WO2010097844A1

WO2010097844A1 - Runaway detection device

Info

Publication number: WO2010097844A1
Application number: PCT/JP2009/002474
Authority: WO
Inventors: 森有佳理; 三宅二郎; 谷村昌史
Original assignee: パナソニック株式会社
Priority date: 2009-02-25
Filing date: 2009-06-02
Publication date: 2010-09-02

Abstract

The runaway detection device is equipped with a first register (12) having a first field and a second field, a second register (13) that stores the first field data before the stored content of the first register is updated, a comparator (14) that compares the second field data with the stored content of the second register and outputs a match signal if they match, and a timer (11) that counts a certain period of time and that receives the match signal and is reset.

Description

Runaway detection device

The present invention relates to a runaway detection device in a microcomputer or the like.

In recent years, information processing devices represented by microcomputers (hereinafter referred to as microcomputers) have been used in a wide variety of fields such as home appliances, OA devices, communication devices, and automobile control applications. However, there are times when the device does not respond during operation, a program bug, etc. causes an infinite loop, or the system malfunctions due to external noise, etc. There is a problem. Therefore, in order to operate the system stably and normally, the operation step and the system status are monitored, and the program that escapes from the runaway state by detecting the program runaway state quickly and reliably and restarts the system. It has become an extremely important technology. In particular, for microcomputers used in systems that require safety and stability, such as microcomputers for automotive control applications, a mechanism that can detect various runaway conditions reliably and correct the trajectory will become increasingly important in the future. It is thought to become.

The watchdog timer is well known as a microcomputer runaway detection technology. However, in a typical watchdog timer, a runaway state cannot be detected when a program portion including a timer clear instruction falls into an infinite loop. Therefore, a number is assigned to the timer clear instruction, and each time the timer clear instruction is issued, the number is stored in the compare register and the counter is counted up. If the compare register value and the counter value match, the watchdog There is one that resets the timer (for example, see Patent Document 1).

JP-A-4-107748

In the improved watchdog timer described above, if the program to be monitored is changed or modified, the number of timer clear instructions that have increased or decreased due to the change or modification is taken into account, and the compare register in the program after the corrected location It is necessary to correct the data written to the. Therefore, there is a problem that the number of corrections in the program is wide and the number of correction steps increases. From the viewpoint of program diversion, it is desirable that the modification of the program accompanying the increase / decrease in the timer clear instruction is minimal.

Also, it is assumed that the overflow period setting of the watchdog timer is not appropriate as the reason why runaway detection cannot be performed. In other words, if an incorrect overflow period that should not be set is set, if the program execution is shifted to an unexpected routine due to runaway, the watchdog timer is not cleared and runaway detection cannot be performed.

In view of the above problems, an object of the present invention is to detect a system runaway that could not be detected conventionally. Furthermore, an object of the present invention is to minimize the number of program corrections associated with increase / decrease in clear instructions. Another object of the present invention is to appropriately set the overflow period of the watchdog timer.

In order to solve the above problems, the present invention has taken the following measures. First, the runaway detection device according to the first invention stores a first register having a first field and a second field, and stores the data of the first field before the stored contents of the first register are updated. A second register that compares the second field data with the stored contents of the second register, and outputs a match signal when the two match, and a timer that counts a predetermined time. And a timer that is reset in response to the coincidence signal.

According to this, the timer can be cleared only when the data in the first field before the data is written to the clear register matches the data in the second field after the data is written. In addition, when modifying a program that involves adding or deleting a clear instruction to the timer, the write data to the first register related to the change / modification is modified in consideration of the write data to the first register before and after the modification. This can be achieved.

The first register further includes a third field, and the runaway detection device changes the predetermined time of the timer based on the data of the third field when receiving the coincidence signal. It is preferable to further include a period setting unit. According to this, it is possible to prevent a problem that the watchdog timer sets the wrong runaway detection cycle. In addition, runaway can be detected at an early stage.

The second register preferably stores the data of the first field when receiving the coincidence signal. According to this, it is possible to avoid overwriting the value in the second register at the time of comparison.

It is preferable that the comparator outputs a mismatch signal when the data in the second field does not match the stored contents of the second register. The mismatch signal can be used as an interrupt signal or a reset signal for the microcomputer.

According to a second aspect of the present invention, there is provided a runaway detection device, a register that can be accessed at a plurality of addresses, a decoder that generates and outputs an identification number that does not overlap with each other from the address that is associated with accessing the register, and the decoder generates An access order storage device that holds a plurality of identification numbers to be processed and outputs these identification numbers in a predetermined order, and an identification number output from the decoder and an identification number output from the access order storage device are compared And a comparator that outputs a coincidence signal when they coincide with each other, and a timer that measures a predetermined time and is reset upon receiving the coincidence signal.

* According to this, the timer can be cleared only when the access order to the registers is correct. Even if the clear instruction is added to or deleted from the timer, the other parts of the program basically need not be modified.

It is preferable that the runaway detection device further includes a runaway detection cycle setting unit that changes the predetermined time of the timer based on the stored contents of the register when the coincidence signal is received. According to this, it is possible to prevent a problem that the watchdog timer sets the wrong runaway detection cycle. In addition, runaway can be detected at an early stage.

It is preferable that the access order storage device outputs the next identification number when receiving the coincidence signal. According to this, it is possible to avoid outputting an incorrect identification number at the time of comparison.

The comparator preferably outputs a mismatch signal when the identification number output from the decoder does not match the identification number output from the access order storage device. The mismatch signal can be used as an interrupt signal or a reset signal for the microcomputer.

According to the present invention, it is possible to detect a system runaway that could not be detected conventionally. Furthermore, it is possible to reduce the number of program corrections accompanying the increase / decrease of the clear command. In addition, the watchdog timer overflow period can be set appropriately.

FIG. 1 is a configuration diagram of the runaway detection device according to the first embodiment. FIG. 2 is a diagram illustrating a program example. FIG. 3 is a diagram showing a program example in which the program of FIG. 2 is modified. FIG. 4 is a configuration diagram of the runaway detection device according to the second embodiment. FIG. 5 is a diagram illustrating a specific example of the clear register.

Hereinafter, embodiments for carrying out the present invention will be described with reference to the drawings.

(First embodiment)
FIG. 1 shows a configuration of a runaway detection apparatus according to the first embodiment. The watchdog timer 11 is a runaway detection counter that outputs an abnormal state detection signal S1 when a predetermined time elapses. Specifically, the watchdog timer 11 outputs the signal S1 when it overflows. The signal S1 can be used as an interrupt signal or a reset signal for a microcomputer (not shown).

The clear register 12 is a register that is accessed when a clear instruction in the program is executed. The clear command is executed when the count value of the watchdog timer 11 is cleared. The clear register 12 includes a first field, a second field, and a third field. A first field saving register (hereinafter, sometimes simply referred to as “saving register”) 13 is a register for storing data of the first field of the clear register 12.

When the clear instruction is executed, data is written to the clear register 12. The comparator 14 compares the data stored in the save register 13 with the data in the second field of the clear register 12 in which the current data is written, and outputs a match signal S2 when the two match. The data held in the save register 13 is data written to the first field of the clear register 12 by the previous clear instruction.

The save register 13 preferably stores the data of the first field of the clear register 12 in which the current data is written when the match signal S2 is received. As a result, it is possible to avoid data being overwritten in the save register 13 during comparison. The comparator 14 may output the mismatch signal / S2 when the data stored in the save register 13 and the data in the second field of the clear register 12 to which the current data is written do not match. The mismatch signal / S2 can also be used as an interrupt signal or a reset signal for a microcomputer (not shown).

The watchdog timer 11 clears the count value when it receives the coincidence signal S1. On the other hand, since the coincidence signal S1 is not output during runaway, the count value of the watchdog timer 11 is not cleared and the watchdog timer 11 overflows and outputs an abnormal state detection signal S1. Thereby, it becomes possible to interrupt or reset a microcomputer (not shown).

When the runaway detection cycle setting unit 15 receives the coincidence signal S2, the runaway detection cycle setting unit 15 converts the data in the third field of the clear register 12 into an overflow cycle and sets it in the watchdog timer 11. The watchdog timer 11 detects an overflow at a set cycle. Since the data write to the third field is performed based on the clear command, if an erroneous clear command is executed due to runaway, an unexpected overflow period is written to the third field. However, at this time, if the mismatch signal / S2 is output from the comparator 14, the microcomputer (not shown) can perform an interrupt process or a reset operation. As a result, the erroneous setting of the overflow period is invalidated. In addition, an appropriate overflow cycle can be set each time a clear instruction is issued, leading to early detection of runaway.

The third field of the clear register 12 and the runaway detection cycle setting unit 15 may be omitted.

When a clear instruction is inserted into the program, the data to be written to the clear register 12 is determined so that the data written to the first field by the previous clear instruction matches the data written to the second field by the current clear instruction. To do. Hereinafter, a case where there is no third field will be described. For example, a program is created so that data is written to the clear register 12 as shown in FIG. However, both the first field and the second field are 4 bits, and the initial value of the save register 13 is 0x0. By setting the second field of data to be written to the clear register 12 by the clear instruction at address A executed first to 0x0, the comparator 14 detects a match and outputs a match signal S2, and the watchdog timer 11 The count value is cleared. By setting the first field of the write data for the clear instruction at address A to 0x1 and the second field of the write data for the clear instruction at address B to 0x1, the comparator 14 matches when executing the clear instruction at address B. Detecting and outputting the coincidence signal S2, the count value of the watchdog timer 11 is cleared.

When the clear command increases / decreases due to program change / correction, the write data to the clear register 12 related to the change / correction is corrected in consideration of the write data to the clear register 12 before and after the correction part. For example, in order to insert a clear instruction at addresses X and Y between addresses C and D in the program of FIG. 2, the program may be changed as shown in FIG. First, since 0x3 is written in the first field by the clear instruction at address C, 0x3 is written in the second field by the clear instruction at address X. The data written to the first field by the clear instruction at address X is arbitrary, for example, 0x5. Next, the data written in the second field by the clear instruction at address Y is set to 0x5 written in the first field by the clear instruction at address X. Since the data written to the second field by the clear instruction at address D is 0x3, the data written to the first field by the clear instruction at address Y is set to 0x3.

As described above, according to the present embodiment, only when the data in the first field before the data is written to the clear register 12 matches the data in the second field after the data is written, 11 can be cleared. Therefore, when the clear instruction is executed in an infinite loop due to runaway, the data in the first field and the data in the second field do not match, and the runaway can be detected. In addition, it is easy to change or modify the program in accordance with the increase / decrease of the watchdog timer 11 clear command. Furthermore, even if an overflow period longer than expected is set by mistake during runaway, runaway detection is possible.

Note that the watchdog timer 11 may output an abnormal state detection signal S1 due to underflow. Further, when the same data is written to the first field and the second field by the clear instruction, the stored contents of the clear register 12 need not be updated. As a result, even when a clear instruction that repeatedly causes the first field and the second field to be the same data due to runaway is repeatedly executed, the coincidence signal S1 is not output and the runaway can be detected.

(Second Embodiment)
FIG. 4 shows the configuration of the runaway detection device according to the second embodiment. The clear register 12 is a register having a plurality of addresses for access, that is, a register accessible by a plurality of addresses. FIG. 5 shows a specific example of the clear register 12. The clear register 12 includes a plurality of address detection circuits 121 that detect a specific address, and the logical sum of the outputs of these address detection circuits 121 becomes a write control signal for the register 122. With such a configuration, it is possible to access with a plurality of addresses.

Returning to FIG. 4, the decoder 16 generates and outputs identification numbers that do not overlap each other from the address related to the access to the clear register 12. The access order storage device 17 is a storage unit that stores an input order of addresses used when accessing the clear register 12, that is, an access order to the clear register 12. Specifically, the access order storage device 17 includes an identification number storage unit 171, a number storage unit 172, and a counter 173. The identification number storage unit 171 stores a plurality of identification numbers to be generated by the decoder 16. The number storage unit 172 stores the number of valid identification numbers. The counter 173 repeats the counting operation within the value range of the number storage unit 172. The identification number storage unit 171 sequentially outputs identification numbers corresponding to the numbers designated by the counter 173. For example, when the number of identification numbers stored in the identification number storage unit 171 is 8, 7 is set in the number storage unit 172. Therefore, the identification number entered in the 0th entry is output after the 7th entry in the identification number storage section 171.

The watchdog timer 11 and the runaway detection cycle setting unit 15 are as described above. However, in this embodiment, the runaway detection period setting unit 15 converts the data in the clear register 12 into an overflow period and sets it in the watchdog timer 11 when receiving the coincidence signal S2. The operational effects are as already described. The runaway detection cycle setting unit 15 can be omitted.

In this embodiment, when a microcomputer (not shown) is activated, the identification numbers of addresses accessed when the program operates normally are stored in the identification number storage unit 171 in the order of access. Further, the number of identification numbers to be used is stored in the number storage unit 172. The contents stored in the identification number storage unit 171 and the number storage unit 172 are updated every time a microcomputer (not shown) is activated.

When the clear register 12 is accessed by the clear instruction, the decoder 16 decodes an address related to the access and outputs an identification number. This access may be any of writing data to the clear register 12, reading data, and a shift operation. The comparator 14 compares the identification number output from the decoder 16 with the identification number output from the access order storage device 17, and outputs a match signal S2 when the two match. The access order storage device 17 preferably outputs the next identification number when receiving the coincidence signal S2. As a result, it is possible to avoid an erroneous identification number being output due to the counting operation of the counter 173 proceeding at the time of comparison.

When a clear instruction is inserted into the program, an identification number corresponding to the address accessed by the clear instruction to be added this time is inserted into the corresponding part of the series of identification numbers before the clear instruction is added, and updated accordingly. A series of identification numbers is stored in the identification number storage unit 17 when the microcomputer is activated.

As described above, according to the present embodiment, the watchdog timer 11 can be cleared only when the access order to the clear register 12 is correct. Therefore, when the clear instruction is executed in an infinite loop due to runaway, the access order to the clear register 12 is out of order, so that runaway can be detected. Further, even if the clear instruction of the watchdog timer 11 is increased or decreased, the other parts of the program basically need not be corrected. Furthermore, even if an overflow period longer than expected is accidentally set during runaway, runaway detection is possible. The address used when accessing the clear register 12 is stored in the identification number storage unit 171 as an identification number as it is. May be. In this case, although the number of bits for storing the identification number increases, there is an advantage that the decoder 16 can be omitted.

Since the runaway detection device according to the present invention can detect a runaway that could not be detected in the past, it is particularly useful for a microcomputer that is particularly required for safety or stability, for example, an automotive control application.

11 Watchdog timer (timer)
12 Clear register (first register, register)
13 First field save register (second register)
14 Comparator 15 Runaway Detection Period Setting Unit 16 Decoder 17 Access Order Storage Device

Claims

A first register having a first field and a second field;
A second register for storing the data of the first field before the stored content of the first register is updated;
A comparator that compares the data in the second field with the stored contents of the second register and outputs a match signal when they match;
A runaway detection device comprising: a timer for measuring a predetermined time, and resetting upon receiving the coincidence signal.
The first register further includes a third field;
2. The runaway detection device according to claim 1, further comprising a runaway detection period setting unit that changes the predetermined time of the timer based on data of the third field when the match signal is received.
2. The runaway detection device according to claim 1, wherein the second register stores the data of the first field when the coincidence signal is received.
2. The runaway detection device according to claim 1, wherein the comparator outputs a mismatch signal when the data of the second field does not match the stored contents of the second register.
Registers accessible at multiple addresses;
A decoder that generates and outputs an identification number that does not overlap each other from an address related to access to the register;
An access order storage device that holds a plurality of identification numbers to be generated by the decoder and outputs the identification numbers in a predetermined order;
A comparator that compares the identification number output from the decoder with the identification number output from the access order storage device, and outputs a match signal when the two match.
A runaway detection device comprising: a timer for measuring a predetermined time, and resetting upon receiving the coincidence signal.
6. The runaway detection device according to claim 5, further comprising a runaway detection cycle setting unit that changes the predetermined time of the timer based on the stored contents of the register when the match signal is received.
6. The runaway detection device according to claim 5, wherein the access order storage device outputs a next identification number when receiving the coincidence signal.
6. The runaway detection apparatus according to claim 5, wherein the comparator outputs a mismatch signal when the identification number output from the decoder does not match the identification number output from the access order storage device.