JP4317672B2 - CPU abnormality monitoring device - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a CPU abnormality monitoring apparatus, and more particularly to a CPU abnormality monitoring apparatus that monitors a CPU abnormality by a hardware logic circuit.
[0002]
[Prior art]
In a liquid rocket engine or the like in a space-borne device, a sequence control is performed in which a CPU (Central Processing Unit) opens and closes a valve or the like provided in a fuel pipe in a predetermined order and timing.
[0003]
Since such a CPU is exposed to a space radiation environment, bit inversion occurs more frequently than on the ground, and the program is likely to run away. For this reason, the space-borne equipment is provided with a CPU abnormality monitoring device that monitors CPU abnormality.
[0004]
FIG. 3 is an explanatory diagram of a conventional monitoring apparatus that monitors a CPU abnormality. In FIG. 3, the CPU 17 is connected to a peripheral circuit 20 such as a RAM, a ROM, or an input / output port by an address bus 19, a data bus 18 and a control bus 21. A watchdog timer (WDT) 91 is connected to the control bus 21 and an error signal ERR is output when an abnormality of the CPU 17 is detected.
[0005]
FIG. 4 is a time chart when the CPU 17 performs sequence control. In the sequence control, the CPU 17 sends trigger data TRG1, TRG2, etc. that trigger the transition of the sequence state (for example, the number of the valve to be controlled and its opening degree) from the CPU 17 to the data bus 18, and the state data representing the sequence state. SEQ1, SEQ2, etc. are output alternately.
[0006]
Further, the CPU 17 outputs address data ADRT1, ADRT2, ADRS1, ADRS2, etc. for specifying the trigger data TRG1, TRG2, etc. and the status data SEQ1, SEQ2, etc. to the address bus 19, and further, the CPU 17 sends to the control bus 21. A reset pulse RST for resetting the free-running watchdog timer 91 at a predetermined cycle is output.
[0007]
In this CPU abnormality monitoring device, when the CPU 17 is operating normally, the watchdog timer 91 is reset before counting a predetermined time (timeout time), so that the error signal ERR is not output.
[0008]
On the other hand, when the CPU 17 runs away and the reset pulse RST is not output, the watchdog timer 91 times out, the error signal ERR is output, and the CPU 17 is notified of the abnormality.
[0009]
FIG. 5 is an explanatory diagram of another conventional CPU abnormality monitoring apparatus. In this case, the abnormality of the CPU 17 is monitored by monitoring the address data output from the CPU 17 to the address bus 19.
[0010]
In FIG. 5, a CPU 17 and a peripheral circuit 20 are connected by an address bus 19, a data bus 18, and a control bus 21, and an address monitoring circuit 95 including a comparison circuit 93 and a setting circuit 94 is connected to the address bus 19 and the control bus. 21.
[0011]
The comparison circuit 93 constantly monitors whether the address data transmitted by the address bus 19 is an address in the memory space set by the setting circuit 94, and when the address data indicates an address of an undefined area, An error signal ERR is output as a malfunction of the CPU 17. The address monitoring circuit 95 is also called an address invalid detection circuit.
[0012]
[Problems to be solved by the invention]
As described above, in the conventional CPU abnormality monitoring apparatus shown in FIG. 3, for example, the control register such as the program counter or stack pointer of the CPU 17 causes bit inversion, the program runs out of control, and the reset pulse RST is sent to the watchdog timer 91. Can be detected.
[0013]
In the conventional CPU abnormality monitoring apparatus shown in FIG. 5, it is possible to detect a case where the program runs away and the address data exceeds an address in a preset memory space.
[0014]
However, these conventional CPU abnormality monitoring devices cannot detect an operation error of an operation register such as an accumulator or an abnormality of the CPU 17 due to bit inversion of data in a user area on a memory map. This is because in these cases, the program of the CPU 17 does not run out of control, and the address data also indicates an address in a preset memory space.
[0015]
That is, in the conventional CPU abnormality monitoring device, it is impossible to detect a case where the control target causes an inappropriate sequence transition due to a bit inversion due to a calculation error of the CPU 17, etc., and it is exposed to the space radiation environment like a space-borne device. Thus, bit inversion occurs more frequently than on the ground, and it is not possible to sufficiently detect an abnormality in a device that requires high reliability.
[0016]
SUMMARY OF THE INVENTION An object of the present invention is to provide a CPU abnormality monitoring device that can detect an operation error of an operation register such as an accumulator or a bit inversion of data in a user area on a memory map.
[0017]
[Means for Solving the Problems]
In order to achieve the above object, according to one aspect of the present invention, in a CPU abnormality monitoring apparatus that monitors abnormality of a CPU that performs sequence control by sequentially changing sequence states, the CPU is connected to the CPU by a data bus, Trigger data validity determination means for determining the validity of trigger data that triggers the transition of the state, state data validity determination means for determining the validity of the state data connected to the CPU and the data bus and indicating the sequence state, A decoder is connected to the CPU by an address bus and alternately activates trigger data validity determination means and state data validity determination means.
[0018]
According to the present invention, since the trigger data validity judgment unit and the state data validity judgment unit directly monitor the calculation error and the bit inversion of the data in the CPU, the trigger data validity judgment unit and the state data validity judgment unit are exposed to the space radiation environment like a space-borne device. Therefore, it is possible to accurately detect an abnormality in a device in which bit inversion occurs more frequently than on the ground.
[0019]
Further, as a preferable aspect in the above invention, the trigger data validity determination unit compares the trigger data and the comparison data with the trigger data setting unit that holds comparison data with respect to the trigger data, and the trigger data and the comparison data match. If not, the trigger data setting means includes a trigger data validity setting circuit for holding first comparison data for a predetermined bit of the trigger data, and another predetermined bit of the trigger data. A trigger data bit pattern setting circuit for holding second comparison data for the first comparison data, the comparison means, a first comparator for comparing the trigger data and the first comparison data, the trigger data and the second comparison data And a second comparator for comparing.
[0020]
Furthermore, as a preferable aspect in the above invention, the state data validity determination unit compares the state data and the comparison data with the state data setting unit that holds the comparison data for the state data, and the state data and the comparison data match. If not, a comparator means for outputting an error signal is provided. The status data setting means has a status data validity setting circuit for holding first comparison data for a predetermined bit of the status data, and another predetermined bit of the status data. A state data bit pattern setting circuit capable of holding a second comparison data with respect to and changing a bit pattern by a transition signal from a second comparator for comparing the trigger data and the second comparison data, The comparing means includes a first comparator for comparing the state data and the first comparison data, and the state data and the second comparison data. And having a second comparator for comparing.
[0021]
According to the present invention, the comparison data set by the trigger data setting means and the state data setting means is directly compared with a part of the calculation data in the CPU. It is possible to detect bit inversion of data in the user area on the map, and in particular, it is possible to accurately detect CPU anomalies in an environment where bit inversion occurs more frequently than the ground due to radiation, such as outer space.
[0022]
In the present invention, the operation data is compared with comparison data set by hardware logic such as trigger data setting means and status data setting means, and the operation of the program is monitored, so that the reliability of software is improved. be able to.
[0023]
Further, since the present invention is hardware abnormality monitoring, it is possible to monitor CPU abnormality in real time and at high speed, and particularly to quickly detect abnormality of electronic equipment that performs high-speed sequence control.
[0024]
DETAILED DESCRIPTION OF THE INVENTION
Embodiments of the present invention will be described below with reference to the drawings. However, such an embodiment does not limit the technical scope of the present invention.
[0025]
FIG. 1 is a configuration diagram of a CPU abnormality monitoring apparatus according to an embodiment of the present invention. The CPU abnormality monitoring device 37 according to the present embodiment is connected to the data bus 18 and the address bus 19 that connect the CPU 17 and the peripheral circuit 20, and can detect bit inversion of data due to an operation error of the CPU 17.
[0026]
The CPU abnormality monitoring device 37 according to the present embodiment includes a decoder 29 that decodes an address signal and outputs a chip select signal, and trigger data validity that sets comparison data (first comparison data) in trigger data validity determination. , The trigger data lower bit pattern setting circuit 25 for setting comparison data (second comparison data) in the lower bit pattern determination of the trigger data, the trigger data validity setting circuit 22 and the trigger data lower bit pattern setting. Comparators 23 and 26 that compare the comparison data of the circuit 25 and the data of the data bus 18 are provided.
[0027]
In addition, the CPU abnormality monitoring device 37 of the present embodiment includes a state data validity setting circuit 31 for setting comparison data (first comparison data) in the determination of the validity of the state data, and a lower bit pattern determination of the state data. State data lower bit pattern setting circuit 34 that sets the comparison data (second comparison data) and can change the bit pattern setting by the transition signal from the second comparator that compares the trigger data and the second comparison data. And comparators 32 and 35 for comparing the comparison data of the state data validity setting circuit 31 and the state data lower bit pattern setting circuit 34 with the data of the data bus 18.
[0028]
In the CPU failure monitoring device 37 according to the present embodiment, the trigger data that triggers the transition of the sequence state and the state data that indicates the sequence state are extracted from the data bus 18 that connects the CPU 17 and the peripheral circuit 20, and these data are extracted. Is compared with the comparison data of the setting circuits 22, 25, 31, and 34 in which a part of the program is realized by hardware logic, and when the trigger data or the state data is different from the comparison data, an abnormality of the CPU 17 is detected.
[0029]
For this reason, it is possible to detect an operation error of an operation register such as an accumulator in the CPU 17 or a bit inversion of data in a user area on a memory map, and it is exposed to the space radiation environment like a space-borne device and is more than the ground. In equipment where bit inversion frequently occurs and high reliability is required, it is possible to quickly detect an abnormality in the CPU 17 and improve the reliability of the space-borne equipment.
[0030]
Next, the abnormality monitoring process in the CPU abnormality monitoring apparatus of the present embodiment will be described with reference to the process flowchart shown in FIG. In the CPU abnormality monitoring device 37 of the present embodiment, when the abnormality monitoring process is started, first, the comparator 23 determines the validity of trigger data serving as a trigger for sequence state transition (step S1).
[0031]
When the sequence state transitions, as shown in FIG. 4, trigger data TRG1 or the like that triggers the transition is output from the CPU 17 to the data bus 18, and the trigger data TRG1 or the like is specified on the address bus 19. Address data ADRT1 and the like are output.
[0032]
The trigger data TRG1 etc. is, for example, 8 bits,
"0000xxxx" ... Formula 1
As shown, the upper 4 bits are set to “0”. Note that “x” in Equation 1 represents “0” or “1”.
[0033]
As shown in FIG. 4, when the trigger data TRG1 or the like is output to the data bus 18, the address data ADRT1 or the like for specifying the trigger data TRG1 or the like is output to the address bus 19, so that the decoder 29 receives the address data ADRT1. Etc., and the comparator 23 that determines the validity of the trigger data TRG1 can be chip-selected.
[0034]
On the other hand, the trigger data validity setting circuit 22 is previously set with comparison data for determining the validity of the trigger data. The comparison data corresponds to the trigger data TRG1 etc.
"0000xxxx" ... Formula 2
As shown, the upper 4 bits are set to “0”.
[0035]
When the chip is selected, the comparator 23 compares the upper 4 bits of the trigger data TRG1 and the like fetched from the data bus 18 with the upper 4 bits of the comparison data set in the trigger data validity setting circuit 22.
[0036]
If the upper 4 bits of the trigger data TRG1 do not match the upper 4 bits of the comparison data, an error signal ERR1 is output to notify the CPU 17 of the abnormality (step S2).
[0037]
On the other hand, if the upper 4 bits of the trigger data TRG1 and the like match the upper 4 bits of the comparison data, the comparator 23 outputs a match signal AGR1, chip-selects the comparator 26, and determines the next trigger data lower bit pattern. Is performed (step S3).
[0038]
In this case, the trigger data lower bit pattern setting circuit 25 is set in advance with comparison data for determining the validity of the lower 4 bits of the trigger data. This comparison data is based on what sequence state transition the trigger data corresponds to, for example, if the trigger data maintains a steady state without causing a sequence state transition,
"Xxxx1000" ... Formula 3
If the trigger data corresponds to transition A,
“Xxxx0100” (Formula 4)
If the trigger data corresponds to transition B,
"Xxxx0010" ... Formula 5
If the trigger data corresponds to transition C,
"Xxxx0001" ... Formula 6
It is set like this.
[0039]
When the chip is selected by the comparator 23, the comparator 26 compares the lower 4 bits such as the trigger data TRG1 taken from the data bus 18 with the comparison data set in the trigger data lower bit pattern setting circuit 25.
[0040]
If the lower 4 bits of the trigger data TRG1 and the like do not match the lower 4 bits of the comparison data, an error signal ERR2 is output to notify the CPU 17 of the abnormality (step S4).
[0041]
On the other hand, if the lower 4 bits of the trigger data TRG1 and the like match the lower 4 bits of the comparison data indicating the steady state, the comparator 26 outputs a signal NOR indicating the steady state, and the lower 4 bits of the trigger data TRG1 If it matches the lower 4 bits indicating transition A to transition C of the comparison data, the transition signal TRA corresponding to transition A to transition C is output to the state data lower bit pattern setting circuit 34.
[0042]
In this state data lower bit pattern setting circuit 34, comparison data indicating the steady state of the sequence is stored in advance, for example,
“Xxxx0001” (7)
It is set like this. When the transition signal TRA is input from the comparator 26, the comparison data corresponds to, for example, the transition A to the transition C,
"Xxxx0010" ... Formula 8
"Xxxx0011" ... Formula 9
“Xxxx0100” (Formula 10)
(Step S5).
[0043]
Next, the validity of the state data output from the CPU 17 to the data bus 18 is determined in the comparator 32 (step S6).
[0044]
When the CPU 17 performs the sequence control, as shown in FIG. 4, the status data SEQ1 indicating the sequence status is output to the data bus 18, and the address data specifying the status data SEQ1 etc. is output to the address bus 19. ADRS1 etc. are output.
[0045]
For example, in the case of 8-bit status data SEQ1 etc., as with trigger data TRG1 etc.,
"0000xxxx" ... Equation 11
As shown, the upper 4 bits are set to “0”.
[0046]
In this case, since the address data ADRS1 and the like for specifying the state data SEQ1 and the like are output to the address bus 19, the decoder 29 can chip-select the comparator 32 by decoding the address data ADRS1 and the like.
[0047]
On the other hand, in the state data validity setting circuit 31, comparison data for determining the validity of the state data is set in advance. This comparison data corresponds to the state data,
"0000xxxx" ... Formula 12
As shown, the upper 4 bits are set to “0”.
[0048]
When the chip is selected, the comparator 32 compares the upper 4 bits of the status data SEQ1 and the like fetched from the data bus 18 with the upper 4 bits of the comparison data set in the status data validity setting circuit 31.
[0049]
If the upper 4 bits of the status data SEQ1 and the like do not coincide with the upper 4 bits of the comparison data, an error signal ERR3 is output to notify the CPU 17 of the abnormality (step S7).
[0050]
On the other hand, if the upper 4 bits of the status data SEQ1 and the like match the upper 4 bits of the comparison data, the comparator 32 chip-selects the comparator 35 and determines the next status data lower bit pattern (step S8).
[0051]
As described above, in the status data lower bit pattern setting circuit 34, comparison data for determining the validity of the lower 4 bits of the status data is set in advance. That is, if this comparison data is what the sequence state maintains a steady state,
"Xxxx0001" ... Formula 13
Is set and the sequence state causes transition A,
"Xxxx0010" ... Formula 14
If the sequence state causes transition B,
"Xxxx0011" ... Formula 15
If the sequence state causes transition C,
“Xxxx0100” (Formula 16)
It has been reset like.
[0052]
When the chip is selected by the comparator 32, the comparator 35 compares the lower 4 bits of the status data SEQ1 taken from the data bus 18 with the comparison data set in the status data lower bit pattern setting circuit 34.
[0053]
If the lower 4 bits of the status data SEQ1 and the like do not match the lower 4 bits of the comparison data, an error signal ERR4 is output to notify the CPU 17 of the abnormality (step S9).
[0054]
On the other hand, if the lower 4 bits of the state data SEQ1 and the like match the lower 4 bits of the comparison data indicating the steady state or the lower 4 bits of the comparison data indicating the transitions A to C, the match signal AGR3 is output. Notify the outside etc. that the sequence control is operating normally.
[0055]
Then, it is determined whether or not to continue the monitoring process (step S10). If the monitoring process is continued (Yes), the process returns to step S1 to determine the validity of the next trigger data. On the other hand, if the monitoring process is not continued (No), the process ends.
[0056]
As described above, since the CPU abnormality monitoring apparatus of this embodiment directly monitors a part of the operation data, the operation error in the operation register in the CPU 17 or the bit inversion of the data in the user area on the memory map is detected. In particular, it is possible to accurately detect a CPU abnormality in an environment where bit inversion occurs more frequently than the ground due to radiation, such as in outer space.
[0057]
In addition, since the CPU abnormality monitoring apparatus according to the present embodiment compares the operation data with comparison data set by hardware logic and monitors the operation of the program, the reliability of the software can be improved.
[0058]
Furthermore, since the CPU abnormality monitoring apparatus according to the present embodiment is a CPU abnormality monitoring by hardware, it is possible to perform real-time and high-speed monitoring. Especially, the CPU abnormality of an electronic device that performs high-speed sequence control is detected. It can be detected quickly.
[0059]
The protection scope of the present invention is not limited to the above-described embodiment, but covers the invention described in the claims and equivalents thereof.
[0060]
【The invention's effect】
As described above, according to the present invention, since the comparison data set by the trigger data setting unit and the state data setting unit is directly compared with a part of the calculation data in the CPU, the calculation error in the calculation register in the CPU It is possible to detect bit inversion of data in the user area on the memory map, and in particular, to accurately detect CPU anomalies in an environment where bit inversion occurs more frequently than the ground due to radiation, such as in space. it can.
[0061]
Moreover, since the operation data is compared with the comparison data set by hardware logic such as the trigger data setting means and the state data setting means, and the operation of the program is monitored, the reliability of the software can be improved.
[0062]
Further, since the abnormality is monitored by hardware, it is possible to monitor the abnormality of the CPU in real time and at a high speed, and it is possible to quickly detect the abnormality of the electronic device that performs the high-speed sequence control.
[Brief description of the drawings]
FIG. 1 is a configuration diagram of a CPU abnormality monitoring apparatus according to an embodiment of this invention.
FIG. 2 is a processing flowchart of the CPU abnormality monitoring apparatus according to the embodiment of this invention.
FIG. 3 is an explanatory diagram of a conventional CPU abnormality monitoring apparatus.
FIG. 4 is a time chart of sequence control.
FIG. 5 is an explanatory diagram of a conventional CPU abnormality monitoring apparatus.
[Explanation of symbols]
17 CPU
18 Data bus
19 Address bus
20 Peripheral circuit
21 Control bus
22 Trigger data validity setting circuit
23,26,32,35 Comparator
25 Trigger data lower bit pattern setting circuit
29 Decoder
31 Status data validity setting circuit
34 Status data lower bit pattern setting circuit
37 CPU abnormality monitoring device
91 Watchdog timer (WDT)
93 Comparison circuit
94 Setting circuit
95 Address monitoring circuit

Claims (5)

In a CPU abnormality monitoring device that monitors abnormality of a CPU that performs sequence control by sequentially changing the sequence state,
Trigger data validity determination means that is connected to the CPU by a data bus and determines the validity of trigger data that triggers the transition of the sequence state;
State data validity determination means connected to the CPU by a data bus and determining the validity of the state data indicating the sequence state;
A CPU abnormality monitoring apparatus, comprising: a decoder connected to the CPU by an address bus and alternately activating the trigger data validity determination unit and the state data validity determination unit. In claim 1,
The trigger data validity determination means includes trigger data setting means for holding comparison data for the trigger data;
A CPU anomaly monitoring apparatus comprising: comparing means for comparing the trigger data with the comparison data and outputting an error signal if the trigger data and the comparison data do not match. In claim 2,
The trigger data setting means includes a trigger data validity setting circuit that holds first comparison data for a predetermined bit of the trigger data;
A trigger data bit pattern setting circuit for holding second comparison data for other predetermined bits of the trigger data;
The comparison unit includes a first comparator that compares the trigger data and the first comparison data, and a second comparator that compares the trigger data and the second comparison data. CPU abnormality monitoring device. In claim 1,
The status data validity determination means includes status data setting means for holding comparison data for the status data;
A CPU abnormality monitoring apparatus comprising: comparing means for comparing the state data with the comparison data and outputting an error signal if the state data and the comparison data do not match. In claim 4,
The status data setting means includes a status data validity setting circuit that holds first comparison data for a predetermined bit of the status data,
A state data bit pattern setting circuit for holding second comparison data for other predetermined bits of the state data,
The comparison means includes a first comparator that compares the state data with the first comparison data, and a second comparator that compares the state data with the second comparison data. CPU abnormality monitoring device.

Images