JPH0740232B2 - Program runaway monitoring circuit - Google Patents

Description

Description: TECHNICAL FIELD The present invention relates to a program runaway monitoring circuit of a microcomputer, and in particular, when internal software runs out of control due to external or internal factors, this is detected and system initialization is executed. Regarding the runaway monitoring circuit.

[Conventional technology]

Conventionally, a runaway monitoring circuit of this type has a timer counter 321 with reference to FIG.
And a program memory (ROM) 31 that stores instruction codes
1. An instruction latch 325 for latching the instruction code from the ROM 311, an instruction decoder 322 for converting the content of the instruction latch 325 into a predetermined instruction, and a system reset circuit 315 for supplying a reset signal to the program counter 312. If the timer counter 321 is not reset by a predetermined instruction code within a predetermined set time, the system reset circuit 315 sets the program counter 3 as a runaway state.
It was a method of resetting 12 and executing system initialization.

[Problems to be solved by the invention]

In the conventional runaway monitoring circuit described above, if the program happens to run out of control and an instruction code for resetting the monitoring timer counter is included in the runaway routine, the timer counter naturally does not overflow,
It has the disadvantage that it cannot detect runaway.

The object of the present invention has been made in view of the above-mentioned drawbacks of the conventional runaway monitoring circuit, and it is not necessary to detect the runaway in one step of the program but to obtain in advance the signature of the instruction of a specific step group. It is to detect runaway by comparing with signature data.

[Means for solving problems]

The program runaway monitoring circuit of the present invention includes a program memory that stores a plurality of instruction codes read by a program counter output, a timer counter that is reset by a predetermined instruction code within a predetermined time, and a carry output of the timer counter. In a program runaway monitoring circuit of a microcomputer including a system reset circuit that is triggered by the above and resets the program counter, a plurality of the instruction codes of the program memory are each added with an enable bit of 1 bit, and A flag latch that latches the enable bit output, and a linear feedback register that captures the instruction code and presets predetermined code data internally each time the flag latch output is generated. Comprising a comparator for generating a coincidence by comparing the instruction code and the predetermined code data supplied outputted from the linear feedback register, a judge flag latch for capturing the comparator output,
The timer counter is reset in response to at least one of the coincidence output and the system reset circuit output supplied from the output flag latch.

〔Example〕

Next, embodiments of the present invention will be described with reference to the drawings.

FIG. 1 is a block diagram showing a first embodiment of the present invention, showing only a main part relating to the present invention among the components of a microcomputer to which the present invention is applied.

Referring to FIG. 1, this program runaway monitoring circuit
A ROM 111 that stores an instruction code, an enable bit unit 110 attached to the ROM 111, a program counter 112 that holds the address data of the ROM 111, a flag latch 124 that latches the output of the enable bit unit 110, and a flag latch 124.
The linear feedback register (hereinafter referred to as LFSR) 116 that is triggered by the output of the ROM and captures the output code data from the ROM 111 at this point, and a comparator that compares the code data preset by hardware with the data of the LFSR116. (Hereinafter referred to as the compare register) 117,
A judge flag latch 118 that latches the coincidence / non-coincidence output supplied from the compare register 117 in synchronization with the inverted signal of the clock φ _L , and the judge flag latch 118 that counts in synchronization with the clock φ _CK and carry when the preset count value is reached. It includes a timer counter 121 for generating and a system reset circuit 115 for generating a reset output 114 in response to the carry, the reset output 114 resets the program counter 112 and the LFSR 116, and the reset output 114 or the judge flag latch 1
The timer counter 121 is reset by either one of the coincidence outputs 120 held by 18.

Next, the operation of this embodiment will be described. Referring again to FIG. 1, the timer counter 121 activates the output of the system reset circuit 115 in response to the initialization (system reset) supplied from the outside of the microcomputer including the runaway monitoring circuit, and generates the reset output 114. Then, the initial state is set.

Program counter 11 upon completion of system reset
2 starts counting up from the minimum address of ROM111. Here, one bit is added to each instruction code in the enable bit portion 111 of each instruction code of the ROM 111 to permit fetching of the instruction code into the LFSR 116.

In this embodiment, when the enable bit is "1", the LFSR116
Permission to import. When this enable bit becomes "1" at any ROM address, the flag latch 124 causes this enable bit "1" in the machine cycle.
Latch.

This latch output 123 serves as a fetch clock for the LFSR 116, and fetches the instruction code for this machine cycle in the LFSR 116. Instruction code with enable bit "0" is LFSR
It shall not be taken into 116.

When this sequence is executed in a preset program area, the LFSR 116 holds the signature (referred to as Ai) of the instruction code group whose enable bit determined by the code logic is "1". Here, i indicates that the instruction code whose enable bit is "1" has been fetched i times.

That is, the signature held in the LFSR 116 is the ROM 111
Is the signature of the instruction code group when the enable bit of the enable bit unit 111 attached to is "1", and this signature changes to the signature of all the instructions fetched so far every time this instruction is fetched by LFSR116 . This change occurs in synchronization with the execution of the instruction.

Compare register 117 has signature Ai and LFS in advance.
The signature Am set in R116 is supplied, both values are compared, and Ai
When = Am, a coincidence output is generated.

The coincidence output is latched by the judge flag latch 118, and the timer counter 121, which has continued counting, is reset.

The timer counter 121 sets the count value so that the carry 119 is generated at a time interval longer than the time interval determined by the number of instruction steps required for Ai = Am.

That is, referring to FIG. 2 showing a conceptual diagram for explaining the generation process of the signature Ai, the timer counter 121 starts counting after the system reset, and the carry 12
Assuming that the time until 0 is generated is T, the carry generation time T of this timer counter is a preset time interval. On the other hand, after the system reset, the program counter 112 also starts address counting, and sequentially starts reading instructions 1, 2, ... From the ROM 111 based on this address data. At this time, an instruction execution sequence including i instructions whose enable bit is "1" requires the number of steps from instruction 1 to instruction Q. Here, when the time from the system reset to the execution of the instruction Q is (t _X −t _O ), this (t _X −t _O ) is the time interval at which Ai = Am, and T is (t _It should be set in advance to be larger than ( _X −t _O ).

As described above, instructions 2, 3, ..., K, K + 1, ..., L, ..., M, when the enable bit of “0” or “1” attached to each instruction unit of the program memory is “1”, ...
Each instruction code of P, ..., Q is LFSR116 as a signature.
Ai is a value updated as a signature and a value that is fetched every time, and every time it is fetched, the value of this signature can determine whether or not these instruction groups have been executed.

When the program runs out of control, the execution of the instruction sequence becomes abnormal, so the expected value of this signature Ai cannot be obtained, the Am and Ai do not match, and the timer counter 121 continues counting and carries 119. Occur.
This carry 119 triggers the system reset circuit 115 and produces a system reset output 114.

Therefore, the program counter 112 is reset to the initial state by the system reset, and can exit the runaway state. Here, if the bit length of the LFSR 116 is ^K , the possible states of this register are 2 ^K , and the probability that Ai and Am match is 1/2 ^K. In the present embodiment, K will be described as 8. The value of K can be appropriately selected within the range of the instruction length of the microcomputer.

Further, it is obvious that the point in the structure of the application program executed on this system is that a predetermined processing routine is cycled at a cycle shorter than the carry generation cycle of the timer counter 121.

Third Embodiment showing a configuration of a second embodiment of the present invention in a block diagram
Referring to the drawing, all points different from the first embodiment shown in FIG. 1 are the same as those of the first embodiment except that the code data to be loaded into the LFSR216 is a part of the instruction code stored in the ROM 211. Identical, 110 and 210, 112 and 212, 114 and 2
14, 115 and 215, 116 and 216, 117 and 217, 118 and 218, 119 and 2
19, 120 and 210, 121 and 211, 122 and 222, 123 and 223, 124 and 2
Since 24, 125, and 225 correspond to each other, the description of the configuration here is omitted.

In the second embodiment, a part of the instruction code whose enable bit is "1" (for example, the upper 5 bits) is taken into the LFSR216. The operation other than this point is the same as that of the first embodiment, and the description thereof is omitted here.

The present embodiment is applied to a microcontroller with a small ROM capacity (for example, 0.5K step), so that the LFSR216,
By reducing the number of bits of the compare register 217, the same effect as that of the first embodiment can be obtained.

Referring to FIG. 4 showing a specific example of the LFSRs 116 and 216 in FIGS. 1 and 3, the instruction code supplied from the ROM 111 in FIG. 1 or the ROM 211 in FIG.
LFSR116 and 216 via data input terminals D ₀ (401) to D ₇
Are respectively supplied to the series connected register groups L _{1 to} L ₈ and are taken in in synchronization with the clock supplied from the clock input terminal 405.

Each of the register groups L _{1 to} L ₈ has the same configuration as that shown in the register 402 as an example, and outputs a data latch 407 that latches an input signal and an exclusive OR of the output of this latch 407 and the feedback signal. EXOR40
8 and a D-type flip-flop 404 that stores the output of this EXOR 408 and that is reset by the reset inversion signal supplied from the reset input terminal 406.

The feedback signal is obtained by EXOR 409, 411 and 412 which outputs the exclusive OR of the predetermined combination of outputs among the data output terminals Q ₀ (403) to Q ₇ of the signature output.

〔The invention's effect〕

As described above, the program runaway monitoring circuit of the present invention does not detect whether the program of the microcomputer runs out of control in only one step on the program, but adds it to each instruction unit of the program memory. The instruction code when the enable bit of “0” or “1” is “1” is captured in the LFSR as a signature, and the updated value of all signatures captured so far is Ai. Therefore, it can be judged from the value of this signature whether or not these instruction groups have been executed. In the case of program runaway, the execution of the instruction sequence becomes abnormal, so the expected value of signature Ai cannot be obtained,
This Ai and the signature Am preset in the LFSR
Therefore, the timer counter continues counting and a carry is generated. The carry is configured to trigger a system reset circuit to generate a system reset output.

Therefore, the program counter is reset to the initial state and can be brought out of the runaway state, so that the detection accuracy of the runaway state of the program is dramatically improved.

[Brief description of drawings]

FIG. 1 is a block diagram showing the first embodiment of the present invention, and FIG.
FIG. 4 is a conceptual diagram for explaining the generation process of the signature Ai, FIG. 3 is a block diagram showing a second embodiment of the present invention, and FIG. 4 is a circuit of an 8-bit register of LFSR which is one of the constituent features of the present invention. FIG. 5 is a block diagram showing an example, and FIG. 5 is a block diagram showing a conventional example. 111,211,311 …… Program memory (ROM), 112,212,31
2 …… Program counter, 115,215,315 …… System reset circuit, 122,222,322 …… Instruction decoder, 116,126 …… LFSR, 117,217 …… Compare register, 118,218 …… Judge flag latch, 121,221 …… Timer counter, 401 …… Data input terminal, 402 …… LFSR
1-bit register, 403 …… Data output terminal, 404 ……
D-type flip-flop, 405 ... Data input clock input terminal, 406 ... Reset input terminal, 407 ... Data latch, 408-411 ... EXOR.

Claims (1)

[Claims] 1. A program memory for storing a plurality of instruction codes read by a program counter output, a timer counter that is reset by a predetermined instruction code within a predetermined time, and a carry output of the timer counter. In addition, in a program runaway monitoring circuit of a microcomputer including a system reset circuit that resets the program counter, each of the plurality of instruction codes of the program memory is added with an enable bit of 1 bit, and the enable bit output is output. A flag latch to latch,
A linear feedback register in which the instruction code is fetched each time the flag latch output is generated and predetermined code data is previously set therein, the instruction code supplied from the linear feedback register, and the predetermined code At least the coincidence output and the system reset circuit output supplied from the output flag latch are provided by the timer counter, the comparator including a comparator that compares the data and generates a coincidence output, and a judge flag latch that captures the comparator output. A program runaway monitoring circuit characterized by being reset in response to one of them.