JP2009003711A - Microcomputer stop detection device - Google Patents

Abstract

A microcomputer stop detection device capable of detecting a CPU stop due to a device failure at an early stage is provided.
A first watchdog timer 3 is cleared by a dedicated clear command issued for each program module executed by a CPU 1 and outputs a reset signal when it is not cleared within a set time. The second watchdog timers 4a and 4b start the count operation with the control start signals of the devices 2a and 2b, and output a reset signal for resetting the CPU 1 in a time shorter than the set time of the first watchdog timer 3. And cleared based on the output signals of the devices 2a and 2b.
[Selection] Figure 1

Description

  The present invention relates to a microcomputer stop detection device capable of detecting a stop of a microphone computer at an early stage.

Conventionally, a watchdog timer (hereinafter referred to as WDT) has been used to detect CPU abnormalities such as program runaway by a microcomputer (hereinafter referred to as CPU) and CPU stoppage due to program deadlock. .
Such a watchdog timer is cleared by a dedicated clear command and outputs an overflow signal when it is not cleared within a set time, and outputs an abnormality detection signal. Some have a second watchdog timer that outputs an overflow signal and outputs an abnormality detection signal in a time shorter than the overflow time (see, for example, Patent Document 1).

JP-A-10-124349

  In the above conventional apparatus, the “MSTART signal” and the “MLOOP” signal output from the CPU are used as the clear signal of the second watchdog timer. However, a CPU that does not have such a signal cannot solve this problem and cannot detect a CPU stop due to a failure of a device controlled by the CPU.

  The present invention has been made to solve the above-described problems, and an object of the present invention is to provide a microcomputer stop detection device that can detect a CPU stop due to a device failure at an early stage.

  The microcomputer stop detection device according to the present invention outputs a reset signal for resetting the microcomputer in a time shorter than the set time of the first watchdog timer, and is cleared based on the output signal of the device. A second watchdog timer is provided.

  The microcomputer stop detection device of the present invention includes a second watchdog timer that outputs a reset signal in a time shorter than the set time of the first watchdog timer and is cleared based on the output signal of the device. Therefore, it is possible to detect a microcomputer stop early due to a device failure.

Embodiment 1 FIG.
1 is a block diagram showing a microcomputer stop detection device according to Embodiment 1 of the present invention. In FIG.
In the figure, the stop detection device for the microcomputer includes a CPU 1, devices 2a and 2b, a first watchdog timer 3, and second watchdog timers 4a and 4b. The CPU 1 is a microcomputer that controls the devices 2 a and 2 b and is cleared by a clear signal from the first watchdog timer 3 or the second watchdog timers 4 a and 4 b. The devices 2a and 2b are devices controlled by the CPU 1, and the devices 2a and 2b are also configured to be cleared by a clear signal from the first watchdog timer 3 or the second watchdog timer 4a or 4b. ing. The first watchdog timer 3 is cleared by a dedicated clear command issued for each program module executed by the CPU 1 and outputs a reset signal for resetting the CPU 1 when not cleared within the set time. It is a dog timer. The second watchdog timers 4a and 4b output a reset signal for resetting the CPU 1 in a time shorter than the set time of the first watchdog timer 3, and are cleared based on the output signals of the devices 2a and 2b. Hardware watchdog timer.

  The S / W-WDT signal that is a reset signal output from the first watchdog timer 3 and the H / W-WDT (a) and H / W that are the outputs of the second watchdog timers 4a and 4b. The -WDT (b) signal is input to the NOR circuit 5, and further, the output of the NOR circuit 5 and the power reset signal are input to the AND circuit 6, and the output of the AND circuit 6 is sent to the devices 2a, 2b and the CPU 1 as a reset signal. Configured to be supplied. The ready signals nRDYa and nRDYb, which are output signals from the devices 2a and 2b, are configured to be supplied to the CPU 1 as the ready signal nRDY via the NOR circuit 7.

FIG. 2 is a functional block diagram of the first watchdog timer 3.
As illustrated, the first watchdog timer 3 includes a counter 31, a detection time holding unit 32, and a comparator 33. The counter 31 starts counting up in response to an enable signal from the CPU 1, and when the clear signal from the CPU 1 is supplied via the NOT circuit 34 and the clear signal is input to the clear terminal (CLR), the counter value is cleared. It is a counter that performs. The detection time holding unit 32 holds a detection time value for determining a time for outputting a reset signal to the CPU 1. The comparator 33 compares the count value output from the counter 31 with the detection time value of the detection time holding unit 32, and the count value output from the counter 31 is larger than the detection time value of the detection time holding unit 32. In such a case, a WDT reset signal is output. The first watchdog timer 3 is a software watchdog timer similar to the conventional one.

FIG. 3 is a configuration diagram of the second watchdog timers 4a and 4b.
As shown, the second watchdog timers 4a and 4b include a write enable signal falling edge detector 401, a read enable signal falling edge detector 402, a ready signal falling edge detector 403, a JK flip-flop 404, A counter 405, a detection time holding unit 406, and a comparator 407 are provided.

  The write enable signal falling edge detector 401 detects the falling edge of the write enable signal (nWE) from the CPU 1, and the read enable signal falling edge detector 402 detects the rising edge of the read enable signal (nRD) from the CPU 1. An edge detection unit that detects a downstream edge. The ready signal falling edge detector 403 is an edge detector that detects a falling edge of the ready signal (nRDYa or nRDYb) from the device 2a (2b). The JK flip-flop 404 is a flip-flop that inputs the output of the AND circuit 408 to the J terminal, the output of the AND circuit 409 to the K terminal, and inputs the output to the enable terminal (EN) and the clear terminal (CLR) of the counter 405. is there. The counter 405 is a counter that measures the timer time as the second watchdog timer 4a (4b), starts counting by the output from the JK flip-flop 404 that is input to the enable terminal, and is input to the clear terminal. It is configured to be cleared by the output of the JK flip-flop 404. That is, the counter 405 is configured to start a counting operation in response to a control start signal from the devices 2a and 2b from the CPU 1, and to stop the counting operation in response to a control preparation completion signal from the devices 2a and 2b. The counter 405 requires a clock for performing the counting operation, but the description thereof is omitted here.

  The detection time holding unit 406 is a functional unit that generates the detection time values of the second watchdog timers 4 a and 4 b, and the detection time is the detection time of the detection time holding unit 32 in the first watchdog timer 3. It is set shorter than this. The comparator 407 compares the counter value of the counter 405 with the output value of the detection time holding unit 406, and if the counter value of the counter 405 exceeds the output value of the detection time holding unit 406, the reset signal (H / W-WDT Signal). Further, a chip select signal (nCS1) is input to one input terminal of each of the AND circuits 408 and 409 via the NOT circuit 410, and the output of the OR circuit 411 is input to the other input terminal of the AND circuit 408. The other input terminal of the AND circuit 409 is configured to receive the output of the ready signal falling edge detection unit 403. Further, the output of the write enable signal falling edge detector 401 and the output of the read enable signal falling edge detector 402 are input to the OR circuit 411.

Next, the operation of the microcomputer stop detection device of the first embodiment will be described.
First, the operation of the first watchdog timer 3 will be described.
FIG. 4 is a flowchart showing execution of each program module.
The CPU 1 executes an instruction (WDT clear) for clearing the first watchdog timer 3 before executing module # 1 (step ST12), module # 2 (step ST22) and module # 3 (step ST32) of the program. Command) (steps ST11, ST21, ST31). When these instructions are executed, the CPU 1 outputs a WDT clear signal. The WDT clear signal output is input to the clear terminal of the counter 31, as shown in FIG. Since the WDT clear signal is generated every time one of the modules # 1 to # 3 is executed, the count value of the counter 31 is cleared every time the WDT clear signal is input. If, for example, module # 1 (step ST12) is stopped due to some trouble, the WDT clear signal is not generated, so the counter 31 is not cleared, and the count value is set for a preset time, that is, When the detection time value of the detection time holding unit 32 is exceeded, the comparator 33 outputs a WDT reset signal to reset the CPU 1.

The stop of the CPU 1 is caused not only by a program runaway or a program deadlock but also by a failure of a peripheral device connected to the CPU 1. For example, it is assumed that program modules that control the devices 2a and 2b are modules # 1 and # 2. Even if these modules # 1 and # 2 are executed at intervals of 10 milliseconds and 1 milliseconds, the detection time value of the first watchdog timer 3 is the module with the longest processing time in the program and the most executed It is set with the module time of a low priority. In the case of FIG. 4, since the execution interval of module # 3 is 10 seconds, the detection time of the detection time holding unit 32 is about 20 seconds which is twice as long.
The operation of the first watchdog timer 3 described above is the same as the conventional one.

Next, the operation of the second watchdog timers 4a and 4b will be described.
First, the case where the CPU 1 is operating normally will be described.
FIG. 5 is a timing chart showing the device control operation of the CPU at the normal time.
As shown in FIG. 4, CPU 1 executes module # 1 at 10 msec intervals to control device 2a, executes module # 2 at 1 msec intervals to control device 2b, and otherwise at 10 second intervals. Module # 3 is executed. Hereinafter, the case of controlling the device 2a will be described as an example.

  As shown in FIG. 1, a device 2a is connected to the CPU 1 through a CPU bus. When module # 1 (step ST12) is executed, the CPU 1 outputs the address signal of the device 2a to be controlled as shown in FIG. 5, and then asserts the chip select signal nCSa for selecting the device to "L". Then, control of the device 2a is started. Thereafter, when data is written to the device 2a, the write enable signal nWE is asserted to "L" and a data signal is output. Alternatively, when reading data from the device, the read enable signal nRE is asserted to “L” to wait for a data signal output from the device.

  The chip select signal nCSa, the write enable signal nWE, and the read enable signal nRE are connected to the device 2a. When the device 2a receives the chip select signal nCSa and the write enable signal nWE, it writes to input a data signal. When the operation preparation is performed and the chip select signal nCSa and the read enable signal nRE signal are received, the read operation preparation for outputting the data signal is performed. The device 2a outputs a ready signal nRDYa as “H” as a signal for notifying the outside of the preparation state. Hereinafter, only the write operation will be described.

  Next, when the write enable signal nWE is asserted to “L”, the write enable signal falling edge detector 401 in FIG. 3 detects the falling edge of the write enable signal nWE and outputs an “H” pulse signal. To do. The signal is input to the AND circuit 408 via the OR circuit 411, and ANDed with the inverted chip select signal nCSa is performed in the AND circuit 408 and input to the J terminal of the JK flip-flop 404. In response to this, the JK flip-flop 404 outputs an “H” signal.

  On the other hand, when the preparation for writing is completed, the device 2a asserts the ready signal nRDYa described above to “L” and outputs it. The time from when the chip select signal nCSa is asserted to “L” until the ready signal nRDYa is asserted is called an access response time, and the value varies depending on the device, but is usually an extremely short time of about several hundreds of seconds. Often. When the ready signal nRDYa is asserted to “L”, the ready signal falling edge detector 403 outputs an “H” pulse signal. The signal is ANDed with the inverted chip select signal nCSa by the AND circuit 409 and input to the K terminal of the JK flip-flop 404. Then, the output of the JK flip-flop 404 transitions from “H” to “L”. The output of the JK flip-flop 404 is input to the enable input terminal of the counter 405 and the inverted signal is input to the clear input terminal of the counter 405.

  When the control of the device 2a of the CPU 1 is started and the output terminal of the JK flip-flop 404 becomes “H”, the count operation of the counter 405 is started, and the ready signal from the device 2a (2b) becomes “L”. When the output of the flip-flop 404 becomes “L”, the count value of the counter 405 is cleared to “0”. The comparator 407 compares the output of the counter 405 with the detection time value of the detection time holding unit 406. If the output value of the counter 405 is smaller than the detection time value, “L” is set as the H / W-WDT (a) signal. If it is large, “H” is output. Since the detection time is set to a value larger than the access response time (for example, twice), the output of the comparator 407 when the device 2a is operating normally, that is, H / W-WDT (a) The signal is always “L”. The H / W-WDT (a) signal is an H / W-WDT (b) signal that is an output signal of the second watchdog timer 4b of another device 2b, and an S / W-WDT signal. After the NOR operation in the NOR circuit 5, and further after the AND operation with the power reset signal in the AND circuit 6, it becomes a reset signal for the CPU 1, the device 2a and the device 2b. When the device 2a is operating normally, the reset signal is “H” and the reset operation is not performed.

  On the other hand, the ready signal nRDYa of the device 2a is input as the ready signal nRDY to the CPU 1 through the NOR operation in the NOR circuit 7 with the ready signal nRDYb from the other device 2b. When the CPU 1 receives the ready signal nRDY, the write enable signal nWE is deasserted to “H”, and finally the chip select signal nCSa is deasserted to “H”, and the series of operations of the module # 1 is completed.

Next, the device control operation of the CPU 1 at the time of abnormality will be described.
FIG. 6 is a timing chart of the device control operation of the CPU 1 at the time of abnormality.
If the device 2a malfunctions due to external noise or the address value is rewritten due to noise, the device 2a cannot operate normally and cannot complete preparation for writing. At this time, the device 2a does not assert the ready signal nRDYa to “L” and continues to output “H”. Therefore, since the CPU 1 cannot receive the ready signal nRDYa “L”, the module # 1 seems to stop even though the CPU 1 is not running away. On the other hand, while the ready signal nRDYa is not asserted to “L”, the output of the JK flip-flop 404 remains “H”, and the counting operation of the counter 405 continues. When the output value of the counter 405 eventually exceeds the detection time value set in the detection time holding unit 406, the output of the comparator 407 becomes “H”. If the access response time of the device 2a is 100 nsec, the detection time value is set to 200 nsec, and the stop of the CPU 1 is detected in a very short time.

As described above, since the output of the comparator 407 becomes the reset signal for the CPU 1 and the device 2a as the H / W-WDT (a) signal, the stop detection time of the CPU 1 is detected in the WDT operation using only the first watchdog timer 3. However, since the second watchdog timers 4a and 4b are provided, when an abnormality occurs in the device, the CPU 1 is reset by performing the WDT operation with a detection time of about 200 nsec. The CPU 1 can be recovered in a very short time.
The device 2b is the same as the operation of the device 2a, and the description thereof is omitted.

  As described above, according to the microcomputer stop detection apparatus of the first embodiment, the dedicated clear command issued for each program module executed by the microcomputer for controlling the device connected to the microcomputer is used. When it is cleared and not cleared within the set time, the microcomputer stop detecting device having the first watchdog timer that outputs a reset signal for resetting the microcomputer is set to the time set by the first watchdog timer. A reset signal for resetting the microcomputer in a short time is output, and a second watchdog timer that is cleared based on the output signal of the device is provided, so that the microcomputer can be stopped early due to a device failure. To detect Door can be.

  In addition, according to the microcomputer stop detection apparatus of the first embodiment, the second watchdog timer starts the count operation with the device control start signal from the microcomputer and counts with the control ready signal from the device. A counter that stops operation and a comparator that compares a predetermined detection time value with the count value of the counter. If the count value is longer than the detection time value, both the microcomputer and the device are connected. Since a reset signal for resetting is output, it is possible to reliably detect stoppage of the microcomputer due to a device failure.

Embodiment 2. FIG.
FIG. 7 is a configuration diagram of the microcomputer stop detection device according to the second embodiment.
The second embodiment is different from the first embodiment in that the second watchdog timers 4a and 4b configured for each of the devices 2a and 2b in the first embodiment are used as one second watchdog timer 4c. It is to summarize. In other words, the second watchdog timer 4c has detection time values for each of the plurality of devices 2a and 2b, and these detection time values are obtained from the devices to be controlled by the CPU 1 among the plurality of devices 2a and 2b. A switching device is provided that switches according to the control start signal, and is configured to output a reset signal when the count value of the counter is longer than the detection time value output from the switching device.

FIG. 8 is a configuration diagram of the second watchdog timer 4c.
The second watchdog timer 4c includes a write enable signal falling edge detector 401, a read enable signal falling edge detector 402, ready signal falling edges detectors 403a and 403b, JK flip-flops 404a and 404b, a counter 405, Detection time holding units 406a and 406b, a comparator 407, AND circuits 408a and 408b, AND circuits 409a and 409b, NOT circuits 410a and 410b, OR circuits 411 and 413, and a switch 412 are provided. The write enable signal falling edge detector 401 and the read enable signal falling edge detector 402 receive the write enable signal nWE and the read enable signal nRD, respectively, and output them through the OR circuit 411, as in the first embodiment. The AND circuits 408a and 408b are configured to be input. The ready signal falling edge detection units 403a and 403b are configured to input the ready signal READYa of the device 2a and the ready signal READYb of the device 2b, respectively, and input the outputs to the AND circuits 409a and 409b.

  A chip select signal nCSa to the device 2a and a chip select signal nCSb to the device 2b are input to the AND circuits 408a and 408b via NOT circuits 410a and 410b, respectively. The outputs of the AND circuits 408a and 408b are input to the J terminals of the JK flip-flops 404a and 404b, respectively, and the outputs of the AND circuits 409a and 409b are input to the K terminals of the JK flip-flops 404a and 404b, respectively. ing. The outputs of the JK flip-flops 404a and 404b are input to the enable terminal and the clear terminal of the counter 405 via the OR circuit 413. The detection time holding units 406a and 406b hold detection time values corresponding to the program modules # 1 and # 2 for controlling the devices 2a and 2b, respectively. These detection time values are switched by the switch 412. It is configured to be controlled and fed to the comparator 407. The switch 412 selects the detection time holding units 406a and 406b based on the chip select signals nCSa and nCSb, and selects the detection time value of the detection time holding unit 406a when the chip select signal nCSa is active. When the chip select signal nCSb is active, the detection time value of the detection time holding unit 406b is selected.

Next, the operation of the second embodiment will be described. Here, the operation is the same as that of the first embodiment except for the operation of the second watchdog timer 4c, and therefore only the internal operation of the second watchdog timer 4c shown in FIG. 8 will be described.
FIG. 9 is a timing chart showing the operation of the second watchdog timer 4c.
Since the operation of the counter 405 is performed by connecting the output signals of the JK flip-flop 404a and the JK flip-flop 404b to the enable terminal and the clear terminal of the counter 405, description thereof is omitted here. To do. The difference from the first embodiment is that a detection time holding unit 406a for the device 2a, a detection time holding unit 406b for the device 2b, and a switch 412 for switching between them are added. While the chip select signal nCSa is active (“L”), the switch 412 has its output time as the detection time for the device 2a, and the chip select signal nCSb is active (“L”). In the meantime, the detection time for the device 2b is operated, and the output of the switch 412 is input to the comparator 407. For this reason, as shown in FIG. 9, the detection time changes dynamically depending on the type of the device being controlled.

  Therefore, even when a watchdog timer is configured when there are a plurality of devices, a plurality of counters 405 and comparators 407 are not required, and each can be configured by one. The comparator 407 compares the value of the counter 405 with the detection time value according to the control device, and outputs an “H” signal when the value of the counter 405 exceeds the detection time value from the switch 412. For this reason, in this embodiment, when an abnormality occurs in the device, the CPU 1 can be reset by operating the watchdog timer with a detection time of about several hundreds of nanoseconds, and a plurality of devices can be connected to the CPU 1. Even when is connected, since the watchdog timer can be operated with a single counter, the number of parts can be reduced.

  In this embodiment, the write enable edge signal is used as the start timing of the enable signal of the counter 405 in the second watchdog timer 4c. However, the edge signal of the chip select signal may be used. Similar effects can be obtained.

  In this embodiment, the detection time is described as one regardless of writing and reading of the device. However, the detection time may be provided separately for writing and reading. In that case, the switch 412 may be switched by inputting a write enable signal and a read enable signal, and the same effect can be obtained.

  Further, in the present embodiment, the ready signal is used as the end timing of the enable signal of the counter 405 in the second watchdog timer 4c. However, the polarity is different from a signal indicating device preparation other than the ready signal, for example, the ready signal. A weight signal may be used, and the same effect can be obtained.

  As described above, according to the microcomputer stop detection device of the second embodiment, the second watchdog timer circuit has detection time values for each of a plurality of devices, and these detection time values are Among the devices, there is a switcher that switches according to the control start signal of the device that the microcomputer is controlling, and when the count value of the counter is longer than the detection time value output from the switcher, a reset signal is output. In addition, it is possible to detect the stoppage of the microcomputer due to a device failure at an early stage and to reduce the number of parts.

It is a block diagram which shows the stop detection apparatus of the microcomputer by Embodiment 1 of this invention. It is a functional block diagram which shows the 1st watchdog timer of the stop detection apparatus of the microcomputer by Embodiment 1 of this invention. It is a block diagram which shows the 2nd watchdog timer of the stop detection apparatus of the microcomputer by Embodiment 1 of this invention. It is a flowchart which shows execution of each program module of the stop detection apparatus of the microcomputer by Embodiment 1 of this invention. It is a timing chart which shows the device control operation of CPU at the time of normal of the stop detection apparatus of the microcomputer by Embodiment 1 of this invention. It is a timing chart which shows the device control operation of CPU at the time of abnormality of the stop detection apparatus of the microcomputer by Embodiment 1 of this invention. It is a block diagram which shows the stop detection apparatus of the microcomputer by Embodiment 2 of this invention. It is a block diagram which shows the 2nd watchdog timer of the stop detection apparatus of the microcomputer by Embodiment 2 of this invention. It is a timing chart which shows operation | movement of the stop detection apparatus of the microcomputer by Embodiment 2 of this invention.

Explanation of symbols

  1 CPU (microcomputer), 2a, 2b device, 3 1st watchdog timer, 4a, 4b, 4c 2nd watchdog timer, 405 counter, 406, 406a, 406b detection time holding unit, 407 comparator, 412 Switcher.

Claims (3)

For resetting the microcomputer when it is cleared by a dedicated clear command issued for each program module executed by the microcomputer for controlling a device connected to the microcomputer and is not cleared within a set time. In a microcomputer stop detection device having a first watchdog timer for outputting a reset signal,
A second watchdog timer that outputs a reset signal for resetting the microcomputer in a time shorter than a set time of the first watchdog timer and is cleared based on the output signal of the device; Microcomputer stop detection device. The second watchdog timer is
A counter that starts a count operation with a device control start signal from the microcomputer, and stops a count operation with a control ready signal from the device;
A comparator for comparing a predetermined detection time value with the count value of the counter;
2. The microcomputer stop detection device according to claim 1, wherein the comparator outputs a reset signal for resetting both the microcomputer and the device when the count value is longer than the detection time value.   The second watchdog timer circuit has detection time values for each of a plurality of devices, and switches the detection time values according to a control start signal of a device controlled by the microcomputer among the plurality of devices. 3. The stop detection device for a microcomputer according to claim 2, further comprising a reset signal that is output when the count value of the counter is longer than the detection time value output from the switch.

Images