JPH09319621A - Circuit, method for detecting program runaway, software developing device for detection and software generating method for the same - Google Patents

Abstract

PROBLEM TO BE SOLVED: To detect runaway by more precisely monitoring the normal execution of a program by cumulatively adding the values of a program counter at the time of program execution and comparing the result with a check sum integrated into an object program. SOLUTION: In order to detect the presence/absence of runaway of the program to be executed by a microcomputer, a program counter 1 counts the number of program execution addresses. Each time, the program counter 1 is incremented, an adder 10 cumulatively adds the contents of the program counter 1 and a check sum buffer 11 holds this added result. Therefore, when the contents of the program counter 1 are updated with the execution of the program and an instruction decoder 9 detects a check instruction from check sum data previously stored in an object program instruction, a comparator 12 compares the contents of the check sum buffer 11 with the operand part data of the check instruction so that a program runaway state can be detected.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a program runaway detection circuit, a detection method, a detection software development apparatus and a software generation method therefor, and more particularly to a program runaway detection circuit for detecting the presence or absence of runaway of a program executed by a microcomputer. The present invention relates to a software development device for generating an object program for runaway detection of a microcomputer having a runaway detection circuit and a software generation method for the detection.

[0002]

2. Description of the Related Art Referring to FIG. 6 showing an example of a conventional configuration for detecting runaway using a watchdog timer, a watchdog timer 15 is generally composed of a free running counter, and by inputting a cancel pulse. , The free running counter is cleared.

When the free running counter overflows, a reset signal RESET bar is output.

As a function of a free-running counter, there is a method of using charge / discharge of a capacitance element and a resistance element in addition to a method of using a digital counter.

A general microcomputer 16 is provided with a reset signal RESET bar input and a port output, and inside thereof, only main parts are shown. It comprises a program counter 161, a ROM section 162, an instruction decoder 163, etc. The ROM section 162 comprises an address latch 164, an address decoder 165, a ROM cell array 166, a sense amplifier 167 and an output buffer 168. The reset input end of the microcomputer 16 is connected to the reset output end of the watchdog timer 15, and the cancel pulse output end of the microcomputer 16 is connected to the cancel pulse input end of the watchdog timer 15.

Referring to FIG. 7A showing a flowchart of a method of detecting runaway of the microcomputer 16 using the watchdog timer 15 and FIG. 7B showing an operation timing chart thereof. ,
The microcomputer 16 performs initialization (S3
During the normal operation of 1), it is determined whether or not the timing detection time has elapsed (S32), and when a predetermined time, that is, the main cycle elapses, the watchdog timer 1 is set for each main cycle.
The cancel pulse of 5 is output from the general-purpose port (S3
After 3), main processing is executed (S34).

When the microcomputer 1 runs out of control during execution of the main cycle (for example, when an infinite loop occurs in the main cycle), the cancel pulse is not output thereafter.

When the cancel pulse is no longer input, the watchdog timer 15 outputs a reset signal after the runaway detection time has elapsed.

When the reset signal RESET bar is input, the microcomputer 16 is reset and normally executes the program from address 0.

Further, an example of a conventional runaway detection method is described in Japanese Patent Laid-Open No. 5-257746. Referring to FIG. 8 showing the configuration of the runaway detection circuit and the software development apparatus using the runaway detection circuit described in the publication, this runaway detection circuit aims at detecting the program runaway state without being affected by the program structure. In the runaway detection operation, the program counter 20 is divided into an upper part 21 and a lower part 22, and the contents of the upper part 21 are incremented by 1 in the increment part 23 and stored in the latch 26 in advance. The counter 20 is incremented, and the comparator 25 compares whether or not the lower part 22 becomes equal to the value of the constant storage part 24, and when they become equal, or when a carry occurs from the lower part 22 to the upper part 21. , The upper portion 21 of the programming counter 20 and the latch 26
The runaway determination unit 28 detects whether the contents of the above are the same.

Further, when the branch instruction is executed, the latched contents and the contents of the program counter upper part 21 after the branch do not always match even if the normal operation is continued. The flag 29 is set so that the comparison is not performed immediately after the branch instruction.

[0012]

The above-described conventional runaway detection circuit and runaway detection method using a watchdog timer causes a runaway when a program goes into an infinite loop including a cancellation pulse output process. However, the runaway cannot be detected because the cancel pulse continues to be generated.

Further, if the program runaway has only jumped to the ground and the program execution is not changed significantly, the cancel pulse is not stopped and the runaway cannot be detected.

Further, the conventional runaway detecting circuit and runaway detecting method shown in FIG. 8 only confirms whether or not the contents of the upper part 21 of the program counter 20 are correct, and the lower part 22 makes an incorrect count. When the program runs out of control, the error cannot be detected.

Furthermore, when the branch instruction is executed, the flag 2
Set 9 and the comparison result is always normal (not runaway)
Is output, and there is a drawback that it cannot detect whether or not the branch is normally executed when the branch instruction is executed.

The object of the present invention has been made in view of the above-mentioned drawbacks, and the value of the program counter at the time of program execution is cumulatively added and compared with the checksum incorporated in the object program to execute the program normally. A runaway detection circuit and a runaway detection method for monitoring runaway in more detail and detecting a runaway, a software development device for generating an object program of a micro computer incorporating this runaway detection circuit, and a checksum calculation for this device. It is to provide a software generation method.

[0017]

The program runaway detection circuit of the present invention is characterized by a program counter for counting program execution addresses in a program runaway detection circuit for detecting the presence or absence of runaway of a program executed by a microcomputer, and the program. An adder that cumulatively adds the contents of the program counter each time the counter is incremented, a checksum buffer that holds the addition result, checksum data stored in advance in an object program instruction, and output from the checksum buffer And a comparator for comparing the data.

Further, the mismatch output signal of the comparator is used as a reset signal to reset the microcomputer simultaneously with the detection of runaway of the program.

Further, the checksum data stored in the object program instruction is data obtained by cumulatively adding the program execution address.

Furthermore, the checksum buffer is cleared when a branch instruction of the program is executed.

The program runaway detecting method of the present invention is characterized by a program counting means for counting program execution addresses and an adding means for cumulatively adding the counted contents of the program counting means each time the program counting means is incremented. And a checksum buffer means for holding the addition result of the adding means and a comparing means for comparing the checksum data stored in advance in the object program instruction with the output data from the checksum buffer means. Clearing the program count means, clearing the checksum buffer means, reading one instruction designated by the program count means, and determining whether the read instruction is a branch instruction or another instruction Steps to do If the instruction is a branch instruction, the checksum data is cleared, and if it is another instruction, the step of adding the address value of this instruction to the contents of the checksum buffer means, and the operation code of the instruction read A step of judging whether or not it is a check command for instructing the comparing means to output, a step of returning to the step of reading the one command and reading the next command if the judgment result is not the check command, the judgment If the result is the check instruction, it comprises the step of comparing the checksum data with the operand value of the check instruction. If the result of the comparison is a mismatch, the runaway of the program executed by the microcomputer is detected by the mismatch signal. Especially.

The feature of the program runaway detection software development apparatus of the present invention is that a program counter for counting program execution addresses and an adder for cumulatively adding the contents of the program counter each time the program counter is incremented. And a checksum buffer for holding the addition result, and a comparator for comparing the checksum data stored in advance in the object program instruction with the output data from the checksum buffer. A software development device for generating the object program of a computer, which analyzes an input source program instruction, calculates checksum data of an execution address in program execution, and calculates this checksum data. Lies in comprising instructions incorporation unit that incorporates the object program instructions.

Further, the check instruction incorporated in the object program and the check sum data used as the operand portion of the check instruction are mapped to the absolute address space of the source program when the source program is converted into an object and the check instruction data of the check instruction is stored. The operand part is generated.

The feature of the software runaway detection software generation method of the present invention is that the program count means for counting the program execution address and the addition means for cumulatively adding the contents of the program counter each time the program count means is incremented. And program runaway detection comprising checksum buffer means for holding the addition result of the addition means and comparison means for comparing the checksum data stored in advance in the object program instruction with the output data from the checksum buffer means. A software development method for generating an object program for a microcomputer using the means, comprising: a step of clearing the checksum data; a step of reading the source program for one instruction and determining whether or not it is a branch instruction. If the determination result is negative, the step of adding the assigned absolute address to the checksum data, the step of determining whether or not the check instruction is made, and if the determination result is negative, the source program is set to 1 Returning to the step of reading instructions, if the judgment result is the check instruction, the step of storing the cumulatively added value of the checksum data in the operand part of the check instruction; If it is a branch instruction in the judgment as to whether or not it is a branch instruction, the checksum data is cleared.

[0025]

BEST MODE FOR CARRYING OUT THE INVENTION Next, a program runaway detection circuit, a runaway detection and detection software development apparatus and a software generation method therefor according to the present invention will be described with reference to the drawings.

First, referring to FIG. 1 showing a block diagram of the first embodiment, a ROM address which is currently being executed or a ROM address which is to be executed next is stored and incremented (addition of 1 is performed at each instruction execution. Selected), the address of the program counter 1 fetched by the program counter 1, temporarily held, and output to the address decoder 3, and the address to be executed is selected by the input data from the address latch 2. , Address decoder 3 for activating address lines of ROM cell array 4
And an opcode storage unit 5 and an operand storage unit 6, which stores a group of instruction data converted from a program in advance and senses the opcode and operand data stored at the address activated by the address decoder 3. The ROM cell array 4 that outputs to the amplifier 7, the operation code storage unit 5 that stores the instruction code of the program, the operand storage unit 6 that stores the operand of the instruction, and the operation code and operand data output from the ROM cell array 4 are input. , Output buffer 8
A sense amplifier 7 for outputting to, and an output buffer 8 for inputting and amplifying the operation code and operand data output by the sense amplifier 7 and then outputting to the instruction decoder 9;
An instruction (hereinafter referred to as a check instruction) that interprets the opcode input from the output buffer 8 and further inputs the operand data output from the output buffer 8 as a result of the interpretation of the opcode. The contents of the program counter 1 and the checksum buffer 11 are input and added, and the adder 10 that outputs the addition result to the checksum buffer 11 and the data input from the adder 10 A checksum buffer 11 that stores the contents as needed and outputs the stored contents to the comparator 12, the instruction operand portion of the output buffer 8 and the data of the checksum buffer 11 are input via the switches 13 and 14, respectively, and the comparison result is output. And a comparator 12 that operates.

Although the number of bits of the adder 10 is arbitrary, it is preferably equal to or larger than the number of bits of the program counter 1, and the number of bits of the checksum buffer 11 is arbitrary. It is preferable that the number of bits is equal to or more.

In the runaway detection circuit having the above-mentioned configuration, the contents of the program counter 1 are updated as the program is executed, the updated contents are added, the addition result is stored in the checksum buffer 11 at any time, and the check command is issued. When the instruction decoder 9 detects, the checksum buffer 1
By comparing the contents of 1 and the operand data of the check instruction with the comparator 12, the program runaway state is detected.

A specific operation using such a runaway detection circuit will be described using a simple program example.
Referring also to FIG. 2 showing a program for explaining the runaway circuit and FIG. 3 showing a flow chart of the program runaway detection method, after the microcomputer is reset, the contents of the program counter 1 and the checksum buffer 11 are “0000h. "(S1, S2).

The program counter 1 executes an instruction that does not branch an address thereafter, such as a NOP instruction or a transfer instruction.
It is incremented each time the instruction is read and executed (S3, S4). Program counter 1 is “0000
When it is "h", the checksum buffer is "0000h".

That is, the program counter 1 is "00".
During execution of address 0 at "00h", the content "0000h" of the program counter 1 and the content "0000h" of the checksum buffer 11 are added by the adder 10 and the addition result "0000h" is stored in the checksum buffer 11. (S5).

Next, the program counter 1 is incremented to "0001h".

When the program counter 1 is "0001h", the checksum buffer 11 is "0001h".

That is, the program counter 1 is "00".
While the address 1 is being executed with 01h, the content “0001h” of the program counter 1 and the content “0000h” of the checksum buffer 11 are added by the adder 10, and the addition result “0001h” is stored in the checksum buffer 11. .

Further, the program counter 1 is incremented to "0002h". Checksum buffer 1 when the program counter 1 is "0002h"
1 becomes “0003h”.

That is, the program counter 1 is "00".
While address 2 is being executed at 02h, the content “0002h” of the program counter 1 and the content “0001h” of the checksum buffer 11 are added by the adder 10, and the addition result “0003h” is stored in the checksum buffer 11. .

Further, the program counter 1 is incremented to "0003h". A check command and checksum data are stored at address 3. When the program counter 1 is "0003h", the checksum buffer 11 is "0006h".

That is, the program counter 1 is "00".
While address 2 is being executed at "02h", the contents "0002h" of the program counter 1 and the contents "0001h" of the checksum buffer 11 are added by the adder 10, and the addition result "0006h" is stored in the checksum buffer 11. To do.

Simultaneously (program counter = “0003
When the instruction decoder 9 interprets that the instruction is a check instruction (h ") (S6), the content of the checksum buffer 11 (=" 0006h ") is compared with the value of the operand portion of the check instruction (=" 0006h "). Vessel 12 compares (S
7).

Since the contents of the checksum buffer 11 and the value of the operand part of the check instruction are the same, the coincidence signal is output from the comparator 12 (S8).

After executing the check command, the content of the checksum buffer 11 is automatically set (cleared) to "0000h" (S10), the program counter is incremented by 1 (S11), and thereafter, as described above. The same operation as the operation is repeated.

The above-described operation is performed by the program counter 1
But 0000h → 0001h → 0002h → 0003h
And explained about the case of normal change.

Next, when the program counter 1 does not change normally, for example, 0000h → 0002h → 00
The operation changed from 03h (when 0001h is skipped) will be described.

When the microcomputer is reset, the contents of the program counter 1 and the checksum buffer 11 become "0000h" as in the above description (S1, S2).

Next, it is assumed that the place where the program counter 1 should be incremented to "0001h" suddenly changes to "0002h" due to a disturbance such as noise.

At this time, the program counter 1 is set to "00".
While address 2 is being executed at 02h, the content "0002h" of the program counter 1 and the content "0000h" of the checksum buffer 11 are added by the adder 10, and the addition result "0002h" is stored in the checksum buffer 11 ( S5).

Further, the program counter 1 is incremented to "0003h". A check command and checksum data are stored at address 3. When the program counter 1 is "0003h" and the third address is being executed, the content "0003h" of the program counter 1 and the content "0002h" of the checksum buffer 11 are added by the adder 12, and the addition result "0005h" is checksummed. The data is stored in the buffer 11 (S5).

Simultaneously (program counter = “0003
When the instruction decoder 9 interprets that the instruction is a check instruction (h ”) (S6), the content of the checksum buffer 11 (=“ 0005h ”) and the value of the operand portion of the check instruction (=“ 0006h ”) are compared by the comparator 12 Compare (S
7).

Since the contents of the checksum buffer and the value of the operand part of the check instruction do not match, the comparator 12 outputs a mismatch signal (reset signal) (S).
9).

As described above, when the value of the program counter 1 changes to an abnormal value which is not intended due to disturbance such as noise, it is possible to detect the abnormality and output the mismatch signal from the comparator 12. .

Further, if the output of the comparator 12 is used as a reset signal for the microcomputer, the microcomputer can be automatically reset at the same time when the abnormality is detected.

In the above-described first embodiment, the operation in the case of executing an instruction that does not cause an address branch, such as a NOP instruction or a transfer instruction, has been described. Normally, of course, the program also contains branch instructions, so the second
In this embodiment, the operation when this branch instruction is executed will be described.

Referring to FIG. 4 showing an example of a program including a branch instruction, the checksum buffer 11 is cleared when the branch instruction is executed. The branch destination of a normal program branch should be the start address of each program module.

For example, the module A conditional branch instruction points to the head address of the module C as indicated by the arrow in the figure. Therefore, if the check instruction is executed at the end of each program module A, B, and C, runaway from the beginning of the program module can be detected.

When an abnormal program branch is made as shown by the arrow in the figure, that is, when the conditional branch instruction of the program module A branches to an address in the middle of the program module C, the last check of the program module C is checked. Runaway can be detected by an instruction.
Similarly, if the check instruction is executed at the end of each program module A, B, and C, runaway from the middle of the program module can be detected.

Next, a software development device for generating an object program stored in the ROM cell array 4 in the first and second embodiments will be described.

In the above-described first and second embodiments, a dedicated instruction for detecting runaway (check instruction and checksum data corresponding to the check instruction operand portion)
Is incorporated into an object program, and the object program is stored in the ROM cell array 4 in advance.

An object program incorporating this dedicated instruction is generated by a general software development device (not shown). This software development device is generally a personal computer and software that generates an object program that operates on the personal computer.

The software for generating the object program is an operand of a check instruction when converting the source program written in the assembler language shown in FIG. 2 into an object program or when mapping the object program to an absolute address. The part (checksum data) is calculated, and the operand value is automatically generated.

Alternatively, an object program other than the checksum data may be created once by the assembler and linker, and then the checksum data may be created by dedicated software.

Referring to FIG. 5, which is a flowchart showing an example of an algorithm for generating checksum data, first, the checksum data is set to 0 (S11).

Read the source program for one instruction (S
12) It is determined whether the instruction is a branch instruction (S13). If it is not a branch instruction, the assigned absolute address is added to the checksum data (S14). This operation is repeated until the check command is read (S15).

When the check command is read, the value of the checksum data cumulatively added is stored in the check command operand part (S16).

After that, the checksum data is set to 0, and the same processing is repeated until the check command is read again.

When the branch instruction is read, the checksum data is set to 0.

In order to effectively use this runaway detection method, the check instruction is placed immediately before the branch instruction. By doing so, it is possible to detect runaway of the program up to immediately before the branch instruction, and further to detect whether the branch normally occurred (branch to the head of the program module).

[0067]

As described above, the program runaway detection circuit and detection method, the detection software development apparatus, and the software generation method thereof according to the present invention include a program counter for counting program execution addresses, and a program counter for each increment of the program counter. It has addition data obtained by cumulatively adding the contents of the counter, checksum data cumulatively added to the program execution address and stored in advance in the object program instruction, and a comparator for comparing the addition data and the checksum data, Since there is a method to detect runaway by comparing the added data and checksum data, the normal execution of the program can be improved by cumulatively adding the value of the program counter at the time of program execution and comparing it with the checksum built into the object program. The details It can be monitored. Furthermore, in a software development device of a microcomputer having a runaway detection circuit built-in, an input source program instruction is analyzed to calculate a checksum of a program execution address,
By providing the instruction embedding means incorporated in the object program instruction, the checksum data can be easily created, which contributes to the efficiency improvement of the software development of the microcomputer.

[Brief description of drawings]

FIG. 1 is a block diagram showing a program runaway detection circuit according to a first embodiment of the present invention.

FIG. 2 is a diagram showing a simple program for explaining a program runaway detection circuit.

FIG. 3 is a flowchart of a program runaway detection method.

FIG. 4 is a diagram showing an example of a program including a branch instruction.

FIG. 5 is a diagram showing a software generation algorithm incorporated in a software device for generating a program for a program runaway detection circuit.

FIG. 6 is a configuration diagram of conventional runaway detection using a conventional watchdog timer.

FIG. 7 is a flowchart of a method for detecting runaway of a microcomputer using a conventional watchdog timer.

FIG. 8 is a diagram showing a configuration of a conventional runaway detection circuit and a software development device using the same.

[Explanation of symbols]

 1,20,161 Program counter (PC) 2,164 Address latch 3,165 Address decoder 4,166 ROM cell array 5 Opcode storage 6 Operand storage 7,167 Sense amplifier 8,168 Output buffer 9,163 Instruction decoder 10 Adder 11 Checksum Buffer 12, 25, 27 Comparator 13, 14 Switch 15 Watchdog Timer 16 Microcomputer 21 Upper Part 22 Lower Part 23 Increment Part 24 Constant Storage Part 26 Latch 28 Runaway Judgment Part 29 Flag 162 ROM Part

Claims (8)

[Claims] 1. A program runaway detection circuit for detecting the presence or absence of runaway of a program executed by a microcomputer, and a program counter for counting program execution addresses, and cumulative addition of the contents of the program counter each time the program counter is incremented. And a checksum buffer for holding the addition result, and a comparator for comparing the checksum data previously stored in the object program instruction with the output data from the checksum buffer. Program runaway detection circuit. 2. The program runaway detection circuit according to claim 1, wherein the microcomputer runaway detection circuit is reset at the same time when the program runaway is detected by using a mismatch output signal of the comparator as a reset signal. 3. The program runaway detection circuit according to claim 1, wherein the checksum data stored in the object program instruction is data obtained by cumulatively adding the program execution address. 4. The program runaway detection circuit according to claim 1, wherein the checksum buffer is cleared when a branch instruction of a program is executed. 5. A program counting means for counting a program execution address, an adding means for cumulatively adding the counted contents of the program counting means each time the program counting means is incremented, and an addition result of the adding means. A step of clearing the program counting means by using a checksum buffer means for holding the checksum data stored in advance in an object program instruction and a comparing means for comparing the output data from the checksum buffer means,
If the instruction is a branch instruction, the step of clearing the checksum buffer means, the step of reading one instruction designated by the program count means, the step of determining whether the read instruction is a branch instruction or another instruction Instructing the step of clearing the checksum data and adding the address value of this instruction to the contents of the checksum buffer means if it is another instruction, and outputting the operation code of the read instruction to the comparison means. Determining whether it is a check command to be performed, and if the determination result is not the check command,
It is composed of a step of returning to the step of reading the instruction and reading the next instruction, and a step of comparing the checksum data with the operand value of the check instruction if the judgment result is the check instruction. If so, a program runaway detection method characterized by detecting runaway of the program executed by the microcomputer by the mismatch signal. 6. A program counter for counting a program execution address, an adder for cumulatively adding the contents of the program counter each time the program counter is incremented, a checksum buffer for holding the addition result, and an object in advance. A software development device for generating the object program of a microcomputer including a program runaway detection circuit, which comprises a checksum data stored in a program command and a comparator for comparing output data from the checksum buffer. An instruction embedding means for analyzing input source program instructions, calculating checksum data of execution addresses in program execution, and incorporating the calculated checksum data into object program instructions A software development device for detecting runaway programs characterized by. 7. The check instruction incorporated in the object program and the checksum data which becomes an operand part of the check instruction are mapped to an absolute address space when the source program is converted into an object, and the checksum data of the check instruction is stored. 7. The software development device for detecting program runaway according to claim 6, wherein the operand part is generated. 8. A program counting means for counting a program execution address, an adding means for cumulatively adding the contents of the program counter each time the program counting means is incremented, and a checksum for holding the addition result of the adding means. Software for generating an object program of a microcomputer using program runaway detection means, which comprises buffer means and comparison means for comparing checksum data previously stored in an object program instruction with output data from the checksum buffer means. A generation method, which is a step of clearing the checksum data, a step of reading the source program for one instruction, and a step of judging whether the branch instruction is a branch instruction. If the judgment result is no, the absolute address assigned is checked. The step of adding to the checksum data, the step of determining whether or not it is the check instruction, and if the result of this determination is no, return to the step of reading the source program for one instruction, and the result of the determination is the check instruction. When it is determined that the value of the checksum data that has been cumulatively added is stored in the operand part of the check instruction, and when it is a branch instruction in determining whether the branch instruction, the checksum data is stored. A method for generating software for detecting program runaway, which comprises a step of clearing.