JP2008225807A - Control device, and program runaway monitoring method for the same - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a control device and a program runaway monitoring method therefor that can detect a program runaway and restart or stop the program promptly before the runaway causes failures such as memory destruction while facilitating additions to, modifications to and migrations of initial processing and without employing any special circuits for program runaway detection. <P>SOLUTION: The control device comprises an interrupt trigger part 7 for triggering interrupt handling when a general purpose timer 12 times out, and an interrupt handling part 8 for executing the interrupt handling. A watchdog processing part 6 sets the timer time of the general purpose timer 12 and the number of resets of a watchdog timer 11, and during initial processing, permits interrupts from the general purpose timer 12 to reset the watchdog timer 11 by the set number in the interrupt handling. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a control device that is equipped with a CPU and performs various controls by a software program and a method for monitoring the program runaway.

  Conventionally, as a means of monitoring program runaway of control unit software, a timer called a watchdog timer has been provided that can be reset by a program. If a program does not reset within a set period of time and the program times out, program runaway In many cases, the control device is forcibly stopped or the program is restarted. In this case, the time set for the watchdog timer is generally set to the maximum time allowed for the control device.

FIG. 4 is a block diagram illustrating a configuration example of a control device using a conventional watchdog timer.
In FIG. 4, reference numeral 1 </ b> A denotes a control device, which includes a central control unit 2 </ b> A and a watchdog timer 11. The watchdog timer 11 is a timer having a certain set time. A is a reset signal for the watchdog timer, and is reset to the timer when the program is input to the watchdog timer 11 by a program, and the timer is restarted. Thereafter, every time the signal a is output by the program, the reset and restart of the watchdog timer 11 are repeated. “b” is a time-out signal of the watchdog timer 11, which is output when the signal “a” is not output within the time set in the watchdog timer 11 by the program, and is used thereafter for program restart or forced stop conditions.
Here, considering the processing of the program, the processing contents are generally divided into initial processing and normal processing.
In FIG. 4, the central processing unit 2 </ b> A includes an initial processing unit 4 that performs initial processing and a normal processing unit 5 that performs normal processing. There is also a watchdog processing unit 6A that outputs a reset signal a to the watchdog timer 11.

FIG. 5 is a flowchart showing a processing procedure of a program of a conventional control device. After the start, first, the initial process is performed over time t1 (S22), and then the normal process is performed at time t2 (S24). In general, when initial processing is compared with normal processing, the initial processing time is often significantly longer than the normal processing time (t1 >> t2) due to various initial setting processing to the memory area. In this case, as shown in the flowchart of FIG. 5, when resetting the watchdog timer in S21 and S23, the watchdog timer needs to set the time based on the longer of t1 and t2, ie, t1, In many cases, the upper limit of the time that can be set in the dog timer is exceeded, and there is a problem that the time cannot be set with reference to t1.
In such a case, that is, when the time of the watchdog timer cannot be set with reference to t1, a method of setting the set time of the watchdog timer slightly longer than t2 has been taken.

  FIG. 6 is a flowchart showing the processing procedure of the program runaway monitoring method when the set time of the watchdog timer is set slightly longer than t2. In the initial process, the watchdog timer is reset every time t2. By doing this, it is possible to detect a program runaway that occurs during the initial processing, and to make it possible to restart or stop the program immediately before a failure such as memory destruction due to the runaway occurs.

In addition, two watchdog timers are used to switch the monitoring time between the initial process and the normal process, the timeout signal of each watchdog timer is input to the OR gate, and the program runaway is detected by the output signal from the OR gate. A method has been proposed (see, for example, Patent Document 1).
JP-A-60-164852 (Fig. 3)

  However, in the method of resetting the watchdog timer every time t2 in the initial process in the conventional method, the program is changed so that the watchdog timer is reset every time t2 every time the initial process is added, changed, or moved There is a problem that it takes time and effort. In addition, the method of using two watchdog timers to switch the monitoring time between the initial process and the normal process requires a special hardware circuit, which complicates the circuit and increases the cost.

  The present invention has been made in view of such problems, and can easily cope with the addition, change, and movement of initial processing, and without providing a special circuit for detecting program runaway. It is an object of the present invention to provide a control device and a program runaway monitoring method capable of detecting a runaway and promptly restarting or stopping a program before a malfunction such as memory destruction due to the runaway occurs.

In order to solve the above problem, the present invention is as follows.
The invention described in claim 1 is a timer that can be reset by a reset signal, and includes a watchdog timer that outputs a timeout signal when a timeout occurs without being reset within a predetermined time, and a central control unit that controls the entire apparatus. The central control unit includes a CPU, an initial processing unit that performs initial processing at power-on, a normal processing unit that performs normal processing after the initial processing, and a watchdog process that performs reset processing of a watchdog timer A control unit comprising a general-purpose timer in the control device, the central processing unit having an interrupt activation unit for starting an interrupt process when the general-purpose timer times out, and an interrupt process for executing the interrupt process The watchdog processing unit includes a timer time of the general-purpose timer and a previous time Set the number of times to reset the watchdog timer, during the initial process run enables interrupts from the general-purpose timer, and is characterized in that only reset a set number of times the watchdog timer by the interrupt processing.
The invention according to claim 2 is the control device according to claim 1, wherein the watchdog processing unit sets a timer time of the general-purpose timer to be shorter than a timer time of the watchdog timer. Is.
According to a third aspect of the present invention, in the control device according to the first aspect, the watchdog processing unit sets the number N of times of resetting the watchdog timer, the initial processing time t1, and the timer time of the general-purpose timer. When t4 is set, the number is set such that t4 * N> t1.
According to a fourth aspect of the present invention, in the control device according to the first aspect, the watchdog processing unit prohibits the interruption of the general-purpose timer after the completion of the initial processing, and uses the general-purpose timer for other purposes. It is characterized by making a setting for this.

The invention according to claim 5 is a timer that can be reset by a reset signal, a watchdog timer that outputs a time-out signal when a time-out occurs without being reset within a fixed time, a central control unit that controls the entire apparatus, The central control unit includes a CPU, an initial processing unit that performs initial processing at power-on, a normal processing unit that performs normal processing after the initial processing, and a watch that performs reset processing of the watchdog timer In a program runaway monitoring method for a control device having a dog processing unit, the control device includes a general-purpose timer, and the central processing unit includes an interrupt activation unit that activates interrupt processing when the general-purpose timer times out, and An interrupt processing unit for executing interrupt processing, the timer time of the general-purpose timer, The number of times to reset the watchdog timer is set, an interrupt from a general-purpose timer is permitted during the execution of the initial process, and the watchdog timer is reset by the set number of times in the interrupt process. .
The invention according to claim 6 is the program runaway monitoring method of the control device according to claim 5, wherein the timer time of the general-purpose timer is set shorter than the timer time of the watchdog timer. is there.
Further, according to a seventh aspect of the present invention, in the program runaway monitoring method of the control device according to the fifth aspect, the number N of times of resetting the watchdog timer is defined as an initial processing time t1, a general-purpose timer time t4. In this case, the number is set such that t4 * N> t1.
Further, according to an eighth aspect of the present invention, in the program runaway monitoring method of the control device according to the fifth aspect, the general-purpose timer is prohibited from being interrupted after the initial process is completed, and the general-purpose timer is used for other purposes. It is characterized by setting.

  According to the present invention, a general-purpose timer is provided, interrupt processing is started when the general-purpose timer times out, and the timer time of the general-purpose timer and the number of times to reset the watchdog timer are set. Since interrupts are enabled and the watchdog timer is reset for the number of times set in the interrupt process, if the initial process is added, changed, or moved, it can be easily handled by changing the number of times the watchdog timer is reset. In addition, by making effective use of general-purpose timers that are generally equipped in control devices, it is possible to detect program runaway without providing a special circuit for program runaway detection, and to prevent problems such as memory corruption due to runaway. The program can be restarted or stopped as soon as possible

  Hereinafter, specific examples of the method of the present invention will be described with reference to the drawings.

FIG. 1 is a block diagram showing the configuration of the control device of the present invention.
In FIG. 1, reference numeral 1 denotes a control device, which includes a central control unit 2, a watchdog timer 11, and a general-purpose timer 12. The watchdog timer 11 is a timer having a certain set time. A is a reset signal for the watchdog timer, and is reset to the timer when the program is input to the watchdog timer 11 by a program, and the timer is restarted. Thereafter, every time the signal a is output by the program, the reset and restart of the watchdog timer 2 are repeated. “b” is a time-out signal of the watchdog timer, which is output when the signal “a” is not output within the time set in the watchdog timer 11 by the program, and is used thereafter for program restart or forced stop conditions.
The watchdog timer central control unit 2 includes a CPU 3, an initial processing unit 4 composed of a software initial processing program, a normal processing unit 5 composed of a normal processing program, and a watchdog process for performing processing related to the watchdog timer 11 There are an interrupt activation unit 7 that activates the interrupt processing 8 in response to an interrupt signal that is output when the general-purpose timer times out, and an interrupt processing unit 8 that is activated from the interrupt activation unit 7.
The present invention is different from the prior art in that the central control unit 2 is provided with an interrupt processing unit 8 that is activated when the general-purpose timer 12 is timed out and an interrupt activation unit 7 that is activated.
In general, a control device is equipped with one or more general-purpose timers that can be used for various purposes such as a free-run timer for calculating an elapsed time and a timer for generating a fixed period signal. There is no need for new equipment. c is an interrupt signal generated whenever the time set in the general-purpose timer 12 times out, and is input to the central control unit 2 to start the interrupt processing program in the interrupt processing unit 8.

  FIG. 2 is a flowchart showing the processing procedure of the program runaway monitoring method of the present invention. In this flowchart, S1 to S4 and S6 to S8 are processed by the watchdog processing unit 6, S5 is processed by the initial processing unit 4, and S9 is processed by the normal processing unit 5. First, the timer time t3 is set in the watchdog timer 11 (S1). If the time set in the watchdog timer 2 is fixed by hardware and cannot be set by a program, this processing is unnecessary, and t3 is the time fixed by hardware. Next, the timer time t4 is set in the general-purpose timer 12 (S2). Here, t4 is set to be shorter than t3.

  Next, the number N of times the watchdog timer 11 is reset in the interrupt processing program activated by the general-purpose timer 12 is set in the variable i (S3). N is selected so that t4 * N is longer than the initial processing time t1. For example, when t1 = 500 ms and t4 = 10 ms, since t4 * N> t1, N> 500 ms / 10 ms = 50, and N is set to a value larger than 50, that is, 51 to the variable i. Similarly, when the initial process is added, changed, or moved, and the initial process time t1 is changed, the value N set in the variable i may be changed. If it is changed to t1 = 1s, N> 1000 ms / 10 ms = 100, and N is set to a value larger than 100, that is, 101 to the variable i. As described above, when the initial process is added, changed, or moved, it can be easily dealt with by simply changing the number N of times the watchdog timer 2 is reset.

Next, the interrupt of the general-purpose timer 3 is permitted (S4).
As a result, the general-purpose timer 12 outputs an interrupt signal c to the central control unit 2 in FIG. 1 every t4. The interrupt activation unit 7 of the central control unit 2 activates the interrupt processing program of the interrupt processing unit 8.
FIG. 3 is a flowchart showing the processing procedure of the interrupt program. First, it is checked whether the variable i is other than 0 (S11). If it is not 0, the watchdog timer is reset (S12), and the variable i is decremented by 1 (S13).
Returning to the description of FIG. 2, during the initial process (S5), the watchdog timer 11 is reset at an interval of t4 by the process of S12 of FIG. This process is repeated until the number of processes reaches N. Since t4 * N is selected to be longer than the initial processing time t1, the watchdog timer 2 does not time out in the initial processing (S5). If the initial processing time t1 is extended due to a program runaway, that is, if the initial processing continues to be executed even if the number of processing reaches N times, the watchdog timer 11 is not reset. 11 timeouts occur, and program runaway can be detected.

  After the completion of the initial process (S5), the interrupt of the general-purpose timer 12 is prohibited (S6). Next, settings are made to use the general-purpose timer 12 for other purposes (S7). For example, the general-purpose timer 12 is set to be used as a free-run timer for calculating the elapsed time. Thereafter, the resetting of the watchdog timer 11 is repeated for each round of normal processing (S8, S9). Note that the time set in the watchdog timer 11 may be different between the period t1 and the period t2. In that case, if the set time in the period t2 is t5, the setting of t5 is performed immediately after S7.

  As described above, according to the present invention, by using the general-purpose timer and one watchdog timer that are generally equipped in the control device, the program runaway is detected, and the malfunction such as memory destruction due to the runaway is detected. The program can be restarted or stopped as soon as possible.

The block diagram which shows the structure of the control apparatus of this invention The flowchart which shows the process sequence of the program runaway monitoring method of this invention Flow chart showing interrupt program processing procedure The block diagram which shows the structural example of the control apparatus which uses the conventional watchdog timer The flowchart which shows the processing procedure of the conventional program The flowchart which shows the processing procedure of the conventional program runaway monitoring method

Explanation of symbols

1, 1A control device 2, 2A central control unit 3 CPU
4 Initial processing unit 5 Normal processing unit 6, 6A Watchdog processing unit 7 Interrupt activation unit 8 Interrupt processing unit 11 Watchdog timer 12 General-purpose timer

Claims (8)

A timer that can be reset by a reset signal, a watchdog timer that outputs a timeout signal when a timeout occurs without being reset within a certain time, and
It consists of a central control unit that controls the entire device,
In the central control unit, a CPU,
An initial processing unit that performs initial processing at power-on;
A normal processing unit for performing normal processing after the initial processing;
In a control device having a watchdog processing unit for resetting a watchdog timer,
A general-purpose timer is provided in the control device,
An interrupt activation unit that activates an interrupt process when the general-purpose timer times out to the central processing unit;
An interrupt processing unit for executing the interrupt processing,
The watchdog processing unit sets the timer time of the general-purpose timer and the number of times to reset the watchdog timer,
While executing the initial process, enable interrupts from the general-purpose timer.
A control device that resets the watchdog timer a set number of times in the interrupt processing.   The control device according to claim 1, wherein the watchdog processing unit sets a timer time of the general-purpose timer to be shorter than a timer time of the watchdog timer.   The watchdog processing unit sets the number of times N for resetting the watchdog timer in such a number that t4 * N> t1, where t1 is an initial processing time and t4 is a timer time of a general-purpose timer. The control device according to claim 1, wherein:   The control device according to claim 1, wherein the watchdog processing unit prohibits the interruption of the general-purpose timer after the completion of the initial processing, and makes settings for using the general-purpose timer for other purposes. A timer that can be reset by a reset signal, a watchdog timer that outputs a timeout signal when a timeout occurs without being reset within a certain time, and
It consists of a central control unit that controls the entire device,
In the central control unit, a CPU,
An initial processing unit that performs initial processing at power-on;
A normal processing unit for performing normal processing after the initial processing;
In a program runaway monitoring method of a control device having a watchdog processing unit for resetting a watchdog timer,
A general-purpose timer is provided in the control device,
An interrupt activation unit that activates an interrupt process when the general-purpose timer times out to the central processing unit;
An interrupt processing unit for executing the interrupt processing,
Set the timer time of the general-purpose timer and the number of times to reset the watchdog timer,
While executing the initial process, enable interrupts from the general-purpose timer.
A program runaway monitoring method for a control apparatus, wherein the watchdog timer is reset a set number of times in the interrupt processing.   6. The program runaway monitoring method for a control device according to claim 5, wherein a timer time of the general-purpose timer is set shorter than a timer time of the watchdog timer.   6. The number N of times for resetting the watchdog timer is set to a number such that t4 * N> t1, where t1 is an initial processing time and t4 is a timer time of a general-purpose timer. Program runaway monitoring method for the control unit of the system.   6. The program runaway monitoring method for a control device according to claim 5, wherein after the initial process is finished, interrupting of the general-purpose timer is prohibited, and settings are made to use the general-purpose timer for other purposes.

Images