JPH04256038A - Watchdog timer inspecting device - Google Patents

Abstract

PURPOSE:To inspect specially whether a watchdog time itself operates normally or not in respect of the watchdog time of a microcomputer to detect the abnormality of the operation of a central processing unit. CONSTITUTION:The central processing unit is provided with a pumping pulse stopping part 5 which detects that power supply 1 is supplied by a power switch 2 and instructs to stop the sending of a pumping pulse from the central processing unit 3 to the watchdog timer 4, and a fault detecting part 6 which decides that the watchdog timer is faulty if a reset signal is not received from the watchdog timer when prescribed time elapses after the stop of the sending of the pumping pulse.

Description

[Detailed description of the invention]

0001

[Industrial Application Field] The present invention is a microcomputer watchdog timer that outputs a pumping signal to a port at regular intervals according to a program, and detects when the port signal stops due to CPU runaway, infinite loop, etc. The present invention relates to detecting an abnormality in the operation of a CPU.

In particular, the present invention refers to a watchdog timer inspection device that inspects whether the watchdog timer itself operates normally.

0003

2. Description of the Related Art FIG. 6 is a diagram showing the relationship between a CPU and a WDT. Note that similar components are represented by the same reference numbers or symbols throughout the drawings. The CPU 3 constituting the microcomputer shown in this figure requires a reset signal in order to perform initialization when the power is turned on. Generally, the reset signal only needs to be sent once each time the power is turned on, but when the CPU 3
Due to external noise, poor program design, etc., the program may perform operations other than its intended function, enter into an infinite loop, or stop operating at all.

As a countermeasure against this problem, a means called a watchdog timer 4 (WDT) is used. At regular intervals, the CPU 3 outputs a pulse to indicate that the CPU 3 is normal. D. T. Let 4 know. WDT 4 is CP
When the pulse from U 3 stops coming, the CPU 3 determines that there is an abnormality and performs a predetermined operation. This predetermined operation varies depending on the purpose for which the CPU 3 is used,
WDT 4 itself does not perform a predetermined operation, but rather instructs the circuit that performs such operation.
This is DT 4's job.

[0005] However, the abnormal operation of the CPU 3 is
It is rare for a part of the CPU 3 to be electrically permanently damaged, and it often returns to normal when a reset signal is applied. W
Generally, the DT 4 is designed to first give a reset signal to the microcomputer at the same time or before switching to the backup circuit 30. WDT 4 itself is another CP
There are high-end types that use U3 (WDT 4 + 30 spare circuits) to low-cost types that measure the pulse time output from CPU 3 by charging and discharging a capacitor.
IC that integrates WDT 4 and regulator (not shown)
are commercially available and widely used. Furthermore, since the WDT 4 and the CPU 3 share the same power supply, the timer (CR) of the WDT 4 also serves as a power-on reset signal generation circuit for the CPU 3.

FIG. 7 is a diagram showing the configuration of a conventional watchdog timer. The configuration of the WDT 4 in this figure includes a switching NPN type transistor 41 that receives a pumping signal from a port of the CPU 3, which will be described later, and its inverting terminal is connected to the collector of the transistor 41, and its output is connected to the collector of the transistor 41. a comparator 42 connected to the port;
a resistor 43 whose one end is connected to the power supply Vcc and whose other end is connected to the inverting terminal of the comparator; a capacitor 44 whose one end is connected to the other end of the resistor 43 and whose other end is grounded; a reference voltage forming section (Vref1) 45 connected to the non-inverting terminal of the comparator 42; an inverting delay device 46 in which the output of the comparator 42 is delayed and connected to the base of the transistor 41; A comparator 47 is connected to the output of the comparator 42, and one end thereof is connected to the inverting terminal of the comparator 47, and the other end is connected to the power supply Vc.
The reference voltage forming section (Vref2) 49 is connected to the non-inverting terminal of the comparator 47.

Next, the operation will be explained. FIG. 8 is a time chart explaining the operation of the watchdog timer. In this figure, (a) shows the voltage of the power supply, and (b) shows the output Vr1 of the comparator 47. This comparator 47 is set at Vref2 when the power is turned on.
Negative “L” (Low
)” signal, and then 0V “H (High)”
Output a signal. This Vref2 is set to about 85% of the rated voltage. The "L" signal is also generated from the comparator 47 when the power supply voltage fluctuates and drops below Vref2. This figure (c) shows the voltage V at the inverting terminal of the comparator 42.
Indicates C. The "L" signal of the output Vr1 of the comparator 47 turns on the transistor 41 via the inverting delay device 46 and discharges the capacitor 44. This figure (d) shows CPU 3
This is the pumping signal from. This figure (e) shows the comparator 47
and 42 combined output Vr2 is shown. When the voltage VC is below the reference voltage Vref1, the comparator 42 outputs “H”.
However, within ΔT1 from the time the power is turned on, it is combined with the output from the comparator 47 and sends an "L" signal to the CPU 3. After ΔT1 has elapsed, the output of the comparator 47 becomes "
H” signal (0V), and the composite output Vr2 is sent to the comparator 4.
It becomes the "H" signal from 2. This "H" signal Vr2 turns off the transistor 41 via the inverting delay device 46. Therefore, the capacitor 44 is charged, the voltage VC increases, and the voltage VC
When exceeds Vref1, the comparator 42 outputs an “L” signal, and the transistor 41 is turned off via the inverting delay device 46.
N, the capacitor 44 is discharged, and the capacitor 44 repeats charging and discharging as shown in Figure (c), and the composite signal Vr2 generates a reset signal as shown in Figure (d). CPU
3 starts upon receiving this reset signal, and outputs a pumping signal as shown in Figure (d). D. T. Send to 4. Since the capacitor 44 is discharged via the transistor 41 by the pumping signal, the charging voltage VC of the capacitor 44 becomes less than Vref1, and the combined output Vr2 becomes “
H" signal is maintained. If there is no pumping signal from the CPU 3 as shown in figure (d), the charging voltage VC of the capacitor 44
When the voltage increases and reaches Vref1, a reset signal is sent to the CPU 3 as shown in Figure (e), and an abnormality in the CPU 3 is detected.

[0008] Also, voltage abnormality of power supply Vcc (for example, 85%
As mentioned above, when there is a drop in the power supply, the output of the comparator 47 outputs an "L" signal, and a reset signal as shown in Figure (e) is output to the CPU 3.
maintain normal motility. At this time, capacitor 44 is discharged. In this way, the watchdog timer is
It is used not only for abnormality detection of CPU 3 but also for power-on reset of CPU 3 and reset when power supply voltage is abnormal.

[0009]

[Problem to be Solved by the Invention] By the way, in systems equipped with WDT 4, in most cases (excluding permanent destruction) abnormalities in CPU 3 are returned to normal after being set by WDT 4. Your own failure becomes a problem. Conventionally, abnormalities in the WDT 4 itself were checked by forcibly stopping the pumping signal from the CPU 3 to the WDT 4 during factory inspection, and determining whether a reset signal was being sent from the WDT 4 to the CPU 3.

However, as microcomputers are installed in automobiles and play an important role in automobile control, high reliability is expected, so WDT
4 itself is also required to confirm that it is sound during use. Therefore, in view of the above-mentioned problems, an object of the present invention is to provide a watchdog timer inspection device that can easily inspect a watchdog timer during use.

[0011]

[Means for Solving the Problems] In order to solve the above problems, the present invention provides a watchdog timer inspection device that includes:
It has a pumping pulse stop section and a failure detection section. The pumping pulse stop section detects that the power is turned on with the power on switch, and stops sending pumping pulses from the central processing unit to the watchdog timer.

[0012] The failure detection section determines that the watchdog timer has failed when it does not receive a reset signal from the watchdog timer after a predetermined period of time has elapsed since the sending of the pumping pulses stopped.

[0013]

[Operation] According to the watchdog timer inspection device of the present invention, the pumping pulse stop section detects a power-on reset using, for example, a reset flag, and the central processing unit is instructed to stop sending pumping pulses to the watchdog timer. is instructed. On the other hand, when the failure detection section does not receive a reset signal from the watchdog timer after a predetermined period of time has elapsed since the pumping pulse stopped being sent out, it is determined that the watchdog timer has failed. Therefore, even if the watchdog timer malfunctions, a reset signal is generated due to power fluctuations, which is considered a power-on reset, and the CP
U starts, but failures can be discovered early and repairs can be made early, improving reliability.

[0014]

Embodiments Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 shows a watchdog timer inspection device according to a first embodiment of the present invention. The configuration of this figure will be explained. The watchdog timer inspection device shown in this figure includes a power supply 1 consisting of a car battery, a power supply switch 2 composed of, for example, an ignition switch for turning on/off the power supply 1, and a power supply operated by the power supply switch 2. A central processing unit (CP
U) 3 and reset due to abnormality detection of the CPU 3, C
A watchdog timer 4 having a power-on reset function for the PU 3 and a reset function due to power fluctuations, and the power supply 1
Detecting that the input switch 2 has turned on the C
a pumping pulse stop section 5 that instructs the watchdog timer 4 to stop sending out pumping pulses from the PU 3; and a pumping pulse stop section 5 that instructs the watchdog timer 4 to stop sending pumping pulses; and a failure detection unit 6 that determines that the timer 4 has failed.

The pumping pulse stop section 5 is provided with, for example, a RAM (Random Access Memory; not shown). Furthermore, the failure detection section 6 is provided with a timer (not shown) that measures the time from the stop of pumping pulse transmission. Next, the operation of this embodiment will be explained. As described above, the purpose of the present invention is to test for abnormalities in the watchdog timer 4. In FIG. 4
There is a failure etc. in which the reference voltage Vref1 of No. 5 becomes high. If any of these failures occur, when the power source 1 is turned on by the power on switch 2, the comparator 42 will remain at the "H" signal and will not output the reset signal, so the watchdog timer 4 will not output the reset signal.
It is easily determined that there is a malfunction. However, if the watchdog timer 4 is in a faulty state and the power supply 1 is turned on and there is a fluctuation in the power supply 1, a reset signal is generated as described above. As a result, in the unlikely event that the CPU 3 starts and initially sends a pumping pulse signal to the watchdog timer 4, and then loses the pumping pulse signal, the watchdog timer 4 cannot generate a reset signal due to a failure and the CPU
3, runaway etc. cannot be prevented, so the presence or absence of such failure is checked as follows.

First, the functions of the watchdog timer 4 include power-on reset and watchdog reset, and the CPU 3 must check whether these functions are normal. Power-on reset is CPU 3
does not need to be checked. This is because if the power-on reset is defective, the CPU 3 is not operating.

To check the watchdog timer 4, it is necessary to stop the pulse output from the CPU 3 and check the response of the watchdog timer 4.
A reset signal is applied to CPU 3, causing CPU 3 to enter a reset state for a short time. This requires solving two problems. (1) FIG. 2 is a flowchart illustrating the case where a watchdog timer check is simply inserted. If only inserting step 32 in Figure 2 does not determine whether the reset is canceled from a power-on reset or a watchdog timer 4 reset, a loop of reset cancellation → watchdog timer 4 check → reset → reset cancellation will occur, and the process will end in the middle. It will be reset and will not run to other processing forever. (2) During the operation of the system, there is an unstable time during which the CPU 3 is in a reset state.

Countermeasures include: (1) Determine whether the reset is canceled from a power-on reset or a watchdog reset. (2) Perform a watchdog check at a time when there is little impact on the system, that is, immediately after a power-on reset (
(From the system's point of view, it just looks like the power-on reset is taking longer).

This patent states that ``the watchdog timer 4 is checked immediately after the power-on reset, which has little effect on the system,'' and that ``the power-on reset and the reset of the watchdog timer 4 check are distinguished,
Can't go into infinite loop. ”In particular. FIG. 3 is a flowchart for explaining the operation of the first embodiment, and a case where a RAM is used as the pumping pulse stop section 5 will be explained. In this diagram, power supply 1 is power on switch 2.
is supplied to the CPU 3 and watchdog timer 4 (step 1). The CPU 3 cannot start unless there is a power-on reset signal from the watchdog timer 4. Since the control system using the CPU 3 is not operated by the user or the like, it is determined that there is a failure in the control system including the watchdog timer 4 (step 2). A power-on reset occurs in the watchdog timer 4, and after this reset is released, the CPU 3 starts and sends a pumping pulse signal to the watchdog timer 4 (step 3). When the CPU 3 starts, the pumping pulse stop section 5 checks whether there is a flag stored in the RAM (step 4). Here, the flag is used to identify whether the reset signal is generated by forced stop of the pumping pulse, which will be described later. This flag will be explained. RAM
ACCESS MEMORY) is a transistor, M
It consists of an OS flip-flop, and it is uncertain whether it is "0" or "1" immediately after the power is turned on, but the I
Flip-flops that are close to each other on C have a common tendency to become "0" or "1", and adjacent flip-flops are in the same state.

Taking an 8-bit RAM as an example, in most cases it will be "FF16" or "0016". Therefore,
After the power-on reset, a value in which "0" and "1" are alternately arranged is written into the RAM, and the contents are used as a flag indicating the completion of the power-on reset. Specifically, “10101010
” or “01010101” as flags during watchdog timer checking (step 5), this combination is almost never used at power-on reset.

After setting this flag, the sending of pumping pulses from the CPU 3 to the watchdog timer 4 is forcibly stopped (step 6). Simultaneously with this stop, the failure detection unit 6 starts measuring with a timer (step 7). When the timer's measurement exceeds a predetermined time (step 8), the failure detection unit 6 determines that the watchdog timer 4 is not operating, so it is determined that there is an abnormality, and a warning is displayed or the fact that the failure has occurred is stored. If the overflow is not reached in step 8, the measurement continues (step 10,
7), if a reset signal is generated before overflow, the process returns to step 3 and a pumping pulse is sent out. This is because the watchdog timer 4 is normal. After that, R.A.
The flag stored in M is checked in step 4, but it is clear that it is set to, for example, 10101010, so other processing is performed (step 11).

As described above, it will be understood that according to this embodiment, the intended purpose is achieved. FIG. 4 shows a watchdog timer inspection device according to a second embodiment of the present invention. The pumping stop section 5 in this figure includes a resistor 5-1 connected to the power supply 1 via the power-on switch 2, and a capacitor 5-1, one of which is connected in series to the resistor 5-1, and the other connected to the ground.
2, the connection point of the resistor 5-1 and the capacitor 5-2 is connected to the port of the CPU 3, and is an alternative to the case where the RAM is installed in the first embodiment.

FIG. 5 is a diagram illustrating flags in the second embodiment. Figure (a) shows the voltage V5 between the resistor 5-1 and the capacitor 5-2, which increases as the power is turned on because the capacitor 5-2 is discharged at the time of power-on reset. Figure (b) shows the signal processing of CPU 3. In CPU 3, when V5≦Vref3, the port is “L”.
When V>Vref3, a port “H” signal is formed to reset the watchdog timer, and “L”
The signal is determined to be a flag: 0, and the "H" signal is determined to be a flag: 1.

This embodiment is constructed by replacing step 4 with "Port "H"?" in the flowchart of the first embodiment shown in FIG. 2 and omitting step 5, and the same effect as in the first embodiment is obtained. It will be done. Figure (c) shows the voltage (Vcc) of the power supply 1 after the power is turned on, and in order to prevent a start due to voltage fluctuations in the power supply, it is effective to delay the power-on reset by setting the flag to 0 when the power supply fluctuates. For this purpose, it is necessary to make the time constant determined by the resistor 5-1 and capacitor 5-2 as large as possible.

In particular, for airbags that protect the driver in the event of a car collision, a plug between the gas container and the gas container is detonated to instantly inject gas into the airbag, but the ignition used for this explosion is Since a capacitor with a large energy reserve is used, it is effective to use an airbag capacitor as the capacitor 5-2 after the power is turned on because charging takes several seconds.

As a modification of the second embodiment, C
Since the PU 3 has a reduced voltage flag, in this case, the power supply voltage Vcc stored in the register for the reduced voltage flag is used to perform steps 4 and 5 in the flowchart of the first embodiment. It could be constructed by replacing it with "Did it go down?"

[0027]

As described above, according to the present invention, when power is turned on, the sending of pumping pulses from the central processing unit to the watchdog timer is stopped, and when there is no reset signal within a predetermined time, the watchdog timer is stopped. Since the failure of the watchdog timer can be easily detected, even if a power-on reset occurs due to a power fluctuation and the central processing unit starts, a failure of the watchdog timer can be easily detected.

[Brief explanation of the drawing]

FIG. 1 is a diagram showing a watchdog timer inspection device according to a first embodiment of the present invention.

FIG. 2 is a flowchart illustrating a case where a watchdog timer is simply inserted.

FIG. 3 is a flowchart illustrating the operation of the first embodiment.

FIG. 4 is a diagram showing a watchdog timer inspection device according to a second embodiment of the present invention.

FIG. 5 is a diagram illustrating flags in a second embodiment.

FIG. 6 is a diagram showing the relationship between a CPU and a WDT.

FIG. 7 is a diagram showing the configuration of a conventional watchdog timer.

FIG. 8 is a time chart explaining the operation of the watchdog timer.

[Explanation of symbols]

1...Power supply 2...Power on switch 3...Central processing unit 4...Watchdog timer 5... Pumping pulse stop instruction section 6...Failure detection section

Claims (1)

[Claims] [Claim 1] The power supply (1) is connected to the power supply switch (2).
A watchdog that generates a power-on reset to start a central processing unit (3) when turned on, and generates a reset signal when it no longer receives pumping pulses output from the central processing unit (3). A timer (4) detects that the power supply (1) is turned on by the power-on switch (2) and stops sending the pumping pulse from the central processing unit (3) to the watchdog timer (4). A pumping pulse stop unit (5) for instructing, and a failure detection unit that determines that the watchdog timer (4) is malfunctioning when a reset signal is not received from the watchdog timer (4) after a predetermined period of time has elapsed since the sending of the pumping pulse was stopped. A watchdog timer inspection device comprising: (6).