JPH0444132A - Circuit and system for detection of runaway - Google Patents

Abstract

PURPOSE:To properly detect the runaways and to take the proper countermeasures to the abnormalities of all types of programs by specifying the relationship between a fixed period of an interruption signal output circuit and a fixed period of an end signal output circuit. CONSTITUTION:An interruption signal output circuit 1 outputs an interruption signal to a CPU 5 if a trigger signal outputted by a software instruction is not received within a fixed period (Tw). An end signal output circuit 2 outputs an end signal to forcibly end the bus cycle of the CPU 5 when the bus cycle of the CPU is not finished within a fixed period (TS). Then a relationship TW<TB is secured between the fixed period TW of the circuit 1 and a fixed period TB of the circuit 2. Thus it is possible to properly detect the runaways and to take the proper countermeasures to the abnormalities of all types of programs.

Description

[Detailed description of the invention] [Industrial application field]

The present invention relates to a CPU runaway detection circuit and a runaway detection method.

[Conventional technology]

Conventionally, as a runaway detection method using timer monitoring, the following two methods are widely known. ■Runaway detection method using a watchdog timer (hereinafter referred to as rWDTJ). This method works as follows. A trigger signal is generated by software and the period (TW) is
Starts the hardware timer. Thereafter, the software configures a program so that the retrigger signal continues to be applied to the hardware timer within a time period not exceeding the period (TW) of the hardware timer. Note that a retriggerable timer is used as the hardware timer, and as long as a retrigger signal is applied within a period not exceeding the period Tw, time-up of the timer will not occur. On the other hand, the software has a program code for generating a retrigger signal embedded in an appropriate location, and is designed to always generate a trigger signal within Tw as long as the system is operating normally. . In the above configuration, if some abnormality occurs in the system and the program runs out of control or runs in an infinite loop,
If a phenomenon such as transition to a hold state is affected, a retrigger signal is additionally generated and the hardware timer times up. By using this time-up signal, it is possible to detect system abnormalities. ■Runaway detection method using a bus timer (hereinafter referred to as rBTJ). This method operates as follows. In general, a CPU is capable of temporarily freezing a bus cycle by inserting a wait state in order to achieve timing consistency with peripheral devices that operate at slow speeds. If the state control input signal to the CPU used to control the insertion or release of a wait state is called a ready input, for example, this ready input signal can be used to input the result of decoding an address and selecting the result of the address decoding. It is generated from a timing signal that allows the device to insert as many wait states as necessary into the bus cycle. In other words, this ready input signal can be considered as a response signal from a device that has received an access request from the CPU. After receiving this response signal, the CPU performs the actual write or read operation and ends the bus cycle. In the above configuration, if some abnormality occurs in the system and access to an address area that is not mapped on the system is started, the CPU enters a wait state and continues to wait for a response signal from a device that is not supposed to come. It turns out. In order for the system to escape from this infinite wait state, a mechanism is needed to provide an alternative response signal to the ready input of the CPU if a response signal is not returned from the device within a certain period of time. A bus timer is used for this purpose. The bus timer is composed of a retriggerable timer, and its period (T8) is set to a value sufficiently larger than the longest bus cycle time required during normal operation. This timer is triggered by hardware every bus cycle. Therefore, during normal operation, the bus timer is not timed up because the bus timer is retriggered at a cycle shorter than TB. On the other hand, if no response signal is returned from the device, the bus timer times out after TB has elapsed after the timer trigger. As mentioned above, this time-up signal is used as an alternative response signal to escape the CPU's wait state, but this signal can also be used as a system abnormality detection signal. . When using a timer to detect runaway, use one of the above timers and send the time-up signal to the CP.
A commonly used method is to connect it to the U interrupt line.

[Problem to be solved by the invention]

However, in the above conventional example, (1) When using the WDT, if the program execution path resulting from the runaway includes a code that triggers the WDT, the runaway cannot be detected. (2) When using BT, if the program execution path as a result of a runaway forms an infinite loop, this runaway cannot be detected. Each method had its own drawbacks.

[Means to solve the problem]

The present invention has been made with the aim of solving the above-mentioned problems, and by using both the WDT and BT described above for runaway detection, the runaway detection ability is improved compared to when they are used alone. The purpose of the present invention is to provide a high level of runaway detection means. For example, the following configuration is provided as a means for achieving the above object. That is, an interrupt signal output circuit outputs an interrupt signal to the CPU when a trigger signal output by a software instruction is not given within a certain period (TW);
C if the CPU bus cycle does not end within TB).
and a termination signal output circuit that outputs a termination signal for forcibly terminating a bus cycle for the PU.

[Effect]

In the above configuration, the interrupt signal output circuit has a certain period (T
W ) and the fixed period (TB) of the termination signal output circuit,
By setting the relationship such as (TW)<(TB), it is possible to appropriately detect abnormalities in any program, etc., and to take appropriate measures.

【Example】

Hereinafter, one embodiment of the present invention will be described in detail with reference to the drawings. FIG. 1 is a circuit diagram of a runaway detection circuit according to an embodiment of the present invention. In the same figure, 1 indicates that after the WDT trigger signal S goes up and is activated, the WDT trigger signal S1 rises again within a certain time (TW). After being activated by the BT trigger signal S3, the WDT 2 generates a BT timeout signal S4 if the BT trigger signal S3 is not given again within a certain time (TB). 3 is an acknowledge generation circuit that generates an acknowledge signal S5 during normal bus access, and 4 is an OR that takes the logical sum of the BT timeout signal S4 and the acknowledge signal S5 and generates a ready signal S6.
The gate 5 is a CPU, and its interrupt input receives a WDT timeout signal S2, and its ready input receives a ready signal S6.
are connected to each other. Further, 10 is a decoder that performs decoding processing etc. based on the bus signal for each execution cycle of the CPU 5, and generates and outputs a BT trigger signal S3 for each execution bus cycle. The WDTI is composed of a retriggerable timer, and as long as the WDT trigger signal S1 is manually input at intervals not exceeding T1, the WDT timeout signal S2 will not be output. The WDT trigger signal S1 is a pulse-like signal that can be generated by software of the CPU 5. As long as the system of the CPU 5 operates normally and the software performs a predetermined processing operation, it is designed to always execute the process of generating the WDT trigger signal S1 within T7. Since this program setting method and the like are well known, detailed explanation will be omitted. If some abnormality occurs in the system, resulting in a program running out of control, running an infinite loop, or transitioning to a hold state, the program that generates the WDT trigger signal S1 will no longer be executed, and the WDTI W
The supply of the DT trigger signal S1 is stopped. Therefore, the WDTI times up after the Tw dark time has elapsed since the reception of the previous WDTI-trigger signal S1, and the WDT timeout signal S2 is output. The WDT timeout signal S2 is an interrupt signal for the CPU 5, and when the signal S2 is generated, the CPU 5 is interrupted, and thereafter, measures against the runaway are taken, for example, by starting a runaway detection processing program. On the other hand, like the WDTI, BT2 is also composed of a retriggerable timer, and is also a type of response signal to the access device 10 access by the CPU 5.
As long as the trigger signal S3 is input at intervals not exceeding TB, the BT timeout signal S4 is never output. The BTI-rigger signal S3 is a signal generated by the decoder 10. Specifically, based on the bus signal for each execution cycle of the CPU 5, the address value in that bus cycle is decoded, and the result is sent to each connected peripheral in the system. This is a signal that is generated when it is a device address value and is applied every bus cycle. Since the timeout time T of BT2 is sufficiently larger than the access cycle time, in normal operation, B
The T timeout signal S4 is never output. On the other hand, if the address decoding result points to an area that is not mapped in the system (if the address value is not the address value of the connected peripheral device, or if the address value etc. is not output), the CPU 5 It is possible that the bus is in a wait state, and the decoder 10 does not output the BT-trigger signal S3 in the relevant bus cycle. In this case, a time-up of 13T2 occurs, and the BT timeout signal S4 is output. The BT timeout signal S4 passes through the OR gate 4 and becomes a ready signal S6, which is applied to the RDY input of the CPU 5, and the CPU 5 exits from the wait state. On the other hand, if the address decode result points to an area that is not mapped within the system (if the address value is not the address value of the connected peripheral device),
Acknowledge signal S5 is not output. Therefore, in this case, the time-up of BT2 occurs after the TB time has elapsed after the start of access, and the BT timeout signal S4 is output. The BT timeout signal S4 passes through the OR gate 4 and becomes a ready signal S6, which is applied to the RDY input of the CPU 5, and the CPU 5 exits from the wait state. The acknowledge generation circuit 3 is a circuit for inserting as many wait states as required by the peripheral device to be accessed into the bus cycle in the bus cycle, and decodes the address value in the bus cycle and generates the corresponding wait state. After an appropriate time corresponding to the address value has elapsed, an acknowledge signal S5 is output, and the CPU 5 resets the wait state in the relevant bus cycle and returns to the original operating state. However, the output of the acknowledge signal S5 by the acknowledge generation circuit 3 is only performed when the address decode result indicates a device within the system, and the address decode result indicates an area that is not mapped within the system. If it is pointing (if the address value is not the address value of the connected peripheral device), the acknowledge signal S5 is not output. Therefore, in this case, the CPU 5 remains in a wait state, time-up of BT2 occurs after the time T11 has elapsed after the start of access, and the BT timeout signal S4 is output instead of the acknowledge signal S5. The BT timeout signal S4 passes through the OR gate 4 and becomes a ready signal S6, which is applied to the RDY input of the CPU 5, and the CPU 5 exits from the wait state. Here, by focusing on the fact that BT2 is always started when WDT1 is started, and by setting the condition Tw < TIl, when BT2 time-up occurs, WD is always started.
A time-up of T1 also occurs. Therefore, even if access to an area that is not mapped in the system is started as a result of some abnormality occurring in the system, the WDTI time-up will occur due to the BT2 time-up, and the C
An interrupt is generated in the PU5, and the runaway detection processing program is started. Therefore, in this embodiment, the WDTI timeout period T
By setting w and the timeout time TB of BT2 as Tw (TB), it is possible to reliably recover from a program runaway state or a wait state.

[Other Embodiments] In the embodiments described above, an example was assumed in which a non-maskable interrupt line that can be interrupted at any time is used as an interrupt source for the CPU 5. However, this interrupt line may be a normal maskable interrupt line or may use an interrupt input line of an interrupt controller. Further, the CPU 5 is not limited to a single chip, but may be composed of multiple chips, or may be a central processing unit of a large computer with a discrete configuration, or may perform various processing according to a program. It is applicable to both cases. As explained above, according to this embodiment, by setting the timeout time Tw of WDTl and the timeout time TB of BT2 to the condition that Tw < TB, runaway detection is possible even when the timeout of any timer is up, and runaway detection is possible. It has the effect of increasing ability. In addition, the interrupt line to the CPU can be unified, and the interrupt control circuit can be simplified. Furthermore, since multiple abnormality status interrupts are not generated for the same cause of runaway, the software for the abnormality processing portion can be simplified. Effects of the Invention As explained above, according to the present invention, the constant period (TW) of the interrupt signal output circuit and the constant period (TW) of the termination signal output circuit
By setting the relationship (TW) < (TB), it becomes possible to appropriately detect runaways and take appropriate measures against abnormalities in any program, etc.

[Brief explanation of the drawing]

The figure is a basic configuration diagram of an embodiment according to the present invention. In the figure, 1...WDT, 2...BT, 3...acknowledge generation circuit, 4...OR gate, 5...CP
U, 10...Decoder, Sl...WDT trigger signal, S2...WDT timeout signal, S3...BT
Trigger signal, S4...BT timeout signal, S5...
. . . acknowledge signal, S6 . . . ready signal. Patent applicant Canon Corporation ℃-:J

Claims (2)

[Claims] (1) An interrupt signal output circuit that outputs an interrupt signal to the CPU when a trigger signal output by a software instruction is not given within a certain period (T_W), and a bus cycle of the CPU within a certain period (T_B). and a termination signal output circuit that outputs a termination signal for forcibly terminating the bus cycle to the CPU when the interrupt signal output circuit does not terminate, the interrupt signal output circuit having a certain period (T_W) and the termination signal output circuit having a certain period (T_W). Period (T_B) and (T_W)<
A runaway detection circuit characterized by being set to have the following relationship (T_B). (2) Generates an interrupt signal to the CPU when a trigger signal output by a software instruction is not given within a certain period (T_W), and
), if the CPU bus cycle does not end within
A termination signal is generated to forcibly terminate the bus cycle for a certain period (T_W) and a certain period (T_W).
B) is controlled so that (T_W)<(T_B) is established.