestorable one.

Description

DETAILED DESCRIPTION OF THE INVENTION (Field of Industrial Application) The present invention relates to a system using a microprocessor, which uses a microprocessor for abnormality monitoring and retry to initialize and restart the system when a runaway program occurs. Regarding a control device.

(Prior Art) In microprocessor application systems, programs may run out of control due to unrepairable causes of the system itself such as hardware failures or software bugs, or due to temporary disturbances such as noise. be. Such program runaway causes erroneous output, resulting in malfunction and runaway of peripheral hardware, and adversely affects the entire system. For this reason, watchdog timer monitoring devices have been known as a system protection measure against program runaway. Figure 2 shows a time chart ((a) in the same figure) and a flow chart ((b) in the same figure) for explaining the principle of the watchdog timer monitoring device.
, and this monitoring device monitors the processing program execution cycle (
(see (a) in the same figure) is constantly monitored using a timer or the like.

That is, in a normal state, the timer reset signal WDTR is output at a program execution cycle shorter than the fixed monitoring period Tw, and the timer is reset repeatedly, so the watchdog timer monitoring device does not determine that an abnormality has occurred in the program. On the other hand, if the timer is not reset even after the monitoring period Tv has elapsed, the watchdog timer monitoring device determines that an abnormality has occurred in the software or hardware of the microprocessor system, and assigns a program to the microprocessor system. to handle the abnormality (for example, investigate the cause of the abnormality,
give a warning on the display, etc.) (step S)
101) Meanwhile, the microprocessor is stopped using software (step S102).

By the way, there are cases where the abnormality processing program itself has already been destroyed due to runaway, or the abnormality processing program itself cannot function normally due to abnormalities that occur in various hardware such as failures in the address bus, memory, registers, etc. Therefore, the watchdog timer monitoring device based on the above principle cannot perform accurate monitoring.

The configuration and operation of a monitoring device for dealing with such a situation will be explained with reference to FIGS. 3 to 5.

In FIG. 3, the monitoring periods for the microprocessor system 21 are TwA and TVs (TwA<Twa
), each VDT circuit 22A uses a watchdog timer (hereinafter referred to as rWDT circuit) 22A, 22B.

Interrupt signal iRT and stop signal μ5T which are the output of 22B
The configuration is such that OP is used as an interrupt input and a stop input of the microprocessor system 21, respectively.

The operation of this monitoring device will be explained with reference to FIG.

First, under normal conditions, the microprocessor system 21 sends a timer reset signal W every program execution cycle.
Since it outputs DTR, VDT circuits 22A and 22B
None of them outputs the interrupt signal iRT or the stop signal μ5TOP.

On the other hand, if an abnormality occurs in the microprocessor system 21 and the program goes out of control, the microprocessor system 21 will no longer output WDTR (see Figure 4. However,
In the figure, it is shown as WDTR). Therefore, since the timer (not shown) of the VDT circuit 22A is not reset, the interrupt signal iRT, which is the first count-up signal, is output after a preset fixed time Tw has elapsed since the start of counting. Abnormal processing is performed inside the microprocessor system 21 by inputting this iRT. In parallel with this operation, the VDT circuit 22B outputs a stop signal μ5TOP, which is a second count-up signal, to the microprocessor system 21 when the time Tws has elapsed since the start of counting, and hardware stops the operation of the microprocessor system 21. .

FIG. 5 is a circuit diagram specifically showing the program abnormality monitoring device of FIG. 3. Under normal conditions, the microprocessor system 2 (corresponding to the microprocessor system 21 in FIG. 3) runs the VDT circuit 1 (WDT circuit 22A in FIG. 3,
22B) is outputting WDTR,
This WDTR is input as a reset signal to the reset terminal R3T of the VDT circuit 1 via the NOR gate 3.

A timer (not shown) inside the WDT circuit 1 cancels counting when R8T, which is an inverted signal of the WDTR, is input, and restarts counting from zero. At this time, R3
Since T is input at a cycle shorter than the monitoring periods TvA and TwB (see FIG. 4), the VDT circuit 1 does not output iRT or μ5TOP to the microprocessor system 2.

On the other hand, when the program runs out of control, the microprocessor system 2 does not output WDTR, so R8T is not input to the WDT circuit 1. Therefore, WDT circuit 1
determines that the program has gone out of control when its internal timer passes the monitoring period Tw^, and sends the first count-up signal iRT to the interrupt terminal iR of the microprocessor system 2.
When the monitoring period Tvs has elapsed, μ5TOP outputs an internal reset signal 1RST, which is a second count-up signal, to the system reset terminal R5T of the microprocessor system 2 via the NOR gate 8.

As a result, the microprocessor system 2 performs abnormality processing after the monitoring period Tw^ has elapsed and before the monitoring period TvB has elapsed, and after the monitoring period TwB has elapsed, the system is hardware-stopped.

In FIG. 5, eR3T input to one terminal of the NOR gates 3 and 8 is an external reset signal used when starting up the system.

(Problem to be solved by the invention) By the way, depending on the microprocessor system, even if the system is temporarily stopped due to an abnormality such as a runaway program, it may have a fatal effect on the overall operation when the system is restarted. In some cases, it may be preferable to reboot if the

For example, if the cause of a runaway program is due to a temporary disturbance such as noise, the system must be restarted even if the CRT display section or keyboard processing section function is temporarily stopped. When restarting after initialization, the screen display will be temporarily disrupted, the screen will only stop, or the keypad will be temporarily disabled, but the system as a whole will not be fatally affected. It is preferable to avoid outages.

On the other hand, if the cause of the runaway program abnormality is something that cannot be recovered, such as a hardware failure or a software bug, it is necessary to stop the system to protect the entire system.

However, with conventional system protection devices, system protection in the event of a runaway program is not performed without distinguishing whether the cause of the runaway is temporary or unrecoverable. Since this is basically done by stopping the system, there is an inconvenience that the above request cannot be met.

Furthermore, in the monitoring device whose operating principle is shown in Figure 2, if the program itself for handling abnormalities is destroyed, the protection function of the device will not work properly, and peripheral hardware may be put into an incorrect mode due to the program running out of control. When this happens, the system cannot cope with the runaway unless there is a means of recovery other than resetting the hardware. Furthermore, in the monitoring devices shown in FIGS. 3 and 5, there was no means for automatically canceling the hardware stop signal even if the program went out of control due to a temporary abnormality.

The present invention was proposed in order to solve the above-mentioned problems, and when a program runs out of control, a microprocessor stop signal is generated to stop the system hardware, thereby preventing the adverse effects on the system due to the runaway. At the same time, after a certain period of time has elapsed since the stop, the microprocessor stop signal is released, the system is initialized by both hardware and software, and the system is restarted, allowing the system to continue operating, and furthermore, preventing the program from running out of control. If the cause is impossible, the microprocessor abnormality monitoring retry control device is designed to prevent the spread of failures due to program runaway by keeping the system in a stopped state without releasing the microprocessor stop signal. The purpose is to provide.

(Means for Solving the Problems) In order to achieve the above object, the present invention inputs a reset signal for each program execution cycle of a microprocessor system, and counts the time from the input point of the reset signal using a timer. , if the reset signal is input before the count value exceeds a preset first monitoring period or second monitoring period, the timer is de-counted and the count is restarted from zero, When the count value exceeds the first monitoring period, outputting a first count-up signal as an interrupt signal for causing the system to perform abnormality processing;

program abnormality detection means such as a watchdog timer that outputs a second count-up signal when the count value exceeds the second monitoring period; The system is stopped by outputting a signal to stop the system, and after a certain period of time has elapsed, the stop signal is released to initialize the system.

A system stop/restart means such as a differential circuit that restarts the system, and a restart means such as a counter circuit that prevents release of the stop signal and continues stopping the system when the number of restarts exceeds a preset number of times. It consists of a means for counting the number of activations.

(Function) In the present invention, a reset signal for each program execution cycle is input to the program abnormality detection means, the time from the time of input is counted by a timer, and the count value exceeds a preset first monitoring period. When the reset signal is input and when the reset signal is input before the count value exceeds the preset second monitoring period, the timer restarts counting from zero.

The program abnormality detection means outputs an interrupt signal to the microprocessor system when the count value exceeds a first monitoring period, and outputs an interrupt signal to the microprocessor system when the count value exceeds a second monitoring period. A second count-up signal is output to the restart means. Upon receiving this signal, the system stop/restart means outputs a hardware stop signal to the microprocessor system, and cancels the stop signal after a certain period of time.

Then, the microprocessor system performs abnormal processing in response to the input of the interrupt signal, stops, initializes, and restarts the system in response to the hardware stop signal and its release signal, and resumes outputting the reset signal. Also,
When the number of restarts exceeds a set value, the restart number counting means stops driving the release signal to continue stopping the system.

As a result, the present invention distinguishes whether a program runaway is temporary or unrecoverable, and if it is temporary, the system continues to operate, and the program is unrecoverable. In such cases, the system can be stopped either through software or hardware.

(Embodiment) An embodiment of the present invention will be described below with reference to the circuit diagram of FIG. In the figure, the watchdog timer reset signal WDTR output from the microprocessor system 2
is connected to a reset terminal R3T of a watchdog timer (VDT circuit) 1 as a program abnormality detection means via a NOR gate 3 so as to be input as a reset signal R5T. The above VD is applied to NOR gate 3.
In addition to TH, an external reset signal eRST is input at the time of starting up the microprocessor system 2, etc. When eR8T becomes low level, a low level signal is output to reset the VDT circuit 1.

In the WDT circuit 1, R5T cancels the counting of an internal timer (not shown) and restarts the counting from zero, while the counting by the timer exceeds a preset monitoring period TwA (see FIG. 4). and output terminal i
Interrupt signal iR which is the first count up signal from RT
T, and the monitoring period T during which the count is set in advance.
ws (see the same figure), the output terminal μ5T
It is configured to output a microprocessor system stop signal μ5TOP, which is a second count-up signal, from OP.

Further, the output terminal iRT is connected to the input terminal iRT of the microprocessor system 2, and the output terminal μ5T
OP is the differential circuit 4 as a system stop/restart means.
In addition to being connected to the input terminal of , and the clock terminal CK of a counter circuit 5 serving as means for counting the number of restarts, it is also connected to one input terminal of an AND gate 7 .

The differentiating circuit 4 differentiates μ5TOP and outputs a pulse signal DEF, and its output side is connected to one input terminal of the NOR gate 6.

The counter circuit 5 is configured to count the rising edge of μ5TOP, and output a high level signal CTUP when the count reaches a preset count number N.
Its output terminal is connected to the other input terminal of AND gate 7. The counter circuit 5 also has a reset terminal R3.
The eR3T is input to the terminal R3T, and when the eR8T becomes low level, the counter circuit 5 is reset.

Further, the output terminal of the AND gate 7 is connected to one input terminal of the NOR gate 6, and the output signal of the AND gate 7 and the output signal of the differentiating circuit 4 are inputted to the input terminal of the NOR gate 6 as described above. In addition, the eR3T is input, and when this eR3T becomes low level, a low level signal is output. Furthermore, the output terminal of the NOR gate 6 is connected to the internal reset terminal R3T of the microprocessor system 2.

The operation of this embodiment will be explained below.

When the program is normal, the microprocessor system 2 outputs WDTR at the program execution cycle. This WDTR is inverted via NOR gate 3 and VDT
It is output to the reset terminal R3T of circuit 1 as 100 completions.

When RST is input, the VDT circuit 1 cancels the count of the internal timer and restarts counting from zero. At this time, since RST resets the internal timer every cycle shorter than the monitoring period T MA , T us , the VDT circuit 1
does not output iRT to the microprocessor system 2, and the differentiating circuit 4. Counter circuit 5. A
μ5TOP is not output to any of the ND gates 7.

On the other hand, when the program runs out of control, the microprocessor system 2 does not output WDTR, so RST is not input to the WDT circuit. Therefore, when the internal timer of the VDT circuit 1 passes the monitoring period Tw^, it determines that the program has gone out of control and outputs iRT to the microprocessor system 2, and when the monitoring period TSB passes, μ5
Differentiating circuit 4. It is output to the counter circuit 5 and AND gate 7.

The counter circuit 5 starts μ5 at the rising edge of the input μ5TOP.
The number of TOP is counted, and when the count value reaches the set number of times N, CTUP is output. However, assuming that the counter value has not yet reached the set number of times N, AND
Gate 7 outputs a low level signal.

The differentiating circuit 4 differentiates the input μ5TOP, generates a pulse DEF having a time width sufficient to reset the microprocessor system 2, and outputs it to the NOR gate 6. NOR gate 6 inverts μ5TOP and 1R3T
It is output to the internal reset terminal box of the microprocessor system 2 as .

As a result, the microprocessor system 2 hardware stops the system at the rising edge of 1R5T, and initializes and restarts the system at the falling edge of 1R3T. By this restart, the microprocessor system 2 starts outputting WDTR again and releases the outputs iRT and μ5TOP of the WDT circuit 1.

Here, if the runaway of the program is due to a temporary cause such as noise, the microprocessor system 2 can resume normal operation after this.

On the other hand, if the program runaway is due to a cause that can be immediately recovered, such as a hardware failure or software bug, the WDTR is
so the output will be stopped again.

Microprocessor system 2 performs abnormality processing.

The counter circuit 5 adds 1 to the count value, and the microprocessor system 2 stops and initializes the system. Since the above operation is repeated during program runaway, the count value of the counter circuit 5 eventually reaches the set number N, and the counter circuit 5 outputs CTUP.

As a result, the AND gate 7 outputs a high level signal and the NOR gate 6 continues to output a low level 1R3T, so the microprocessor system 2 maintains a stopped state, and this stopped state is caused by an external reset signal. e
This continues until R5T is input.

(Effects of the Invention) As described above, according to the present invention, when a program runaway occurs, the abnormality is detected by the program abnormality detection means, the microprocessor system is interrupted to perform abnormal processing, and the system The system is stopped and restarted by a system stop/restart means, while the number of restarts is counted by a restart count means, and when the count value exceeds a set value, the system is stopped continuously. Therefore, it is possible to distinguish between program runaways due to causes that cannot be recovered immediately from program runaways due to temporary causes such as noise, and in the case of the latter, the system is automatically initialized both hardware and software. By restarting the system, you can continue operating the system.

In addition, an upper limit value for the number of restarts can be set arbitrarily, and if the number of restarts exceeds the upper limit value when abnormalities occur frequently, it is determined that the program has gone out of control due to an unrecoverable cause, and the microprocessor system automatically By stopping the system, it is possible to appropriately respond to unrecoverable failures such as hardware failures and program bugs.

[Brief explanation of the drawing]

FIG. 1 is a circuit diagram for explaining one embodiment of the present invention, FIG. 2(a) is a time chart for explaining the prior art, FIG. 2(b) is a flowchart, and FIG. 3 is the prior art. FIG. 4 is a time chart for explaining an embodiment of the present invention and the prior art, and FIG. 5 is a circuit diagram corresponding to the block diagram of FIG. 3. 1...Watchdog timer 2...Microprocessor system 3.6...NOR gate 4...Differential circuit 5
...Counter circuit 7...AND gate WD
TR...Watchdog timer reset signal iRT.
...Interrupt signal (first count up signal) μ5TOP
... Microprocessor system stop signal (second count up signal) DEF ... Differentiation circuit output signal CTUP ... Counter circuit output signal 1R8T ... Internal reset signal eR8T ... External reset signal

Claims (1)

[Claims] A reset signal for each program execution cycle of the microprocessor system is input, and a timer counts the time from the input point of the reset signal, and this count value is set in a preset first monitoring period or first monitoring period. When the reset signal is input before the second monitoring period has passed, the timer is deactivated and the count is restarted from zero, and when the count value exceeds the first monitoring period, the timer is reset. outputting a first count-up signal as an interrupt signal for causing the system to perform abnormal processing;
program abnormality detection means for outputting a second count-up signal when the count value exceeds the second monitoring period; and a signal for stopping the operation of hardware of the system by the second count-up signal. a system stop/restart means for outputting an output to stop the system, and then canceling the stop signal after a certain period of time has passed to initialize and restart the system; 1. An abnormality monitoring retry control device for a microprocessor, comprising restart count means for preventing cancellation of the stop signal and causing the system to continue stopping when the system is stopped.