KR102019378B1 - Appartus for monitoring microcontroller unit, system having the same and operating method thereof - Google Patents

Abstract

The monitoring apparatus for monitoring a microprocessor unit according to the present invention comprises: an error detector for periodically detecting an error in the operation of the microprocessor unit and generating corresponding flags; A flag processor configured to input a bit corresponding to the flags by a shift buffering scheme, compare an input value with a reference value, and generate an interrupt signal, and a reset controller which generates a reset signal in response to the interrupt signal. have.

Description

Supervisors for monitoring microprocessor units, their containing systems and methods of operation {APPARTUS FOR MONITORING MICROCONTROLLER UNIT, SYSTEM HAVING THE SAME AND OPERATING METHOD THEREOF}

The present invention relates to a monitoring apparatus for monitoring a microprocessor unit, a system including the same, and a method of operating the same.

A system incorporating a microprocessor is provided with a monitoring device for resetting the microprocessor when a failure is detected by managing or monitoring the operation of the microprocessor. Typically such a monitoring device is called a watchdog. A typical watchdog has a timer circuit in the form of a counter or retrieval monostable circuit that resets the microprocessor if the timer circuit is not reset after a predetermined time has elapsed. Watchdog instructions that operate as instructions for resetting the timer circuit are embedded in the program executed by the microprocessor. The reset instruction is executed periodically so that if the microprocessor operates correctly, the timer circuit is always reset before the predetermined time has elapsed, so that the timer circuit does not reset the microprocessor. On the other hand, when a failure occurs, the timer circuit is not reset, which resets the microprocessor.

US Patent No. 8,244,425, published April 30, 2009, titled: “Method and apparatus for monitoring processor integrity in a distributed control module system for a powertrain system”. Korean Patent Registration No. 10-1304209, Publication Date: June 10, 2011, Title: “How to check can message timeout error”.

It is an object of the present invention to provide a monitoring apparatus for monitoring a microprocessor unit which improves reliability, a system including the same, and a method of operating the same.

An apparatus for monitoring a microprocessor unit according to an exemplary embodiment of the present disclosure may include: an error detector configured to periodically detect an error of an operation of the microprocessor unit and to generate corresponding flags; A flag processor configured to input a bit corresponding to the flags by a shift buffering method, and generate an interrupt signal by comparing the input value with a reference value; And a reset controller generating a reset signal in response to the interrupt signal.

In an embodiment, the error detector may include: a query response generating unit generating a query message and a value corresponding to the query message; And a response diagnosis unit configured to receive a response message corresponding to the query message from the microprocessor unit and to compare the received response message with the corresponding value.

In example embodiments, the error detector may further include a watchdog timer that counts a response time from when the query message is transmitted to the microprocessor unit until the response message is received from the microprocessor unit.

In an embodiment, when receiving the response message in the closed window section of the watchdog timer, the response diagnostic unit may generate an early answer flag (EAF).

In an embodiment, when the response message and the corresponding value are different, the response diagnostic unit may generate an incorrect answer flag (IAF).

In an embodiment, when the response message is not received despite the timeout of the watchdog timer, the response diagnostic unit may generate a timeout flag (TOF).

In an embodiment, the existing flags may be transmitted to the microprocessor unit.

In example embodiments, when the response message is received in the open window period of the watchdog timer, and the response message and the corresponding value are different from each other, the flag processor may shift buffer the bit.

The flag processor may be configured to receive the response message in the open window period, and to input a bit of '0' and shift the remaining value bit by bit when the response message and the corresponding value are different. Shift buffer; And a response shift filter for storing the reference value.

The method may further include an interrupt controller configured to generate the interrupt signal by comparing the value stored in the response shift buffer with the reference value.

In an embodiment, the reference value may be a variable value.

An operating method of a monitoring apparatus for monitoring a microprocessor unit according to an exemplary embodiment of the present disclosure may include: detecting an error of an operation of the microprocessor unit in a query response manner; Storing the bits corresponding to the presence or absence of corresponding errors according to the shift buffering scheme; And determining whether to interrupt or reset the microprocessor unit by comparing the stored value with a reference value.

In an embodiment, the query response method may be a seed-key method.

The detecting of the presence of an error may include generating the seed and a key; Resetting a watchdog timer when generating the seed and key; And waiting for a key trigger generated from the microprocessor unit.

The detecting of the presence of an error may include determining whether the key trigger has been received; Determining whether the generated key value coincides with the key trigger when the key trigger is received; And determining whether the watchdog timer is timed out when the key trigger is not received.

The storing of the corresponding bit may include: determining whether the watchdog timer is an open window period when the generated key value and the key trigger match; And inputting a bit of '1' into a response shift buffer when the watchdog timer is in the open window period.

The storing of the corresponding bit may include inputting a bit of '0' into a response shift buffer when the key trigger is not received and the watchdog timer is the timeout. Can be.

In an embodiment, the determining of whether to interrupt or reset may include generating the interrupt or reset signal when the value stored in the response shift buffer is the reference value.

In an embodiment, when the key trigger is not received and the watchdog timer is not the timeout, the step of waiting for the key trigger may be entered.

A microprocessor system according to an embodiment of the present invention includes a microprocessor unit having a seed-key generation circuit for generating a key trigger in response to a seed value; And a monitoring device for monitoring the microprocessor unit in a seed-key manner, wherein the monitoring device is configured when the key trigger received from the seed-key generating circuit does not match a key value corresponding to the seed value. And generating a response error flag, transmitting the generated response error flag to the microprocessor unit, and when the response error flag is generated in an open window section of a watchdog timer, operating the microprocessor unit in a shift buffering manner. This can increase the number of errors for.

In example embodiments, when the key trigger is not received during the timeout of the watchdog timer, the monitoring apparatus may increase the number of errors in the shift buffering scheme.

In an embodiment, when the number of errors is greater than or equal to a reference value, the monitoring apparatus may generate an interrupt signal or a reset signal and transmit the interrupt signal or the reset signal to the microprocessor unit.

The monitoring apparatus, a system including the same, and an operation method thereof according to an exemplary embodiment of the present invention assist the timing protection management of the MCU without fail processing using an error message, and replace the conventional error counter with a response shift buffer. By accumulating and using the pass / fail result accumulated for a predetermined time, it is possible to maximize the reliability of the monitoring operation while reducing the chip size compared with the conventional one.

Monitoring apparatus according to an embodiment of the present invention, a system including the same and its operation method is monitored only within the latest time window using a response shift method, so that if the MCU is normalized immediately after failing to operate the system without a separate reset This is possible.

In addition, the monitoring apparatus, a system including the same, and an operation method thereof according to an exemplary embodiment of the present disclosure may correspond to various fail patterns by operating a plurality of response shift filter values.

In addition, the monitoring apparatus according to an embodiment of the present invention, a system including the same, and an operation method thereof may facilitate fail pattern analysis by transmitting a response shift value at a fail time to an MCU in an interrupt manner and storing the same. .

BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings are provided to facilitate understanding of the present embodiment, and provide embodiments with a detailed description. However, the technical features of the present embodiment are not limited to the specific drawings, and the features disclosed in the drawings may be combined with each other to constitute a new embodiment.
1 is a diagram illustrating a microprocessor system 10 according to an exemplary embodiment of the present invention.
2 is a diagram exemplarily illustrating a shift buffering operation of the monitoring apparatus 200 according to an exemplary embodiment.
3 is a flowchart illustrating a monitoring operation of the monitoring device 200 according to an exemplary embodiment of the present invention.
4 is a diagram illustrating a method of operating a monitoring apparatus according to an exemplary embodiment of the present disclosure.

DETAILED DESCRIPTION Hereinafter, the contents of the present invention will be described clearly and in detail so that those skilled in the art can easily implement the drawings.

As the inventive concept allows for various changes and numerous embodiments, particular embodiments will be illustrated in the drawings and described in detail in the text. However, this is not intended to limit the present invention to a specific disclosed form, it should be understood to include all modifications, equivalents, and substitutes included in the spirit and scope of the present invention. Terms such as first and second may be used to describe various components, but the components should not be limited by the terms.

The terms may be used for the purpose of distinguishing one component from another component. For example, without departing from the scope of the present invention, the first component may be referred to as the second component, and similarly, the second component may also be referred to as the first component. When a component is referred to as being "connected" or "connected" to another component, it may be directly connected to or connected to that other component, but it may be understood that another component may be present in the middle. Should be. On the other hand, when a component is said to be "directly connected" or "directly connected" to another component, it should be understood that there is no other component in between.

Other expressions describing the relationship between components, such as "between" and "immediately between" or "neighboring to" and "directly neighboring", should be interpreted as well. The terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting of the invention. Singular expressions include plural expressions unless the context clearly indicates otherwise.

In this application, the terms "comprise" or "having" are intended to indicate that there is a feature, number, step, action, component, part, or combination thereof that is implemented, and that one or more other features or numbers are present. It should be understood that it does not exclude in advance the possibility of the presence or addition of steps, actions, components, parts or combinations thereof. Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art. Terms such as those defined in the commonly used dictionaries should be construed as meanings consistent with the meanings in the context of the related art and shall not be construed in ideal or excessively formal meanings unless expressly defined in this application. .

1 is a diagram illustrating a microprocessor system 10 according to an exemplary embodiment of the present invention. Referring to FIG. 1, the microprocessor system 10 may include a microcontroller unit (MCU) 100 and a monitoring device 200 for monitoring its operation. The processing system 10 here may be an electronic control unit (ECU) for a vehicle.

The MCU 100 may include a query response circuit 110 that receives the query message Q from the monitoring apparatus 200 and generates a response message A in response to the received query message Q. The query message Q may be a seed value, and the response message Q may be a key value corresponding to the seed value.

The monitoring device 200 may be implemented to monitor the operation of the MCU 100. For example, the monitoring device 200 may be called a watchdog. In an embodiment, the monitoring device 200 may be implemented as an application specific integrated circuit (ASIC). The monitoring device 200 may include a flag generator 210, a flag processor 220, and a reset controller 230.

The flag generator 210 may be implemented to monitor the operation of the MCU 100 according to a query response method. The flag generator 210 may include a query response generation unit 212, a response diagnostic unit 214, and a watchdog timer 216, as shown in FIG. 1.

The query response generating unit 212 may be implemented to produce a query message Q. The query message Q may be a seed value. In addition, the query response generating unit 212 may generate a value for confirming the response message A corresponding to the query message Q. In an embodiment, the query response generating unit 212 may include a seed-key generating unit.

In addition, the query response generating unit 212 may transmit the generated query message Q to the MCU 210.

The response diagnostic unit 214 receives the response message A from the query response circuit 110 of the MCU 100 and determines whether the value generated in the query response generating unit 212 and the response message A match. can do.

In an embodiment, the response diagnosis unit 214 may be implemented to determine whether the response message A is error based on the time information of the watchdog timer 216. For example, when the watchdog timer 216 receives the response message A in an open window section, and the value generated by the query response generating unit 212 does not match the response message A, The operation of the MCU 100 may be determined to be an error. The open window section is an active section of the monitoring operation of the monitoring device 200.

On the other hand, the watchdog timer 216 may ignore the monitoring operation regardless of whether an error of the response message (A) in the closed window period. Here, the closed window section is an inactive section of the monitoring operation of the monitoring device 200.

On the other hand, if the time from the time when the inquiry message Q is sent to the MCU 100 to the time when the response message A is received is timed out, the response diagnostic unit 214 determines that the response message A Regardless of the value, it may be determined that the operation of the MCU 100 is an error.

The watchdog timer 216 may be implemented to reset / refresh when the query message 210 is generated in the query response generation unit 212. The watchdog timer 216 may be implemented to indicate a closed window section and an open window section. Here, the closed window section and the open window section may be implemented by counting an internal clock. The watchdog timer 216 may be implemented, for example, to generate a signal indicating a timeout.

Meanwhile, the response diagnostic unit 214 of the flag generator 210 may generate an incorrect answer flag (AFF) when the received response message A and the stored value are different. The generated response error flag IAF may be transmitted to the MCU 100 or to the flag processor 220.

In addition, the response diagnosis unit 214 of the flag generator 210 may generate an early response flag (EAF) when receiving the response message A in the closed window section of the watchdog timer 216.

In addition, the response diagnostic unit 214 of the flag generator 210 may generate a timeout flag (TOF) based on the timeout information of the watchdog timer 216.

The flag processor 220 receives at least one flag signal (eg, IAF, EAF, TOF) output from the response diagnosis unit 214, and shifts buffering without counting an error number using the received flag signal. Can be implemented to manage the number of errors. The flag processor 220 may include a response shift buffer 222, a response shift filter 224, and an interrupt controller 226.

The response shift buffer 222 may receive an error response flag signal IAF indicating whether the response message A is in error, an early response flag signal EAF associated with the open / closed section information, or a timeout flag signal TOF. On the basis of this, it may be implemented to store a bit (eg, '0') indicating an error of an operation of the MCU 100 or to shift the stored value. According to an embodiment, the response shift buffer 222 may include registers corresponding to the number of errors to be determined.

The response shift filter 224 may be implemented to determine an interrupt by comparing a predetermined value with a value stored in the response shift buffer 222. In an embodiment, the value stored in the response shift filter 224 may vary. That is, the reference value for generating the interrupt signal INT may be changed.

The interrupt controller 226 may be implemented to generate an interrupt signal INT according to the result of the response shift filter 224. The interrupt signal INT may interrupt the operation of the MCU 10.

Meanwhile, although the interrupt controller 226 is included in the flag processor 220 in FIG. 1, it is to be understood that the interrupt controller 226 may not be included in the flag processor 220.

The reset controller 230 may be implemented to generate a reset signal RST in response to the interrupt signal INT of the interrupt controller 226. Here, the reset signal RST may reset the operation of the MCU 100.

Meanwhile, although one MCU 100 is illustrated in FIG. 1, it should be understood that the monitoring apparatus 200 may monitor the operation of a plurality of MCUs.

Generally, considering the purpose of a watchdog for MCU timing protection, failing an error message is unnecessary. In general, the watchdog uses a counter as an error handling method, and thus it is difficult to apply a filter time to determine whether the normal operation is returned.

On the other hand, the monitoring device 200 according to an embodiment of the present invention may process the watchdog fail only when there is no MCU trigger (for example, out of timeout) for a predetermined time. The monitoring apparatus 200 according to the present invention stores the pass / fail status of the operation of the MCU 100 in the response shift buffer 222, and utilizes the result values accumulated in the response shift buffer 222 for a final time. It may be determined whether to reset 100.

Specifically, when the monitoring device 200 generates an inquiry message Q, that is, a watchdog seed and transmits the watchdog seed to the MCU 100, the MCU 100 may provide a key suitable for the watchdog seed. A response message A, that is, a generated key, may be transmitted to the monitoring apparatus 200. When the key value transmitted from the MCU 100 matches the predetermined value and the MCU trigger is made in the open window section, the operation of the MCU 200 is determined to be a normal operation, and the response shift buffer 222 is performed. Bit '1' corresponding to may be input. On the other hand, when the key value transmitted from the MCU 100 is different from the predetermined value or when the MCU trigger is made in the closed window section, a flag signal corresponding to the MCU 100 (response error flag signal IAF) Alternatively, an early response flag signal (EAF) may be transmitted. In addition, when the MCU trigger is not performed until the watchdog timeout time, the timeout flag signal TOF is transmitted to the MCU 100 and a bit '0' corresponding to the response shift buffer 222 may be input. have.

At this time, when the value stored in the response shift buffer 222 is equal to the reference value, the watchdog reset signal RST is generated. Otherwise, a new watchdog cycle may be started.

The monitoring apparatus 200 according to an embodiment of the present invention assists in timing protection management of the MCU 100 without failing by using an error message, and uses the response shift buffer 222 instead of the conventional error counter. By using the pass / fail result accumulated for a predetermined time, it is possible to maximize the reliability of the monitoring operation while reducing the chip size compared with the conventional one.

The monitoring apparatus 200 according to an exemplary embodiment of the present invention monitors only the latest time window using a response shift method, and thus, when the MCU 100 is normalized immediately after failing, the system may be operated without a separate reset.

In addition, the monitoring apparatus 200 according to an embodiment of the present invention may correspond to various fail patterns by operating a plurality of response shift filter values.

In addition, the monitoring apparatus 200 according to an embodiment of the present invention may facilitate the fail pattern analysis by transmitting the response shift value at the fail time to the MCU 100 in an interrupt manner and then storing the same.

2 is a diagram exemplarily illustrating a shift buffering operation of the monitoring apparatus 200 according to an exemplary embodiment. 1 and 2, the shift buffering operation for the MCU 100 of the monitoring apparatus 200 is as follows. In FIG. 2, for convenience of explanation, it is assumed that the response shift buffer 222 (see FIG. 1) stores four bits. However, it should be understood that the number of bits stored in the response shift buffer 222 of the present invention is not limited thereto.

By default, the response shift buffer 222 is stored as '1111'. All of the arrows T1, T2, T3, T5, T6, and T7 except the arrows T4, T8, and T9 indicating the timeout will indicate the trigger timing of the MCU 110 (see FIG. 1).

At the time points T4, T8, and T9 indicating the timeout, a timeout flag signal TOF having a high level H may be generated and transmitted to the MCU 100.

At the trigger time points T2 and T4 received in the closed window section, a high level H early response flag EAF is generated regardless of whether the response message A is in error and is sent to the MCU 100. Can be sent.

A response error of a high level (H) at a time point (T5, T) at which it is determined that the response message (A) transmitted by the MCU trigger is an error, regardless of whether it is an open window section or a closed window section. The flag signal IAF may be generated and transmitted to the MCU 100.

The response shift buffer 222 may be implemented to perform corresponding bit input and shifting in consideration of the overall timeout flag signal TOF, early response flag signal EAF, and response error flag signal IAF. . For example, the response shift buffer 222 may perform data fluctuation and shifting operations at the MCU trigger points T1, T3, and T7 and the timeout points T4, T8, and T9.

In the MCU trigger time point T1, since it is an open window period and there is no error in the response message A, data of '1' is stored in the response shift buffer 222 and one bit shifting operation is performed. Therefore, the stored value of the response shift buffer 222 is '1111'.

In the MCU trigger time point T3, since it is an open window period and there is no error in the response message A, data of '1' is stored in the response shift buffer 222, and one bit shifting operation is performed. Therefore, the stored value of the response shift buffer 222 is '1111'.

In the case of the timeout time T4, since there is no MCU trigger during the timeout period, it is treated as an error. Data of '0' is stored in the response shift buffer 222, and a bit shifting operation is performed. Therefore, the stored value of the response shift buffer 222 is '1110'.

In the MCU trigger time point T7, since it is an open window period and there is no error in the response message A, data of '1' is stored in the response shift buffer 222, and one bit shifting operation is performed. Therefore, the stored value of the response shift buffer 222 is '1101'.

In the case of the timeout time T8, since there is no MCU trigger during the timeout period, it is treated as an error. Data of '0' is stored in the response shift buffer 222, and a bit shifting operation is performed. Therefore, the stored value of the response shift buffer 222 is '1010'.

In the case of the timeout time T9, the MCU is not treated as an error during the timeout period. Data of '0' is stored in the response shift buffer 222, and a bit shifting operation is performed. Therefore, the stored value of the response shift buffer 222 is '0100'.

The response shift filter stores '0100'. Therefore, the interrupt signal INT may be generated by comparing the value stored in the response shift filter with the value stored in the response shift buffer 222. For example, if the value stored in the response shift buffer 222 is '0100', an interrupt signal INT having a high level H may be generated and transmitted to the MCU 100. In response to the interrupt signal INT, a reset signal RST may be generated and transmitted to the MCU 100.

3 is a flowchart illustrating a monitoring operation of the monitoring device 200 according to an exemplary embodiment of the present invention. 1 to 3, the monitoring apparatus 200 may proceed as follows. In the following description, it is assumed that the query response method is a seed-key method for convenience of description. On the other hand, it should be understood that the query response method of the present invention is not limited to the seed-key method.

The monitoring device 200 may generate a seed and a key for starting a monitoring operation (S110). The generated seed value will be sent to the MCU 100. At this time, the watchdog timer 116 may be reset (S120). After that, the monitoring apparatus 200 waits for the MCU trigger (S120). The MCU trigger is a key value corresponding to the seed value output from the MCU 100.

The monitoring device 200 may determine whether the key trigger has been received (S132). If the key trigger is received, it may be determined whether the key value received from the MCU and the key value generated by the monitoring apparatus 200 match (S140). Thereafter, it may be determined whether a time point at which a key value is received is an open window section (S150). If the time point at which the key value is received is an open window section, '1' is input to the response shift buffer 222 (see FIG. 1), and previously stored values may be shifted by one bit (S160). On the other hand, if the key value generated in the monitoring device 200 in step S140 does not match or is not an open window section in step S150, the related information may be notified to the MCU 100 in the form of a flag signal (S162).

In addition, in step S132, if the key trigger is not received, it may be determined whether or not timeout (S134). If timeout, '0' is input to the response shift buffer 222, and previously stored values may be shifted bit by bit. The relevant information may be notified to the MCU 100 in the form of a flag signal (S170). Thereafter, it may be determined whether a value stored in the response shift buffer 222 and a predetermined value PDV stored in the response shift filter 224 match (S180). When the value stored in the response shift buffer 222 and the predetermined value PDV of the response shift filter 224 are the same, an interrupt signal INT or a reset signal RST may be generated (S190). .

In addition, if it is not the timeout in step S134, step S130 may proceed.

In addition, after step S160, step S110 may be performed for a new period of the watchdog monitoring operation. In addition, if the value stored in the response shift buffer 222 and the predetermined value PDV of the response shift filter 224 are not the same in operation S180, operation S110 may be performed for a new period of the watchdog monitoring operation.

On the other hand, the monitoring device according to an embodiment of the present invention will not be understood that the error detection only by the query response method. In addition, it should be understood that error detection of the MCU may be performed in various ways.

4 is a diagram illustrating a method of operating a monitoring apparatus according to an exemplary embodiment of the present disclosure. 1 to 4, the operation of the monitoring apparatus of the present invention may proceed as follows.

The monitoring device may detect whether an operation of the MCU is error based on various methods during the watchdog cycle (S210). In this case, the MCU may include a plurality of cores. The monitoring apparatus may detect an operation error of all of the plurality of cores or detect an operation error of each of the plurality of cores.

The monitoring device may store bit information on the presence or absence of an error in the operation of the MCU by the shift buffering method (S220). In this case, bit information corresponding to each of the plurality of cores of the MCU may be stored. Then, by comparing the stored value with the reference value, it may be determined whether the MCU is interrupted or reset. Here, each reference value of the plurality of cores may be the same or different.

On the other hand, the content of the present invention described above is only specific embodiments for carrying out the invention. The invention will include not only specific and practically available means per se, but also technical ideas as abstract and conceptual ideas that may be utilized in future technology.

10: microprocessor system
100: MCU
110: question and answer circuit
200: monitoring device
210: flag generator
220: flag handler
230: reset controller
212: query response generation unit
214: response diagnostic unit
216: watchdog timer
222: response shift buffer
224: response shift filter
226: interrupt controller
INT: interrupt signal
RST: reset signal
IAF: Response Error Flag Signal
EAF: Early Response Flag Signal
TOF: Timeout Flag Signal
Q: Inquiry Message
A: response message

Claims (20)

In the monitoring device for monitoring the microprocessor unit:
An error detector for periodically detecting an error in the operation of the microprocessor unit in a seed-key manner and generating corresponding flags;
A flag processor configured to input a bit corresponding to the flags by a shift buffering method, and generate an interrupt signal by comparing the input value with a reference value; And
A reset controller for generating a reset signal in response to the interrupt signal,
The error detector,
A query response generating unit for generating a query message and a value corresponding to the query message; And
And a response diagnostic unit for receiving a response message corresponding to the query message from the microprocessor unit and comparing the received response message with the corresponding value. delete The method of claim 1,
The error detector,
And a watchdog timer that counts a response time from when the query message is sent to the microprocessor unit until the response message is received from the microprocessor unit. The method of claim 3, wherein
And upon receiving the response message in the closed window section of the watchdog timer, the response diagnostic unit generates an early answer flag (EAF). The method of claim 3, wherein
And when the response message and the corresponding value are different, the response diagnostic unit generates an incorrect answer flag (IAF). The method of claim 3, wherein
And when the response message is not received despite the timeout of the watchdog timer, the response diagnostic unit generates a timeout flag (TOF). The method of claim 3, wherein
And the flags are transmitted to the microprocessor unit. The method of claim 3, wherein
And receiving the response message in the open window period of the watchdog timer, and when the response message and the corresponding value are different, the flag processor shifts and buffers the bit. The method of claim 8,
The flag handler is,
A response shift buffer which receives the response message in the open window period, shifts a bit of '0' and shifts the remaining value bit by bit when the response message is different from the corresponding value; And
And a response shift filter for storing the reference value. The method of claim 9,
And an interrupt controller for generating the interrupt signal by comparing the reference value with a value stored in the response shift buffer. The method of claim 9,
And the reference value is a variable. In a method of operating a monitoring device for monitoring a microprocessor unit:
Detecting the presence or absence of an error in the operation of the microprocessor unit in a seed-key manner;
Storing the bits corresponding to the presence or absence of corresponding errors according to the shift buffering scheme; And
Determining whether to interrupt or reset the microprocessor unit by comparing a stored value with a reference value,
The detecting of the presence or absence of the error may include:
Generating a seed and a key;
Resetting a watchdog timer when generating the seed and key; And
Waiting for a key trigger generated from the microprocessor unit. delete delete The method of claim 12,
The detecting of the presence or absence of the error may include:
Determining whether the key trigger has been received;
Determining whether the generated key value coincides with the key trigger when the key trigger is received; And
Determining if a watchdog timer is timed out when the key trigger has not been received. The method of claim 15,
The storing of the corresponding bit may include:
Determining whether the watchdog timer is an open window section when the generated key value matches the key trigger; And
And when the watchdog timer is in the open window period, inputting a bit of '1' into a response shift buffer. The method of claim 15,
The storing of the corresponding bit may include:
And when the key trigger has not been received and the watchdog timer is the timeout, inputting a bit of '0' into the response shift buffer. The method of claim 17,
Determining whether to interrupt or reset,
Generating an interrupt or reset signal when the value stored in the response shift buffer is the reference value. A microprocessor system comprising a microprocessor unit and a monitoring device for monitoring the microprocessor unit in a seed-key manner:
The microprocessor unit comprises a seed-key generation circuit for generating a key trigger in response to a seed value from the monitoring device,
The monitoring apparatus includes: a query response generating unit generating a query message and a value corresponding to the query message; And
An error detector for receiving a response message corresponding to the query message from the microprocessor unit, and including a response diagnostic unit for comparing the received response message with the corresponding value;
The response diagnostic unit generates a response error flag when the key trigger received from the seed-key generation circuit does not match a key value corresponding to the seed value,
Send the generated response error flag to the microprocessor unit,
When the response error flag is generated in the open window period of the watchdog timer, a microprocessor system for increasing the number of errors for the operation of the microprocessor unit by the shift buffering method. The method of claim 19,
When the key trigger is not received during the timeout of the watchdog timer, the monitoring device increases the error number in the shift buffering manner,
And when the number of errors is equal to or greater than a reference value, the monitoring apparatus generates an interrupt signal or a reset signal and transmits the interrupt signal or the reset signal to the microprocessor unit.

Images