JP4063699B2 - Program runaway detection circuit - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a program runaway detection circuit, and more particularly to a program runaway detection circuit applicable to a watchdog timer such as a microprocessor system.
[0002]
[Prior art]
Conventionally, various circuits for detecting runaway control programs in microprocessor systems have been proposed. As such a program runaway detection circuit, the control program itself and its sequence execution process are monitored, and the operation of the CPU, which is the central part of the arithmetic control, is monitored to monitor the malfunction of the transmitted control signal. There is something to do.
[0003]
For example, with regard to the operation of the CPU, in the “program runaway detection circuit” of a single chip microcomputer, a watchdog timer is started by a program signal output from the CPU, and when the overflow occurs, a program runaway detection circuit Is reset. In addition, after the activation, one-shot mono-multi prohibits detection of overflow only for a predetermined period, thereby guaranteeing normal operation within the reset sequence of the watchdog timer (see, for example, Patent Document 1).
[0004]
[Patent Document 1]
Japanese Patent Laid-Open No. 2-5149 (page 2, FIG. 1)
[0005]
[Problems to be solved by the invention]
However, the program runaway detection circuit according to the conventional example has the following problems.
In such a watchdog timer, when the control program of the arithmetic processing circuit (CPU) cannot instruct the CPU to periodically reset the timer (reset sequence), it is determined that this is a program runaway. Therefore, as long as the reset sequence is executed and the timer reset is continuously commanded, there is a possibility that such a program runaway may not be detected even if the control program remains in a runaway state in the CPU.
[0006]
An object of the present invention is to provide a program runaway detection circuit capable of detecting a runaway mode in which a program sequence remains in a state in which a timer reset command is issued in a CPU. And
[0007]
[Means for Solving the Problems]
To achieve the above object, a program runaway detection circuit according to claim 1 of the present invention is a program runaway detection circuit for detecting a program runaway in an arithmetic processing unit of a software-controlled microprocessor system,
When the microprocessor system is started, the elapsed time starts to be measured, and the program signal output from the arithmetic processing unit almost regularly by the control program is initialized to transit to the valid state, and the program signal enters the valid state. First timer means for detecting the first runaway mode when the transition is delayed;
It said program signal starts to measure the elapsed time by the transition to a valid state, the the program signal transitions to the invalid state is initialized, the program signal detecting the valid state continues to hold the second runaway mode And a second timer means.
[0008]
With this configuration, when the control program is normally executed in the CPU, a periodic program signal is introduced into the first timer and initialization is performed. When normal execution is delayed, the program signal is delayed, so that the program runaway is detected as the first runaway mode without being initialized. When the program signal is introduced into the second timer means, the elapsed time of the program signal is periodically and repeatedly measured. If any malfunction occurs in the CPU and the program signal continues to be output, the second timer is not initialized, so that the second runaway mode is detected. Therefore, even if a runaway mode in which the program sequence remains in the state where the timer reset is commanded in the CPU occurs, it is possible to detect a program runaway including these modes.
[0009]
3. The program runaway detection circuit according to claim 2, wherein the first timer means has a counter for measuring an elapsed time by counting the number of clock signals in the microprocessor system, and the count value is calculated by an arithmetic processing unit. The program is reset by the program signal.
[0010]
By comprising in this way, the elapsed time in a 1st timer means can be measured without malfunction by digital signal processing.
[0011]
4. The program runaway detection circuit according to claim 3, wherein the first timer means has a comparison circuit for comparing an elapsed time with a reference time, and when the elapsed time exceeds the reference time, an effective state of the program signal The transition to is delayed.
[0012]
With this configuration, it is possible to quantitatively determine the delay of the program signal based on the reference time.
[0013]
5. The program runaway detection circuit according to claim 4, wherein the first timer means has a control circuit for setting a reference value for detecting the first runaway mode, and the reference value is based on a cycle of the program signal. Also, by setting a long time, the delay of the transition to the valid state of the program signal is detected.
[0014]
With this configuration, it is possible to realize flexible management for the detection of the first runaway mode by the first timer means.
[0015]
6. The program runaway detection circuit according to claim 5, wherein the second timer means has a counter that measures an elapsed time by counting the number of clock signals in the microprocessor system, and calculates the count value. The program signal is reset when the program signal transitions to an invalid state .
[0016]
By comprising in this way, the elapsed time in a 2nd timer means can be measured without malfunction by digital signal processing.
[0017]
7. The program runaway detection circuit according to claim 6, wherein the second timer means has a comparison circuit for comparing an elapsed time with a reference time, and when the elapsed time exceeds the reference time, an effective state of the program signal However, it is the structure which it is supposed to keep holding .
[0018]
With this configuration, the length of the program signal can be quantitatively determined based on the reference time.
[0019]
8. The program runaway detection circuit according to claim 7, wherein the second timer means has a control circuit for setting a reference time for detecting the second runaway mode, and the arithmetic processing unit calculates the reference time. By setting a time longer than the processing time, the continuation of the valid state of the program signal is detected.
[0020]
By comprising in this way, flexible management is realizable about the detection of the 2nd runaway mode by the 2nd timer means.
[0021]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, an embodiment of the present invention will be described with reference to the accompanying drawings.
FIG. 1 is a block diagram showing a schematic configuration example of a program runaway detection circuit according to the present embodiment.
[Configuration of the embodiment]
This circuit detects the runaway of the control program in a programmable microprocessor system, and the CPU 1 which is the central part of the arithmetic processing by the control program and the microprocessor system program runaway detection circuit operate normally. And a watchdog timer 2 indicating that the
[0022]
The CPU 1 supplies a reset signal of the microprocessor system to the initialization function of each arithmetic processing unit as it starts up. Further, according to a specific program sequence, a program signal S3 is periodically sent to the watchdog timer 2 as the control program is executed, indicating that the control program is being executed normally.
[0023]
The watchdog timer 2 includes two counters a and c that count an external clock of the microprocessor system, comparison circuits b and d that compare the count values of the counters a and c with a reference value (reference time), and both comparisons. And a control circuit e that sets appropriate reference values (detection sensitivity) for the circuits b and d. The counter a, the comparison circuit b, and the control circuit e constitute the first timer means in the present invention, and the counter c, the comparison circuit d, and the control circuit e constitute the second timer means in the present invention.
[0024]
The counter a initializes the count value by introducing the program signal S3, and starts counting when the program signal S3 disappears. The counter c starts counting when the program signal S3 is introduced, and initializes the count value when the program signal S3 disappears. When the count values of the counters a and c reach the respective reference values, the comparison circuits b and d generate an alarm signal and output it to an external circuit. For example, a control program runaway occurs as an alarm signal for a microprocessor system. Notify.
[0025]
The control circuit e supplies external control data of the microprocessor system to a setting function such as a register and sends these as reference values to the comparison circuits b and d. For example, the reference value of the counter a is a value slightly longer than the maximum execution cycle (allowable maximum execution cycle) allowable as the periodic program signal S3, and the reference value of the counter c is calculated by the CPU 1 The value is slightly longer than the longest processing time allowable as processing (allowable longest processing time).
[0026]
[Description of Operation of Embodiment]
Next, the operation of the program runaway detection circuit according to this embodiment will be described in detail with reference to FIGS.
The runaway mode of the control program includes a case where the allowable maximum execution period is exceeded due to the delay of the program signal S3 due to runaway, and a case where the allowable maximum processing time is exceeded while the program signal S3 is output. The watchdog timer 2 determines these cases, thereby monitoring the abnormal operation of the microprocessor system. In the control circuit e of the watchdog timer 2, predetermined values are set in advance as reference values for the counters a and c in accordance with an instruction from an external control signal.
[0027]
When the reset signal of the microprocessor system is enabled, the CPU 1 and the watchdog timer 2 are initialized, and the count values of the counters a and c are also set to initial values (for example, “0”). When disabled, the CPU 1 becomes operable, the counters a and c become active, and only the counter a starts counting until the program signal S3 (negative logic) is generated. This count value is compared with the maximum allowable execution period of the control circuit e in the comparison circuit b.
[0028]
When the reset signal is disabled, the execution of the control program is started in the microprocessor system, and the CPU 1 periodically outputs the program signal S3, so that the counter a is also periodically initialized. Therefore, in the comparison circuit “b”, the count value of the counter “a” does not reach the allowable maximum execution period, and no alarm signal is output from the watchdog timer 2. The counter c starts counting by the periodic program signal S3, but immediately after that, the program signal S3 disappears. Therefore, even if the length of the program signal S3 slightly varies, the count value does not reach the maximum allowable processing time in the comparison circuit d, and similarly no alarm signal is output.
The above is the case where the microprocessor system program runaway detection circuit is operating normally, as in the “normal operation” shown in FIG.
[0029]
Next, the case where “the program signal is lost” shown in FIG.
If the CPU 1 causes an abnormal operation and the program signal S3 is delayed without being periodically output, the count value of the counter a is not periodically initialized and eventually exceeds the allowable maximum execution period in the comparison circuit b. Therefore, an alarm signal is output, and the abnormal operation (first runaway mode) of the microprocessor system is displayed outside.
[0030]
In addition, with respect to “when the program signal is continuing” shown in FIG. 2C, there is a case where the CPU 1 causes an unexpected abnormal operation (for example, due to overheating) and the program signal S3 is continuously output. If the program signal continues to be output, the alarm signal is not output while the counter a is initialized. However, since the count value of the counter c is not periodically initialized and eventually exceeds the allowable maximum processing time in the comparison circuit d, an alarm signal is output, and abnormal operation of the microprocessor system (second operation) Runaway mode) is displayed externally.
[0031]
[Other Embodiments]
Next, a program runaway detection circuit according to another embodiment will be described.
In this circuit, the watchdog timer is constituted by two one-shot mono-multi circuits in the circuit according to the embodiment. One one-shot mono-multi circuit is initialized by a reset signal of the microprocessor system, and when this reset signal is disabled, it is periodically reset by a program signal. In the built-in CR time constant circuit, a value slightly larger than the allowable maximum execution cycle is set, so that the first runaway mode is detected and an alarm signal is transmitted.
[0032]
Another one-shot mono-multi circuit is also initialized by a reset signal, and is reset when the program signal disappears after being activated by the program signal. In the built-in CR time constant circuit, a value slightly larger than the maximum allowable processing time is set to detect the second runaway mode and send an alarm signal. That is, in both one-shot mono-multi circuits, each reference time for detection is a fixed value, but it can be easily configured from a small number of circuit elements because it does not require setting of external control data.
[0033]
【The invention's effect】
As described above, according to the program runaway detection circuit of the present invention, not only the abnormal execution of the control program is detected by the periodic delay of the program signal in the software control of the microprocessor system, but also the abnormality of the program signal itself. It is possible to detect even an output. Therefore, it is possible to provide a program runaway detection circuit capable of detecting a runaway mode in which the program sequence remains in a state in which the CPU is instructed to reset the timer.
[Brief description of the drawings]
FIG. 1 is a block diagram showing an example of a schematic configuration of a program runaway detection circuit according to an embodiment of the present invention.
FIG. 2 is a flowchart showing the transition of each signal of the program runaway detection circuit.
[Explanation of symbols]
1. Arithmetic processing circuit (CPU)
2 Watchdog timer (first and second timer means)
3 Program signal

Claims (7)

A program runaway detection circuit for detecting a program runaway in the arithmetic processing unit of a software controlled microprocessor system,
When the microprocessor system is started, the elapsed time starts to be measured, and the program signal output from the arithmetic processing unit almost regularly by the control program is initialized to transit to the valid state, and the program signal enters the valid state. First timer means for detecting the first runaway mode when the transition is delayed;
It said program signal starts to measure the elapsed time by the transition to a valid state, the the program signal transitions to the invalid state is initialized, the program signal detecting the valid state continues to hold the second runaway mode And a program runaway detection circuit characterized by comprising: a second timer means.   The first timer means has a counter for measuring elapsed time by counting the number of clock signals in the microprocessor system, and the count value is reset by a program signal of an arithmetic processing unit. The program runaway detection circuit according to claim 1. The first timer means has a comparison circuit for comparing the elapsed time with the reference time, and the transition to the valid state of the program signal is delayed due to the elapsed time exceeding the reference time. 3. The program runaway detection circuit according to claim 1 or 2, characterized in that: The first timer means has a control circuit for setting a reference time for detecting the first runaway mode, and by setting a time longer than the cycle of the program signal as the reference time, the program signal The program runaway detection circuit according to any one of claims 1 to 3, wherein a delay in transition to a valid state is detected. The second timer means has a counter for measuring elapsed time by counting the number of clock signals in the microprocessor system, and resets the count value when the program signal of the arithmetic processing unit transitions to an invalid state. The program runaway detection circuit according to claim 1, wherein the program runaway detection circuit is provided. The second timer means has a comparison circuit that compares the elapsed time with a reference time, and the effective state of the program signal is maintained because the elapsed time exceeds the reference time. The program runaway detection circuit according to any one of claims 1 to 5. The second timer means has a control circuit for setting a reference time for detecting the second runaway mode, and sets a time longer than the time of the arithmetic processing in the arithmetic processing unit as the reference time. The program runaway detection circuit according to claim 1, wherein the continuation of the valid state of the program signal is detected by:

Images