JP2011175607A - Inspection device, method and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To perform inspection of a failure report line from a watch dog timer to a CPU in addition to inspection of the watch dog timer without stopping the CPU. <P>SOLUTION: The device includes the CPU 11 and the watch dog timer 20 which outputs, when a clear signal for resetting a counter is not obtain from the CPU 11 within a predetermined period, a failure report to the CPU 11 to report a failure of the CPU 11. The device has a normal period that is a period which the CPU 11 is caused to execute normal program processing, and a test period that is a period which does not hinder the normal program processing of the CPU 11. The CPU 11 outputs, in the test period, a test signal to the watch dog timer 20 to cause the watch dog timer 20 to output the failure report, and detects a failure of the watch dog timer 20 when the failure report cannot be obtained from the watch dog timer 20. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to an inspection apparatus, method, and program.

  Conventionally, a WDT (Watch Dog Timer) is known as a device that monitors a runaway of a CPU (Central Processing Unit). For example, the WDT periodically monitors the counter clear signal of the WDT output from the CPU, and determines that the CPU is in a runaway state when the counter clear signal cannot be detected. Further, after the determination, the WDT notifies the CPU of an abnormality so as to perform a process such as outputting a reset signal to return the CPU, or executing a non-maskable interrupt from software, and cope with the runaway of the CPU.

  Further, as a method for inspecting (testing) the presence or absence of WDT function abnormality from the CPU side, for example, a method for inspecting without stopping the CPU as in an in-vehicle electronic control device has been proposed. In Patent Document 1, when the CPU performs WDT inspection, the abnormality is notified to return the WDT test result through a path different from the path from which the abnormality notification is sent from the WDT to the CPU, and the CPU is reset during the WDT test. Techniques that will not be disclosed are disclosed. In Patent Document 2, two WDTs are provided, and the WDT is inspected without stopping the CPU by inspecting each of the WDTs one by one, and the CPU is also used from both WDTs (or during one of the WDT tests, A technique for resetting a CPU when an abnormality notification is acquired (from a non-test side WDT) is disclosed.

JP-A-5-216711 JP 2003-131906 A

  However, in the method of Patent Document 1 described above, the path for notifying the CPU of the abnormality from the WDT is not used during the WDT test execution. Therefore, even if there is an abnormality on the path, the abnormality of the path (for example, disconnection) is detected. There was a problem that I could not. Further, in the method of Patent Document 2 above, since the detection results of both WDTs are connected by a logic coupling circuit and the abnormality notification is not detected from both WDTs, the abnormality notification to the CPU is not transmitted. Even if there is an abnormality (for example, disconnection or the like) in the route for notification, there is a problem that the abnormality of the route cannot be detected during the test execution. Further, since two WDTs are required, there is a problem that the cost increases.

  The present invention has been made in view of such circumstances, and an inspection apparatus and method capable of inspecting a watchdog timer without stopping the CPU and inspecting an abnormality notification line for the CPU from the watchdog timer. The purpose is to provide a program.

In order to solve the above problems, the present invention employs the following means.
The present invention is a processor and a watchdog timer that outputs an abnormality notification for notifying the processor of an abnormality to the processor when a clear signal for resetting the counter is not acquired within a predetermined period from the processor, A normal period that is a period for causing the processor to execute normal program processing, and a test period that is a period that does not interfere with the program processing of the processor. In the period, a test signal is output to the watchdog timer to output the abnormality notification from the watchdog timer, and the abnormality detection of the watchdog timer is detected when the abnormality notification cannot be acquired from the watchdog timer Providing equipment.

  According to such a configuration, in the watch dog timer, when the clear signal for resetting the counter is not acquired from the processor within a predetermined period, the processor abnormality is notified from the watch dog timer to the processor. Also, the watchdog timer is checked for abnormalities during the test period, which is the normal period during which the processor executes normal program processing and the test period during which the processor program processing is not hindered. The In this way, during the test period that does not interfere with the program processing of the processor, the processor checks whether or not the watchdog timer is abnormal. Therefore, the program processing in the processor is interrupted to check the watchdog timer. There is nothing to do. Further, since it can be detected online without interruption of processor program processing, it can also be applied to applications that require compliance with safety-related standards such as EN50156.

  Further, during the test period, when the abnormality notification from the watchdog timer corresponding to the test signal output from the processor is not acquired by the processor, it is detected as an abnormality of the watchdog timer. In this way, even during the test period of the watchdog timer, by detecting an abnormality notification from the watchdog timer to the processor, the route between the watchdog timer or the watchdog timer and the processor can be tested, and the abnormality notification If there is an abnormality in the route for performing the operation, the abnormality can be detected. Thereby, a wider range of failure detection becomes possible. The abnormality notification is, for example, a high-priority maskable interrupt or an interrupt signal for executing a non-maskable interrupt (NMI: Non-Maskable Interrupt) from software. Furthermore, since only one watchdog timer is required, the cost can be reduced as compared with the case where a plurality of watchdog timers are used.

  The processor of the inspection apparatus does not output the clear signal in the test period, and uses as information a test signal the count value of the counter included in the watchdog timer immediately before the expiration of the predetermined period. The test signal may be output to the watchdog timer.

  Since the count value immediately before the expiration of the predetermined period is input as a test signal to the watchdog timer, the counter quickly expires for the predetermined period. Further, since a clear signal for resetting the counter is not output during the test period, the counter is surely expired for a predetermined period. In this way, since the count value of the watchdog timer can be promptly shifted to the expiration state for a predetermined period, the time taken to output an abnormality notification from the watchdog timer can be reduced. Can do.

  In the test period, the processor of the inspection apparatus does not output the clear signal but outputs the test signal, and the watchdog timer obtains the count value of the counter when the test signal is acquired. It may be set to a value immediately before the expiration of the predetermined period.

  The watchdog timer sets the count value of the counter to a value immediately before the expiration of the predetermined period based on the acquisition of the test signal, so that the counter quickly expires for the predetermined period. Further, since a clear signal for resetting the counter is not output during the test period, the counter is surely expired for a predetermined period. In this way, since the count value of the watchdog timer can be promptly shifted to the expiration state for a predetermined period, the time taken to output an abnormality notification from the watchdog timer can be reduced. Can do.

When the allowable range of the predetermined period of the inspection apparatus is set, the processor outputs, as a test signal, information that sets the count value to the count value before entering the allowable range with respect to the watchdog timer Immediately after the test, the clear signal for testing may be output.
The counter of the watchdog timer acquires the clear signal outside the allowable range of the predetermined period by acquiring the test clear signal immediately after the count value before entering the allowable range of the predetermined period is acquired. Therefore, an abnormality notification is output to the processor. Thereby, it is possible to detect a reset timing of the counter that is too early.

The inspection apparatus may further include scheduler means for defining a period between the normal period and the test period and switching timings of the periods.
Since the switching between the normal period and the test period is performed by the scheduler means, the timing is easily switched.

The watchdog timer of the inspection apparatus includes a plurality of the counters, and even if one of the counters adjusts the count value based on the test signal, the other counter adjusts the count value. Instead, when the test period shifts to the normal period, the count value of one of the counters may be matched with the count value of the other counter.
Thus, even when the count value is adjusted by the test signal and the measurement timing of the counter is shifted, it can be quickly returned to the original count value, and the reset signal from the processor can be accurately monitored. .

  The present invention is a processor and a watchdog timer that outputs an abnormality notification for notifying the processor of an abnormality to the processor when a clear signal for resetting the counter is not acquired within a predetermined period from the processor, An inspection method for an inspection apparatus comprising: a normal period that is a period during which the processor executes normal program processing; and a test period that is a period during which the processor does not interfere with the program processing And outputting a test signal from the processor to the watchdog timer to output the abnormality notification from the watchdog timer during the test period, and the watchdog timer according to the test signal. When the abnormality notification from is not acquired by the processor , To provide an inspection method and a process of detecting an abnormality of the watchdog timer in the processor.

  The present invention is a processor and a watchdog timer that outputs an abnormality notification for notifying the processor of an abnormality to the processor when a clear signal for resetting the counter is not acquired within a predetermined period from the processor, An inspection program for an inspection apparatus comprising: a normal period that is a period during which the processor executes normal program processing; and a test period that is a period during which the program processing of the processor is not hindered A process for outputting a test signal from the processor to the watchdog timer so that the abnormality notification is output from the watchdog timer during the test period, and the watchdog timer according to the test signal. The abnormality notification from is acquired by the processor If it has to provide a test program for executing a process for detecting an abnormality of the watchdog timer in the processor to the computer.

  The present invention has an effect that the watchdog timer can be inspected without stopping the CPU, and the abnormality notification line for the CPU can be inspected from the watchdog timer.

It is the block diagram which showed schematic structure of the inspection apparatus which concerns on the 1st Embodiment of this invention. It is a functional block diagram of the inspection apparatus which concerns on the 1st Embodiment and 2nd Embodiment of this invention. It is a figure for demonstrating the count-up of the counter with which WDT is equipped. It is an operation | movement flow of the test | inspection apparatus which concerns on the 1st Embodiment of this invention. It is a figure for demonstrating the counter with which WDT is provided in the inspection apparatus which concerns on the 2nd Embodiment of this invention. It is a figure for demonstrating WDT in the test | inspection apparatus which concerns on the 3rd Embodiment of this invention.

Hereinafter, an embodiment of an inspection apparatus, method, and program according to the present invention will be described with reference to the drawings.
[First Embodiment]
Hereinafter, a first embodiment of the present invention will be described with reference to FIG.
FIG. 1 is a block diagram showing a schematic configuration of the inspection apparatus according to the present embodiment.
As shown in FIG. 1, an inspection apparatus 10 according to the present embodiment is a computer system (computer system), and includes a CPU (Central Processing Unit) 11, a main storage device 12 such as a RAM (Random Access Memory), and an auxiliary storage. The apparatus 13 includes an input device 14 such as a keyboard and a mouse, an output device 15 such as a display and a printer, and a communication device 16 that exchanges information by communicating with external devices.
The auxiliary storage device 13 is a computer-readable recording medium, such as a magnetic disk, a magneto-optical disk, a CD-ROM, a DVD-ROM, or a semiconductor memory. Various programs (for example, inspection programs) are stored in the auxiliary storage device 13, and the CPU 11 reads out the programs from the auxiliary storage device 13 to the main storage device 12 and executes them to implement various processes.

  Moreover, in this embodiment, although demonstrated as the test | inspection apparatus 10 being a computer system, it is not limited to this. For example, it may be provided in a control device that performs some control. In the case of being provided in the control device, the input device 14 is replaced with a keyboard or a mouse, the input module, and the output device 15 is replaced with a display or a printer. Output module.

Next, the processing content performed in each part with which the inspection apparatus 10 mentioned above is provided is demonstrated with reference to FIG. 2 are realized by the CPU 11 reading out the inspection program stored in the auxiliary storage device 13 to the main storage device 12 and executing it.
FIG. 2 is a functional block diagram showing the functions provided in the inspection apparatus 10 in an expanded manner. As shown in FIG. 2, the inspection apparatus 10 includes a CPU (processor) 11, a watchdog timer (hereinafter referred to as “WDT”) 20, and a scheduler unit (scheduler means) 21.

The scheduler unit 21 defines a period between a normal period and a test period, and outputs a switching instruction for each period to the CPU 11. Specifically, the scheduler unit 21 manages a current execution process (not shown), manages the execution state of each process, has a table or scheduling algorithm in which a scheduling order is described, In accordance with this, determination (scheduling) and switching (dispatching) of processing to be performed next are performed. The scheduler unit 21 is driven by, for example, a timer handler started from an external timer or a system call from each process.
Here, the normal period is a period during which the CPU 11 executes normal program processing, and the test period is a period during which the normal program processing of the CPU 11 is not hindered. Are referred to as a normal mode and a WDT test mode. Further, the period in which the program processing is not hindered is, for example, the idle time (idle period) of the periodic processing.

The CPU 11 includes a normal program processing unit 111 that executes a normal program during a normal period, and an interrupt processing unit 112 that executes an interrupt handler including an abnormal program and a test program for the WDT 20.
The normal program processing unit 111 outputs, at a predetermined interval, a clear signal that is a signal that causes a counter 201 (details will be described later) provided in the WDT 20 to be an initial value for the WDT 20 during a normal period. Specifically, during the normal period, the normal program processing unit 111 outputs a clear signal at predetermined intervals when the program being executed is not in an abnormal state such as runaway or stop.

  Based on the interrupt processing instruction acquired from the WDT 20, the interrupt processing unit 112 processes an abnormal program during a normal period, and processes a test program for the WDT 20 during a test period. When the interrupt processing unit 112 processes a test program for the WDT 20, based on the test period start command from the scheduler unit 21, the WDT 20 test (hereinafter referred to as “WDT test”) that checks for an abnormality in the operation of the WDT 20. )do. Specifically, the interrupt processing unit 112 detects that it is a test period based on a flag notified that it is in the WDT test mode, and detects that the WDT test mode is started, the auxiliary storage device The test program for the WDT 20 stored in the memory 13 is read out, a clear signal is not output, and a test signal is output to the WDT 20 so that an abnormality notification is output from the WDT 20.

  For example, when the WDT test is started, the interrupt processing unit 112 does not output a clear signal, and the counter 201 of the WDT 20 has a count value (for example, 49) immediately before the expiration of a predetermined period (for example, 0 to 50). A test signal including the information and notification information for starting the WDT test is output to WDT 20. Further, the interrupt processing unit 112 determines that there is an abnormality in the path between the WDT 20 and the CPU 11 or the WDT 20 when the abnormality notification is not acquired from the WDT 20 even though the test signal is output. The interrupt processing unit 112 determines that there is no abnormality in the path between the WDT 20 and the CPU 11 and the WDT 20 when an abnormality notification is acquired from the WDT 20 in accordance with the output test signal.

If the interrupt processing unit 112 determines that there is an abnormality in the path between the WDT 20 and the CPU 11 or the WDT 20, the CPU 11 is terminated with an abnormal time. When the interrupt processing unit 112 determines that there is no abnormality in the path between the WDT 20 and the WDT 20 and the CPU 11, the WDT 20 outputs a command for returning from the WDT test mode to the normal mode.
On the other hand, when the interrupt processing unit 112 processes an abnormal program, the interrupt processing unit 112 executes processing based on the abnormal program.

  The WDT 20 includes a counter 201 and an output unit 202. The counter 201 starts counting up based on a processing start signal from the CPU 11 (for example, increases the count value by 1), and starts measuring time. The counter 201 detects a timeout when the clear signal is not acquired within a predetermined period. The output unit 202 outputs an abnormality notification to the CPU 11 in response to the timeout detection of the counter 201. The abnormality notification is, for example, a high-priority maskable interrupt or an interrupt signal for executing a non-maskable interrupt (NMI: Non-Maskable Interrupt) from software.

  Also, the counter 201 performs a count-up that increases the counter value to be larger than a normal increase (for example, one by one) based on the acquired test signal in the test period, and does not acquire the clear signal within the predetermined period Timeout is detected. When the timeout is detected in the counter 201, the output unit 202 outputs an abnormality notification to the CPU 11.

  For example, as shown in FIG. 3, when the WDT test is started, the counter 201 of the WDT 20 is based on a test signal acquired from the CPU 11 (for example, information that the WDT test is started and the count value is set to 49). The count value is increased (for example, changed to the count value 49), and the count value until the WDT 20 times out is shortened (for example, the test period T is set). In the test period, the clear signal is not output from the CPU 11, so that the counter 201 cannot detect the clear signal within the predetermined period, and the counter 201 detects a timeout. Thus, since the time until the counter 201 times out is shortened, the time taken to output the abnormality notification from the output unit 202 can be reduced, and the time taken for the WDT test can be reduced.

Next, the operation of the inspection apparatus 10 according to the present embodiment will be described with reference to FIGS.
When the scheduler unit 21 notifies the CPU 11 that the normal period is shifted to the test period, the CPU 11 notifies the interrupt processing unit 112 of the test mode notification information in which the test mode flag is enabled. (Step SA1). The interrupt processing unit 112 notified of the test mode outputs a test signal to the WDT 20, and notifies the WDT 20 that the WDT test is started (step SA2). When the WDT 20 detects the start of the WDT test, the counter 201 is incremented, and it is determined whether or not a timeout of the WDT 20 has occurred (step SA3).

  When a timeout is detected in the counter 201 of the WDT 20, an abnormality notification is output from the output unit 202 to the CPU 11 via the abnormality notification line as an interrupt process (step SA4). In the interrupt processing unit 112 of the CPU 11, when an abnormality notification is acquired, it is determined whether or not the test mode is set (step SA5). If the CPU 11 determines that the test mode is set, the test mode flag is cleared (step SA6). After a predetermined time has elapsed, the CPU 11 detects the value of the test flag in the interrupt processing unit 112 (or a subroutine called from the interrupt handler) (step SA7). On the other hand, when the timeout of the counter 201 is not detected in step SA3 even though the timeout of the WDT 20 has occurred, the value of the test flag is detected after a predetermined time has elapsed (step SA7).

Subsequently, the CPU 11 determines whether or not the test mode is set (step SA8). If the test mode is not set, the CPU 11 outputs a command for returning to the normal operation of the WDT 20 to the WDT 20 (step SA9). . When the WDT 20 obtains the return command, the WDT 20 returns from the WDT test mode to the normal mode (step SA10), and ends this process. In step SA8, it is determined whether or not the test mode is set. If the test mode is set (for example, if a WDT timeout is not detected and the test mode flag is not cleared in step SA3), the WDT 20 and the CPU 11 The CPU 11 alone is abnormally terminated (step SA11).
In step SA5, it is determined whether or not the test mode is set, and if it is determined that the test mode is not set, the CPU 11 detects its own abnormality, the CPU 11 alone is terminated, and the present process is terminated (step SA11). .

  As described above, according to the inspection apparatus 10 and the method and the program according to the present embodiment, the normal period in which the CPU 11 executes the normal program process and the normal program process of the CPU 11 are hindered. During the test period, which is a period during which the WDT 20 is not used, the WDT 20 is inspected for abnormality during the test period. In this way, during the test period in which the normal program processing of the CPU 11 is not hindered, the abnormality of the WDT 20 by the CPU 11 is inspected, so that the normal program processing in the CPU 11 is interrupted for the inspection of the WDT 20. There is nothing to do. In addition, since normal program processing in the CPU 11 can be inspected online without interruption, it is required to be able to detect abnormalities in the abnormality detection / protection device itself such as a watchdog timer, complying with safety-related standards such as EN50156 Can be applied to applications that require

  Further, during the test period, when an abnormality notification output from the WDT 20 according to a test signal output from the CPU 11 is not acquired by the CPU 11, an abnormality of the WDT 20 is detected. As described above, even during the test period of the WDT 20, since the abnormality notification from the WDT 20 to the CPU 11 is detected, the path from the WDT 20 and the WDT 20 to the CPU 11 can be tested, and the abnormality notification path has an abnormality. The abnormality can be detected. Thereby, a wider range of failure detection becomes possible. Further, only one WDT 20 is required, and the cost can be reduced as compared with the case where a plurality of WDTs 20 are used.

  In the present embodiment, the test signal output from the CPU 11 includes information for changing the count value of the WDT 20 to the count value immediately before the expiration of the predetermined period. However, the present invention is not limited to this. For example, the test signal output from the CPU 11 includes only notification information for starting the WDT test, and the WDT 20 that has acquired the test signal counts the count value immediately before expiration of a predetermined period based on the test signal. It may be changed to a value. Thereby, the test signal output from the CPU 11 can be simplified.

  In this embodiment, the counter of the WDT 20 is a count-up method that increases the count value from an initial value (for example, 0) to a predetermined value (for example, 50). It may be a countdown method in which the value is decreased from an initial value (for example, 50) to a predetermined value (for example, 0).

  In the present embodiment, the inspection apparatus is configured by providing the CPU 11 and the WDT 20 in the same apparatus (computer system). However, the present invention is not limited to this. For example, the inspection apparatus may be configured by connecting a computer system including the CPU 11 and the WDT 20 so as to be communicable (information can be exchanged).

[Second Embodiment]
Next, an inspection apparatus according to a second embodiment of the present invention will be described with reference to FIGS. The inspection device of this embodiment is different from the first embodiment in that a test signal for setting the count value of the WDT 20 to a value before entering the allowable range from the CPU 11 when the allowable range for a predetermined period is set in advance. Is a point to output. Hereinafter, regarding the inspection apparatus according to the present embodiment, description of points that are the same as those of the first embodiment will be omitted, and differences will be mainly described.

  In the present embodiment, as shown in FIG. 5, the allowable range for the predetermined period is 21 to 60, and the count value before the predetermined range included in the test signal output from the CPU 11 is set to 10 before the allowable range. An example will be described. Although the description will be made assuming that the allowable range is 21 to 60 and the count value before the allowable range is 10, the allowable range and the count value before the allowable range are not limited to this.

During the test period, the CPU 11 outputs a test signal that causes the WDT 20 to set the count value 10 before the allowable range. Subsequently, the CPU 11 outputs a test clear signal (hereinafter referred to as “test clear signal”). The test clear signal is a signal for setting the counter value of the counter 201 of the WDT 20 to an initial value during the test period.
When receiving the test signal and the test clear signal at time t1, the WDT 20 sets the count value of the counter 201 to a count value before the allowable range (for example, the count value 10) based on the test signal in the test period. . Further, when the WDT 20 acquires the test clear signal immediately after that, the WDT 20 detects that the clear signal is acquired outside the allowable range, and outputs an abnormality notification to the CPU 11. In other words, the WDT 20 detects that the output timing of the clear signal from the CPU 11 is too early, and outputs an abnormality notification to the CPU 11.

If the WDT 20 has acquired the test clear signal immediately after setting the count value of the counter 201 to a value before the allowable range, but does not output an abnormality notification to the CPU 11, the CPU 11 This means that the reset timing that is too early cannot be detected.
In this way, the CPU 11 outputs a test signal for setting a count value before the allowable range, and immediately after that outputs a clear signal (test clear signal) of the counter 201 to detect the presence or absence of an abnormality notification from the WDT 20. Thus, it is possible to perform a WDT test as to whether or not a reset timing that is too early can be detected.

[Modification]
In the present embodiment, the CPU 11 sends the WDT 20 information including a count value before a predetermined range as a test signal. Instead, the CPU 11 sets the count value of the counter 201 to an initial value (for example, 0). ) May be used as a test signal to detect a reset timing that is too early.

[Third Embodiment]
Next, an inspection apparatus according to a third embodiment of the present invention will be described with reference to FIG. The inspection apparatus of this embodiment is different from the first embodiment and the second embodiment in that the WDT 20 includes a plurality of counters. Hereinafter, regarding the inspection apparatus according to the present embodiment, description of points that are common to the first and second embodiments will be omitted, and different points will be mainly described.
The WDT 20 includes a plurality of counters, and even if one counter adjusts the count value based on the test signal, the other counter does not adjust the count value and changes from the test period to the normal period. When shifting, the count value of one counter is matched with the count value of the other counter.

  For example, FIG. 6 shows that the WDT 20 is provided with two counters Ca and Cb. The counter Ca is used as a counter of the WDT 20 in the normal period and the test period. On the other hand, the counter Cb is a copy counter that is referred to when the counter Ca shifts from the test period to the normal period. As shown in FIG. 6, when the test of the WDT 20 is started at time t2, the count value of the counter Ca is counted up based on the test signal from the CPU 11 (for example, up to the count value immediately before expiration of the predetermined period). Even if the count value of the counter Cb is in the test period, the count increase in the normal period (for example, one count increase) is continued.

When the test of WDT 20 is completed at time t3, the WDT test mode is shifted to the normal mode. At this time, the count value of the counter Ca is copied with reference to the count value of the counter Cb at time t3.
In this way, even if the measurement timing of the counter deviates due to the counter Ca being counted up and the count value being controlled, the counter Ca is corrected when shifting from the WDT test mode to the normal mode. Even when the period is restored, the reset signal from the CPU 11 can be accurately monitored.

  In the present embodiment, the plurality of counters have been described as being configured using a plurality of hardware timers, but the present invention is not limited to this. For example, a software timer configured by software using a single hardware timer may be used, or a combination of a hardware timer and a software timer may be used.

10 Inspection device 11 CPU
20 WDT
21 scheduler section 201 counter

Claims (8)

A processor;
A watchdog timer that outputs an abnormality notification for notifying the processor of an abnormality to the processor when a clear signal for resetting the counter is not acquired within a predetermined period from the processor;
A normal period that is a period for causing the processor to execute normal program processing; and a test period that is a period that does not interfere with the program processing of the processor;
The processor is
In the test period, a test signal is output to the watchdog timer to output the abnormality notification from the watchdog timer, and the abnormality of the watchdog timer is detected when the abnormality notification cannot be obtained from the watchdog timer Inspection device to do.   The processor does not output the clear signal during the test period, and sets the count value of the counter included in the watchdog timer to a count value immediately before expiration of the predetermined period as a test signal, and the test signal The inspection apparatus according to claim 1, wherein the output is output to the watchdog timer. The processor does not output the clear signal in the test period, outputs the test signal,
The inspection device according to claim 1, wherein the watchdog timer sets the count value of the counter to a value immediately before expiration of the predetermined period when the test signal is acquired. When an allowable range of the predetermined period is set,
The said processor outputs the said clear signal for a test immediately after outputting the information which makes the said count value the count value before entering the said tolerance | permissible_range as a test signal with respect to the said watchdog timer. Inspection equipment.   The inspection apparatus according to any one of claims 1 to 4, further comprising a scheduler that defines a period between the normal period and the test period and switches a timing of each period. The watchdog timer includes a plurality of the counters,
Even when one of the counters has a count value adjusted based on the test signal, the other counter does not adjust the count value, and when one of the counters shifts from the test period to the normal period, The inspection apparatus according to claim 2, wherein the count value of the counter is matched with the count value of the other counter. A test comprising: a processor; and a watchdog timer that outputs an abnormality notification for notifying the processor of an abnormality of the processor when a clear signal for resetting the counter is not acquired within a predetermined period from the processor. A method for inspecting a device,
When a normal period that is a period for causing the processor to execute normal program processing and a test period that is a period that does not hinder the program processing of the processor are defined,
Outputting a test signal from the processor to the watchdog timer to output the abnormality notification from the watchdog timer in the test period;
And a step of detecting an abnormality of the watchdog timer in the processor when the abnormality notification from the watchdog timer according to the test signal is not acquired by the processor. A test comprising: a processor; and a watchdog timer that outputs an abnormality notification for notifying the processor of an abnormality of the processor when a clear signal for resetting the counter is not acquired within a predetermined period from the processor. A device inspection program,
When a normal period that is a period for causing the processor to execute normal program processing and a test period that is a period that does not hinder the program processing of the processor are defined,
Processing to output a test signal from the processor to the watchdog timer so as to output the abnormality notification from the watchdog timer in the test period;
An inspection program for causing a computer to execute processing for detecting an abnormality of the watchdog timer in the processor when the abnormality notification from the watchdog timer according to the test signal is not acquired by the processor.

Images