JP2000029747A - Runaway detecting circuit - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a runaway detecting circuit detecting a runaway by, which a loop is formed in a routine containing the initialized instruction (counter resetting instruction) of a counter, and realizing the highly reliable operation of a system. SOLUTION: A runaway detecting circuit is provided with a WDT(watch dot timer) counter part 2 for outputting an overflow output signal 14, when the counting value of a clock CLK exceeds an overflow value, a WDT control register 3 outputting a reset flag signal 12, a register 5 for storing a counting value, a register 6 for storing a value smaller than the overflow value, a comparator 7 for comparing the values of the registers 5 and 6, an AND gate 16 for invalidating the reset flag signal 12 when the value of the register 5 is not more than the value of the register 6, a counter 8 measuring the number of invalidation times, a register 9 storing the upper limit value of the number of invalidation times and a comparator 10 for outputting a system reset signal 15, when the value of the counter 8 is not less than the value of the register 9.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to a runaway detection circuit used for a semiconductor integrated circuit such as a microcontroller.

[0002]

2. Description of the Related Art In recent years, a microcontroller used in the field of portable devices and home information appliances is equipped with a watchdog timer in a runaway detection circuit for detecting a program runaway. A stable operation of the system can be realized by the watchdog operation of the watchdog timer.

FIG. 5 is a configuration diagram of a conventional runaway detection circuit. In FIG. 5, 1 is a microcontroller, 2 is a watchdog timer (hereinafter abbreviated as WDT) counter unit, 3 is a WDT control register, 4 is a CPU, 11 is a bus, 12 is a reset flag signal, and 14 is a WDT counter unit 2. Is an overflow output signal. The operation of the conventional runaway detection circuit configured as described above will be described below with further reference to FIG. FIG. 6 is a timing chart of the conventional runaway detection circuit.

[0004] The WDT counter unit 2 keeps counting the clock CLK supplied to the chip, and when the count value exceeds a predetermined value (overflow value), detects the state as an overflow. In order to detect runaway of the system using the watchdog operation in the microcontroller 1, it is necessary to set a counter reset flag in the WDT control register 3 from the CPU 4 via the bus 11. By periodically executing a counter reset instruction in the program, a counter reset flag in the WDT control register 3 is set, and the WDT control register 3
Outputs a reset flag signal 12, and is controlled so that the overflow of the WDT counter unit 2 does not occur during normal operation (period (a) in FIG. 6). When the reset operation of the WDT counter unit 2 does not operate normally, in other words, when the counter reset instruction arranged in the program is not executed, the counter of the WDT counter unit 2 overflows and the overflow output signal 14 It is possible to detect that some abnormality has occurred in the program processing.

[0005]

However, in the above-mentioned conventional configuration, when a runaway occurs in a routine including a counter reset instruction and a loop is formed (period (b) in FIG. 6), the WDT counter unit 2 Is periodically performed, the WDT counter unit 2 does not overflow, and there is a problem that runaway of the program processing of the microcontroller 1 cannot be detected. Such runaway can occur, for example, when the program counter of the microcontroller 1 malfunctions due to noise.

An object of the present invention is to provide a runaway detection circuit which can detect a runaway that forms a loop with a routine including a counter initialization instruction (counter reset instruction) and can realize a highly reliable operation of the system. That is.

[0007]

According to a first aspect of the present invention, there is provided a runaway detection circuit comprising: a counter for counting a clock; an abnormality detection means for detecting an abnormality when a count value of the counter exceeds a first predetermined value; A runaway detection circuit including initialization means for initializing a count value of a counter, wherein storage means for storing a second predetermined value smaller than the first predetermined value in advance; Counter value comparing means for comparing the count value of the counter with the second predetermined value stored in the storage means of the second predetermined value, and the comparison result of the counter count value comparing means indicates that the count value of the counter is the second predetermined value. And an invalidating means for invalidating the initialization by the initializing means when the following conditions are satisfied.

According to this configuration, when the count value of the counter is equal to or less than the second predetermined value smaller than the first predetermined value, the initialization of the counter value by the initialization means is invalidated. The counter initialization instruction other than the timing intentionally set in the program is excluded, and when the count value of the counter exceeds the first predetermined value, abnormality can be detected by the abnormality detection means. It is possible to detect a runaway that forms a loop in a routine including the above, and realize a highly reliable operation of a system using the runaway.

A runaway detection circuit according to a second aspect of the present invention is the first aspect.
In the runaway detection circuit described above, measuring means for measuring the number of invalidations by the invalidating means, storage means for storing a third predetermined value in advance as an upper limit of the number of invalidations, and measuring means Is compared with the third predetermined value stored in the third predetermined value storage means, and when the invalidation number measured value is equal to or greater than the third predetermined value, an abnormality detection signal is output. And a means for comparing invalidation times.

With this configuration, the number of times of invalidation of the initialization by the initialization means for the count value of the counter is measured, and when the measured value of the number of invalidations is equal to or more than the third predetermined value which is the upper limit of the number of invalidations. At some point, it is possible to detect abnormalities by the invalidation number comparison means, so that a runaway that forms a loop in a routine including a counter initialization instruction occurs, and at a timing other than the timing intentionally set in the program When the initialization instruction of the invalidated counter is generated a number of times equal to or more than the third predetermined value, the abnormality can be detected by the invalidation number comparing means.

A runaway detection circuit according to a third aspect of the present invention is characterized in that:
In the runaway detection circuit described above, the storage means for the second predetermined value is constituted by a nonvolatile memory. By configuring the storage means of the second predetermined value with a non-volatile memory in this way, once the second predetermined value is stored in the storage means of the second predetermined value, the power supply of the system is shut off, and thereafter, When the power is turned on, the second predetermined value need not be stored again.

A runaway detection circuit according to a fourth aspect is the second aspect.
In the runaway detection circuit described above, one or both of the storage means for the second predetermined value and the storage means for the third predetermined value are constituted by a nonvolatile memory. By configuring the storage means of the second and third predetermined values in a non-volatile memory as described above, once the storage means of the second and third predetermined values is stored once, the power supply of the system is cut off, There is no need to store the data again when the power is turned on.

[0013]

Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a configuration diagram of a runaway detection circuit according to the first embodiment of the present invention. In FIG. 1, 1 is a microcontroller, 2 is a watchdog timer (hereinafter abbreviated as WDT) counter section for counting an input clock or an internal clock having a frequency that is an integral multiple thereof, 3 is a WDT control register, 4 is a CPU, 6,9
Is a register, 7 and 10 are comparators, 11 is a bus, 12 is a reset flag signal, 13 is a reset command invalidation signal, 1
4 is a WDT overflow output signal, 15 is a system reset signal, 16 and 17 are AND gates, and 18 is an inverter.

In this embodiment, the clock CLK is counted, and when the count value exceeds a predetermined overflow value (first predetermined value), the overflow output signal 1 is output.
And a WDT control register (initializing means) for outputting a reset flag signal 12 for initializing the count value of the WDT counter section 2 by executing a counter reset instruction of the CPU 1. 3), which are the same as in the conventional example.

Further, in the present embodiment, the register 5 for storing the count value of the WDT counter unit 2 in synchronization with the clock CLK, and the register for storing in advance a value smaller than the overflow value (the means for storing the second predetermined value) 6), a comparator (counter count value comparing means) 7 for comparing the value of the register 5 with the value of the register 6, and when the comparison result of the comparator 7 indicates that the value of the register 5 is equal to or less than the value of the register 6. An AND gate (invalidating means) 16 for invalidating the reset flag signal 12 is provided. Further, the AND gate 16
, An AND gate 17 and a counter 8 which constitute a measuring means for measuring the number of times the reset flag signal 12 has been invalidated by a register, and a register (a third predetermined value storing means) for preliminarily storing an upper limit value of the number of invalidations. 9) and a comparator (invalidation number comparing means) 10 for outputting a system reset signal 15 when the value of the counter 8 is equal to or greater than the value of the register 9.

The output of the comparator 7 is at a low level (logical value 0) when the value of the register 5 is equal to or less than the value of the register 6, and at a high level (logic value) when the value of the register 5 is larger than the value of the register 6. Logical value 1). Also, counter 8
Is a reset instruction invalidation signal 13 which is an output of the comparator 7.
Is high level, the value is initialized to 0. The output of the comparator 10 is at a high level (logical value 1) when the value of the counter 8 is equal to or greater than the value of the register 9, and at a low level (logical value 0) when the value of the counter 8 is smaller than the value of the register 9. ).

Further, the WDT counter unit 2 outputs the clock CL
The counter 5 counts at the timing of the rising edge of K, and the register 5 may store the count value of the WDT counter unit 2 at the rising edge of the same clock CLK, depending on the frequency, or at the falling edge of the clock CLK. The count value of the WDT counter unit 2 may be stored. As described above, the timing at which the register 5 stores the count value of the WDT counter unit 2 may be a rising edge or a falling edge of the clock CLK, or may be generated by a delay.

The operation of the runaway detection circuit according to the present embodiment configured as described above will be further described with reference to FIGS. In the following description, a high level indicates a logical value 1 and a low level indicates a logical value 0. First, register 6
To set an appropriate value via the bus 11. The set value of the register 6 is set as close as possible to the overflow value of the WDT counter unit 2 and within a range that can be reset by a counter reset instruction before the value overflows from the value set during normal operation. Also, an appropriate value is set in the register 9 via the bus 11 from the CPU. The setting of this register 9 will be described later.

During normal operation (period (a) in FIG. 3), a counter reset instruction is executed at timings A and B in FIG. A counter reset flag is set, and a reset flag signal 12 is output from the WDT control register 3. At this time, since the value of the WDT counter unit 2 transferred to the register 5 is larger than the set value of the register 6, the reset instruction invalidation signal 13 which is the comparison result of the comparator 7 becomes high level, and the reset flag signal 1
AND which receives reset command invalidation signal 13 and reset instruction invalidation signal 13
The output of the gate 16 becomes high level, the count value of the WDT counter unit 2 is initialized, and the overflow output signal 1
No. 4 is at a low level and no abnormality is detected.

During program runaway (period (b) in FIG. 3)
It is assumed that the counter reset instruction is executed at timing C in FIG. 3 and the reset flag signal 12 is output from the WDT control register 3. In a program runaway in which a loop is formed by a routine including a reset instruction, the runaway is likely to be a small loop, and at that time, the interval between the reset flag signals 12 becomes small. At this time, since the value of the WDT counter unit 2 transferred to the register 5 is smaller than the set value of the register 6, the reset instruction invalidation signal 13 which is the comparison result of the comparator 7 becomes low level, and the AND gate 16 The output goes low, and the WDT counter 2
Is not initialized and continues to increase. And WDT
If the next reset flag signal 12 is not output from the WDT control register 3 during the interval T until the count value of the counter unit 2 reaches the overflow value, the count value exceeds the overflow value and the overflow output signal 14 becomes high. Level, an abnormality is detected, and a normal state ((c) in FIG. 3)
Period).

However, when the abnormal reset flag signal 12 is output from the WDT control register 3 after the count value of the WDT counter section 2 exceeds the set value of the register 6 during the interval T, the data is transferred to the register 5. Since the value of the WDT counter unit 2 is larger than the set value of the register 6, the reset instruction invalidation signal 13 which is the comparison result of the comparator 7 goes high, the output of the AND gate 16 goes high, and the WDT The count value of the counter unit 2 is initialized, the overflow output signal 14 is at a low level, and no abnormality due to the overflow output signal 14 is detected.

Therefore, a value is set in the register 9 as described above. The set value of the register 9 may be 1 or more, but a larger value may be set to realize a highly reliable system. Hereinafter, a case where the value of the register 9 is set to 2 will be described. The operation during the normal operation (period (a) in FIG. 4) is the same as that described in the period (a) in FIG. In this case, when the reset command invalidating signal 13 is at a high level, the output of the inverter 18 is at a low level, and the output of the AND gate 17 that receives the reset flag signal 12 and the output of the inverter 18 is at a low level. The output value of the counter 8 is 0. Since the output value of the counter 8 is smaller than 2 which is the set value of the register 9, the system reset signal 15, which is the comparison result of the comparator 10, is at a low level.

During program runaway (period (b) in FIG. 4)
It is assumed that the counter reset instruction is executed at timing C in FIG. 4 and the reset flag signal 12 is output from the WDT control register 3. In a program runaway in which a loop is formed by a routine including a reset instruction, the runaway is a small loop, and the interval between the reset flag signals 12 is reduced. At this time, since the value of the WDT counter unit 2 transferred to the register 5 is smaller than the set value of the register 6,
Reset command invalidation signal 13 which is a comparison result of comparator 7
Becomes low level, the output of the AND gate 16 becomes low level, and the count value of the WDT counter unit 2 continues to increase without being initialized. At this time, the reset command invalidation signal 1
Since 3 is at low level and the output of the inverter 18 is at high level, the output of the AND gate 17 is at high level and the output value of the counter 8 is 1. Since the output value of the counter 8 is smaller than 2 which is the set value of the register 9, the system reset signal 15, which is the comparison result of the comparator 10, is at a low level.

Thereafter, when an abnormal reset flag signal 12 is output from the WDT control register 3 at the timing D in FIG. 4 at a time when the count value of the WDT counter section 2 does not exceed the set value of the register 6, the register WD transferred to 5
Since the value of the T counter unit 2 is smaller than the set value of the register 6, the reset instruction invalidation signal 13 which is the comparison result of the comparator 7 is at low level, the output of the AND gate 16 is at low level, and the WDT counter unit The count value of 2 keeps increasing without being initialized. At this time, no abnormality due to the overflow output signal 14 is detected, but since the output of the inverter 18 to which the reset command invalidation signal 13 is input is at a high level, an AND gate to which the reset flag signal 12 and the output of the inverter 18 are input is provided. The output of the counter 17 becomes high level, and the output value of the counter 8 becomes 2. Since the output value of the counter 8 is the same as the set value 2 of the register 9, the system reset signal 15, which is the comparison result of the comparator 10, becomes high level, an abnormality is detected, and a normal state ((c) in FIG. 4) Period). The counter 8 counts the number of times the reset flag signal 12 input when the count value of the WDT counter unit 2 is equal to or less than the set value of the register 6 is invalidated.

As described above, according to the first embodiment,
In addition to the WDT counter unit 2 and the WDT control register 3 which outputs a reset flag signal 12 for initializing the count value, a register 5 for storing the count value of the WDT counter unit 2 and a value smaller than the overflow value are stored in advance. Register 6, which compares the value of the register 5 with the value of the register 6, and the comparison result of the comparator 7
And the AND gate 16 for invalidating the reset flag signal 12 when the value of the register 6 is equal to or less than the value of the register 6, the comparator 7 outputs a signal when the value of the register 5 is equal to or less than the value of the register 6. A low-level reset command invalidation signal 13 is output, and the AND flag 16 invalidates the reset flag signal 12, so that the WDT counter unit 2 other than the timing intentionally set in the program
If the count value of the WDT counter unit 2 exceeds the overflow value, an abnormality can be detected by eliminating the reset instruction of the WDT counter unit 2. Therefore, detecting a runaway that forms a loop in the routine including the reset instruction of the WDT counter unit 2 And the highly reliable operation of the microcontroller 1 can be realized.

Further, an inverter 18, an AND gate 17, and a counter 8 for measuring the number of times the reset flag signal 12 has been invalidated by the AND gate 16,
The provision of the register 9 for preliminarily storing the upper limit value of the number of times of invalidation and the comparator 10 for outputting the system reset signal 15 when the value of the counter 8 is equal to or greater than the value of the register 9 allows the reset flag signal 12 The number of invalidations is measured, and when the measured value of the number of invalidations is equal to or more than the upper limit of the number of invalidations, the system reset signal 15 is output from the comparator 10.
Is generated, a runaway that forms a loop occurs in a routine including a reset instruction of the WDT counter unit 2, and the reset instruction of the WDT counter unit 2 invalidated at a timing other than the timing intentionally set in the program. Can be detected when the number of occurrences is equal to or greater than the value of the register 9, and more reliable operation of the microcontroller 1 can be realized.

By configuring the registers 6 and 9 with nonvolatile elements, if the set values are optimized and stored once, the system power supply is cut off, and it is necessary to reset when the power supply is turned on thereafter. Is obtained. FIG. 2 is a configuration diagram of a runaway detection circuit according to a second embodiment of the present invention, and 19 is a nonvolatile memory.

The second embodiment differs from the first embodiment in that a nonvolatile memory 19 is provided. The nonvolatile memory 19 stores a value set in the register 6, a value set in the register 9, and a program for setting values set in the registers 6 and 9, respectively. Alternatively, a program for automatically setting the set values in the registers 6 and 9 after the reset is executed.

According to the present embodiment, the nonvolatile memory 1
9 is provided, and the set values of the registers 6 and 9 and the program for setting the same are stored, so that the registers 6 and 9 are automatically turned on when the system power is turned off, when the power is turned on, or after a reset. Can be set to

[0030]

As described above, according to the present invention, a counter for counting a clock, an abnormality detecting means for detecting an abnormality when the count value of the counter exceeds a first predetermined value, and a count value of the counter In addition to the initialization means for initializing
A second predetermined value smaller than the predetermined value is stored in advance.
Storage means for storing a predetermined value, a counter count value comparison means for comparing the count value of the counter with a second predetermined value stored in the second predetermined value storage means, and a comparison result of the counter count value comparison means. And invalidating means for invalidating the initialization by the initializing means when the count value of the second counter is equal to or smaller than the second predetermined value, whereby the count value of the counter is smaller than the first predetermined value. By invalidating the initialization of the count value of the counter by the initialization means when the count value is equal to or less than the predetermined value, a counter initialization instruction other than the timing intentionally set in the program is eliminated, and the count value of the counter is reduced. When the value exceeds the first predetermined value, the abnormality can be detected by the abnormality detecting means. Therefore, it is possible to detect a runaway that forms a loop in a routine including a counter initialization instruction. It is possible to realize a highly reliable operating systems out.

Further, measuring means for measuring the number of invalidations by the invalidating means, storage means for storing a third predetermined value as an upper limit of the number of invalidations in advance, and invalidation of the measuring means. Comparing the measured value of the number of times of invalidation with the third predetermined value stored in the storage means of the third predetermined value, and outputting an abnormality detection signal when the measured value of the number of invalidation times is equal to or more than the third predetermined value. By providing the number-of-times comparing means, the number of times of invalidation of the initialization by the means for initializing the count value of the counter is measured, and the measured value of the number of times of invalidation is the third predetermined value which is the upper limit of the number of times of invalidation. When the value is greater than or equal to the value, the invalidation number comparison means can detect an abnormality, so that a runaway that forms a loop in a routine including a counter initialization instruction occurs, and the program is intentionally set. Cows invalidated outside of timing Can data initialization instruction detects an abnormality in the invalidation number comparing means when the number of occurrences of a third predetermined value or more, it is possible to realize a reliable operation of more systems.

[Brief description of the drawings]

FIG. 1 is a configuration diagram of a runaway detection circuit according to a first embodiment of the present invention.

FIG. 2 is a configuration diagram of a runaway detection circuit according to a second embodiment of the present invention.

FIG. 3 is a timing chart of the runaway detection circuit according to the first embodiment of the present invention.

FIG. 4 is a timing chart of the runaway detection circuit according to the first embodiment of the present invention.

FIG. 5 is a configuration diagram of a conventional runaway detection circuit.

FIG. 6 is a timing chart of a conventional runaway detection circuit.

[Explanation of symbols]

 Reference Signs List 1 microcontroller 2 WDT (watchdog timer) counter unit 3 WDT (watchdog timer) control register 4 CPU 5, 6, 9 register 7, 10 comparator 8 counter 11 bus 12 reset flag signal 13 reset command invalidation signal 14 WDT Overflow output signal 15 System reset signal 16, 17 AND gate 18 Inverter 19 Non-volatile memory

Claims (4)

[Claims] 1. A counter for counting a clock, abnormality detecting means for detecting an abnormality when the count value of the counter exceeds a first predetermined value, and initialization means for initializing the count value of the counter. A runaway detection circuit comprising: a second predetermined value storage means for storing in advance a second predetermined value smaller than the first predetermined value; a count value of the counter and the second predetermined value And a counter count value comparing means for comparing the count value with the second predetermined value stored in the storage means. When the count value of the counter is equal to or smaller than the second predetermined value, A runaway detection circuit provided with invalidation means for invalidating the initialization by the initialization means. 2. A measuring means for measuring the number of invalidations by the invalidating means; a third predetermined value storage means for storing a third predetermined value as an upper limit of the number of invalidations in advance; Comparing the invalidation count measurement value with the third predetermined value stored in the third predetermined value storage means, and when the invalidation count measurement value is equal to or greater than the third predetermined value, an abnormality detection signal 2. The runaway detection circuit according to claim 1, further comprising: an invalidation number comparison unit that outputs the output. 3. The runaway detection circuit according to claim 1, wherein the storage means for storing the second predetermined value comprises a nonvolatile memory. 4. The runaway detection circuit according to claim 2, wherein one or both of the storage means for the second predetermined value and the storage means for the third predetermined value are constituted by a nonvolatile memory.