JPS603654B2 - Microcomputer trouble detection circuit - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION The present invention relates to a circuit for detecting troubles such as software runaway in a microcomputer.

As is well known, microcomputers (hereinafter referred to as microcomputers)

) There are two types of software runaway. The first is software runaway due to the microcomputer misreading the ROM program due to noise, entering an open loop and not being able to exit. The second is a software runaway caused by the application of military pressure or style to the microcomputer, which destroys part or all of the program in the ROM, causing it to no longer function as a microcomputer. As a side note, the two types of failures that cause the software to run out of control cannot be distinguished from each other as long as they are viewed from the outside.

However, in the case of the first failure, resetting the microcontroller will return it to its original normal operation, whereas in the second failure, the software itself has been destroyed, so even if the microcontroller is reset, it will not return to its original normal state. The big difference is that it won't come back. The present invention has focused on this point, and its purpose is to distinguish between two types of failures, to automatically reset the microcomputer in the case of the first failure, and to automatically issue an alarm in the case of the second failure. By sounding this, a circuit is provided to detect software runaway.

The present invention will be described below with reference to the drawings. In FIG. 1, numeral 10 is a microcomputer, in which a predetermined program is stored and stored, and external terminals include a first output port P, a second output port P2, a reset terminal RES, and a reference clock pulse for operating each part of the microcomputer. It has an ALE terminal from which a reference signal is oscillated. The first and second output ports P and P2' are normally at a low level. Also, this microcomputer 10 has a reset terminal RE.
When a low level pulse is input to S, a set is applied, and the second output port P2 rises to the level /.
When the microcomputer starts running and passes through the processing routine once, the second output port P2 returns to the low level. 20 is a first failure detection circuit, which receives pulses S from the first output port P,
When P2 is input and software runaway is detected, a low level pulse is output to the reset terminal RES of the microcomputer 10 to reset the microcomputer 10.

That is, the pulse Sp2 from the first output port P of the first failure detection circuit 2 is inputted to the reset terminal R of the first counter 21, the reference signal of the microcomputer 10 is received at the clock terminal CL, and the pulse Sp2 from the first output port P is inputted to the reset terminal R of the first counter 21. A pulse SQm with a period Tm that is 2m times the period of the reference signal is sent to the output terminal Q of the first counter 21.
The pulse Som outputted from the microcomputer 10 and inverted via the first inverter 22 is input to the reset terminal RES of the microcomputer 10. 30 is a second failure detection circuit, into which the pulse Sp from the second output port P2 is input, and the microcomputer 1
When it detects software runaway due to program corruption in 0, it issues a high-level pulse S.

In other words, the pulse Sp from the second output port P2 of the second failure detection circuit 3 is inverted via the second inverter 32, and this inverted pulse Sp is sent to the reset terminal of the second counter 31. input to R. The second counter 31 receives the reference signal of the microcomputer 10 at the clock terminal CL, outputs a pulse SQn with a period [n] which is multiplied by 2n (where n>m) of the period of this reference signal from the output terminal Qn, and further A pulse Son is input to the reset input terminal R of the flip-flop 33. A power supply voltage Vc supplied to the microcomputer 10 is applied to a set input terminal S of this flip-flop 33 via a delay circuit 34 composed of a capacitor C and a resistor R. Then, an output pulse S is output from the inverting output terminal Q of the flip-flop 33.
Toru is output. 40 is an alarm circuit, and output pulse S
Q is received at the base of an NPN type transistor TR whose emitter is grounded, and a power supply voltage Vc is applied to the collector of a buzzer 41, for example.
applied via.

Here, FIG. 2 shows a flowchart of the program of the microcomputer 10, FIG. 3 is a timing diagram at the time of the first failure due to noise etc., and FIG. 4 shows a flow chart of the program of the microcomputer 10. FIG. 10 shows a timing diagram at the time of a second failure due to the addition of

The operation of the embodiment circuit shown in FIG. 1 will be explained below.

First, the second output port P2 is maintained at a high level until the microcomputer completes one cycle of the processing routine according to the flowchart of FIG. In other words, when the second failure occurs, the processing routine cannot be exited, and the second output port P2 maintains the level, so the buzzer 41 sounds and the second failure can also be detected. First, the case of the first failure will be explained with reference to FIG.

According to the flowchart shown in FIG.
, outputs an output pulse Sp2 that becomes high level for, for example, 5 French seconds just before entering the processing routine, and is maintained at low level while the processing routine is executed.

At this time, since the cycle of the processing routine is TL, the pulse Sp2 is outputted from the first output port P every TL time. Incidentally, the period Tm, which is 1'2 cycles of the output pulse Som of the first counter 21, is set to Tm>TL. Therefore, the first counter 21 is always reset, and the output pulse Som is always at a low level. However, when the first failure occurs, the program flow cannot proceed from the processing routine due to software runaway, and the output pulse Sp2 is no longer output. Then, the period during which the output pulse Sp2 is not output exceeds the period Tm, and the first counter 21 is no longer reset. As a result, the output pulse Som becomes high level, the microcomputer 10 is reset, and returns to the normal state. Note that the output pulse Sp, is the output pulse So
When m reaches high level, it becomes /・i level,
Since the output pulse Sp2 is output after a time TL has elapsed since the microcomputer 101 was reset, it returns to the low level. Therefore, since the output pulse Sp, is at a high level only during the TL time, the output pulse Son
and S are both low level, so the buzzer does not sound.
Next, the second failure case will be explained according to FIG.

First, in the same way as the first failure, when the second failure occurs, the pulse Som suddenly changes to a low level, thereby attempting to reset the microcomputer 10.

However, since the program itself has been destroyed, it is not reset and does not pass through the processing routine. Therefore, after the occurrence of the second failure, the output pulse Sp2 is not generated, and the output pulse Sp, which became high level when the microcomputer 10 was tried to be reset, continues to maintain the high level, and this high level is maintained for the second time. A period Tn that is 1/2 period of the output pulse Son of the counter 31
Exceed. As a result, the output pulse SQn is
After time Tn has elapsed since the time when the flip-flop 33 was attempted to be reset, it becomes high level, and the flip-flop 33 is reset. The power supply voltage Vc is input to the set input terminal S of the flip-flop 33 via the delay circuit 34, and the terminal S
is maintained at a high level, but when the high level output pulse Son is applied to the terminal R, the inverted output pulse S
Q is inverted to a high level, transistor TR is turned on, and the buzzer 41 sounds. As described above, according to the software runaway detection circuit in a microcomputer of the present invention, software runaway due to noise is a malfunction that can be recovered by resetting the microcomputer, and software runaway due to noise cannot be recovered even if the microcomputer is reset. It is possible to determine whether the program is running out of control due to a large voltage or current being applied to the microcontroller, and in the case of the former software runaway, the microcontroller is automatically reset to return it to a normal state. In addition, in the latter case, if the software goes out of control, it can be detected by the buzzer sounding eight times.

[Brief explanation of drawings]

FIG. 1 shows an embodiment of the present invention, and FIG. 2 shows a diagram of a microcomputer. FIGS. 3 and 4 are timing diagrams of the embodiment. 10: Microcomputer, 20: First failure detection circuit, 30: Second failure detection circuit, 40: Alarm circuit, 21, 31: Counter, 2
2'32: Inverter, 33: Flip-flop, 3
4: Delay circuit, 41: Buzzer, Sp,: Output port P,
Sp2: Output pulse from output boat P2, SQm: Output pulse from counter 21, SQn:
Output pulse of counter 31, SQ: inverted output pulse of flip-flop 33; Figure 1 Figure 3 Figure 2 Figure 4

Claims (1)

[Claims] 1 A pair of first and second output ports in which initial setting values when a certain processing routine is started to be executed according to a stored predetermined program are output as first and second values that are inverted with each other. and a reference clock terminal from which a reference signal oscillated as a driving clock for executing arithmetic processing of each part is drawn out, the microcomputer comprising: a reference clock terminal from which a reference signal oscillated as a driving clock for executing arithmetic processing of each part is drawn out; Invert the boat's default settings,
After the lapse of a predetermined time, the initial setting value is returned to the original value, and each time the process execution of the certain process routine is repeated, the inverted value appears from the first output port, and the process of the certain process routine is continued from the start. A microcomputer that inverts the initial setting value of the second output port after completing one processing execution, and returns the second output port to the initial setting value only when a reset is applied to the microcomputer. A first time period longer than a processing execution period of the certain processing routine is measured based on the reference signal supplied from the reference clock terminal, and a time period during which the inverted value of the first output port repeatedly appears. a first fault detection circuit for monitoring an interval and resetting the microcomputer when the interval exceeds the first time; while the second output port maintains the initial setting value; A second time period that is longer than the first time period is measured based on the reference signal supplied from the reference clock terminal, and a controlled unit such as an alarm means is actuated after the second time period has been measured. 2. A trouble detection circuit for a microcomputer equipped with a trouble detection circuit.