JPH0458339A - Control microprocessor system - Google Patents

Abstract

PURPOSE:To detect the malfunctions in a control microprocessor system by outputting an alarm signal after checking whether a microprocessor is executing a program or not in a prescribed processor area in a mode except an interruption processing state and whether the microprocessor is normally executing the interruption processing or not. CONSTITUTION:A microprocessor 10 produces a state signal 31 to show a fact that the processor 10 is executing a program in a prescribed program area in a mode except an interruption processing state. At the same time, an interruption executing state signal 42 is produced after detection of a fact that the processor 10 is executing the interruption processing. Then two one-shot flip- flops are set by both signals 31 and 42 and produce the operating pulse signals for a fixed time. An AND is secured among these operating pulse signals and outputted as an alarm signal 47. Thus it is possible to detect such abnormality where another processing has the abnormality even though the interruption processing is normally carried out.

Description

DETAILED DESCRIPTION OF THE INVENTION [Industrial Application Field] The invention is applied to a control microprocessor system.

The present invention is particularly applied to an alarm determination circuit for detecting an alarm state of a microprocessor system for controlling the system.

〔overview〕

In a control microprocessor that periodically processes interrupts, the present invention determines whether or not the microprocessor is executing a program in a preset processor area when not processing interrupts, and whether or not the microprocessor is processing interrupts normally. By checking the status of both microprocessors and outputting alarm signals, malfunctions can be detected regardless of the type of microprocessor.

[Conventional technology]

FIGS. 4(a), 4(a) and 4(c) are block diagrams showing an alarm determination circuit in a conventional control microprocessor system.

In FIG. 4(a), a retriggerable one-shot flip-flop (ISF/F) 52 is used, and care is taken to issue a trigger pulse again within a time shorter than the time constant during programming. In this circuit, when the program is operating normally, the one-shot flip-flop 52 remains "on", but if for some reason the interval between trigger pulses becomes longer or the trigger pulse is no longer output, One-shot flip-flop 52 is turned "off" and outputs alarm signal 54.

A circuit that makes this "off" state an alarm state is called a watchdog timer, and is one of the widely known alarm determination circuits. In addition, in FIG. 4(a), 5
0 is a microprocessor, 51 is an engineering/○ port, and 53 is a bus.

FIG. 4(b) is an example of an alarm determination circuit using a status signal of a microprocessor.

This status signal differs depending on the type of microprocessor used, but for example, as shown in FIG.
By decoding the microprocessor, it is possible to detect the stopped state of the microprocessor and output the alarm signal 57.

In addition, FIG. 4(C) shows a malfunction detection countermeasure that is often used in certain types of microprocessor systems.
This is a method in which the data bus 59 of the microprocessor 58 is pulled up by a pull-up resistor 60. In this case, when 'FFHJ (hexadecimal number) is read as the instruction code, the program address jumps to address r38H. Of course, this can also be used as a software interrupt, but if the microprocessor system malfunctions and the program goes out of control and accesses an address for which no memory is implemented, the microprocessor The instruction code rFFH is read in, and as a result, the program address jumps to address r38H. If a program that makes this condition an alarm is installed after this address "38H", it is possible to detect this condition as an alarm.

[Problem to be solved by the invention]

In general, many control microprocessor systems manually perform some kind of control operation on a regular basis by receiving some kind of interrupt signal from the outside. For example, it is common to input an interrupt signal every few milliseconds from the outside and connect this interrupt signal to the interrupt input of a microprocessor to periodically start some program. At this time, a circuit that attempts to detect an alarm by outputting a trigger pulse to the watchdog timer shown in FIG. 4(a) during the interrupt process activated by the interrupt signal is still commonly used. This is a common thing.

However, in some types of microprocessors, due to some kind of malfunction, only interrupt processing is performed normally, but only the program execution address does not operate normally in the actual program area, and for example, no device is activated. It is also possible that an unconnected area or RAM area is being operated. Of course, in this case, the program is not operating as intended, so its intended control will become abnormal, but if only interrupt processing is being performed normally, The watchdog timer circuit will not be able to detect this abnormal state.

In addition, in the case of a malfunction of the microprocessor as mentioned above,
Even in the alarm determination circuit shown in FIG. 4, which uses the status signal output pin of a microprocessor, the abnormality cannot be detected in many cases. This is because an alarm judgment circuit using this status signal can detect an alarm when the microprocessor indicates a halt (HALT) state. This is because as long as the microprocessor is executing some instruction, no halt state will occur even if the microprocessor is executing an instruction in an address space other than the microprocessor.

Furthermore, although the data bus pull-up method shown in FIG. 4(C) can be applied to some types of microprocessors, even if rFFHJ is read as an instruction code, the program address does not jump to a specific address. Not applicable to processors.

As explained above, the alarm determination circuit of the conventional microprocessor system has a drawback that it cannot fully achieve its purpose. Furthermore, it has the disadvantage that it cannot be applied to different types of microprocessors.

An object of the present invention is to eliminate the above-mentioned drawbacks, thereby making it possible to detect malfunctions of any microprocessor, regardless of the type of microprocessor. It is an object of the present invention to provide a control microprocessor system having an alarm judgment circuit capable of detecting an abnormality of an alarm that cannot be detected by a conventional alarm judgment circuit, such as a case where the above processing is required.

[Means to solve the problem]

The present invention provides a control microprocessor system comprising a microprocessor, interrupt means for applying an interrupt operation to the microprocessor, and alarm means for detecting an abnormal state of the microprocessor and outputting an alarm signal. The alarm means includes means for detecting that the microprocessor is executing an interrupt process and outputting an interrupt execution status signal, and a preset alarm means for detecting that the microprocessor is executing an interrupt process and outputting an interrupt execution status signal. means for detecting that a program area is being executed and outputting a program area execution status signal; and means for outputting an alarm signal when at least one of the program area execution status signal and the interrupt execution status signal is not normal. and means for outputting.

The present invention also provides a microprocessor, at least one interrupt flip-flop that is set by an interrupt signal, outputs an interrupt signal to the microprocessor, and is reset by a reset signal from the microprocessor; In a control microprocessor system comprising an alarm means for detecting an abnormal state of a processor and outputting an alarm signal, the alarm means includes an interrupt signal output from the interrupt flip-flop and an alarm signal output from the microprocessor. means for detecting a state in which the microprocessor is executing an interrupt process based on a reset signal and outputting an interrupt execution state signal; means for decoding something and outputting a program area execution status signal representing the state; and means for latching the program area execution status signal using a system clock of the microprocessor only when the microprocessor is not executing an interrupt process. means for outputting a first operation pulse signal for a certain period of time set by the program area execution state signal output from the latching means; and a second operation pulse signal for a certain period of time set by the interrupt execution state signal. and a logic circuit that performs a logical operation on the first and second operation pulse signals and outputs the alarm signal.

[Effect]

When the microprocessor is not performing interrupt processing, it generates a program area execution state signal indicating that the program area set in advance is being executed. On the other hand, it detects that the microprocessor is executing an interrupt process and generates an interrupt execution status signal. Then, two one-shot flip-flops each set by these two execution state signals and outputting an operation pulse signal for a certain period of time are provided, and the operation pulse signals from these one-shot flip-flops are logically multiplied and an alarm signal is generated. Output as .

That is, the two one-shot flip-flops should remain operational as long as the microprocessor is operating normally. However, if the microprocessor malfunctions for some reason and becomes unable to handle interrupts, or even though interrupt processing is performed normally, the program execution address appears to be executing at a different address from the actual program area. If a runaway condition occurs, an alarm condition can be detected in either case.

〔Example〕

Embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 is a block diagram showing one embodiment of the present invention.

This embodiment uses a microprocessor 10 and an interrupt signal 32.
and 33, respectively, output signals 34 and 35 which are interrupt signals 32 and 33 to the microprocessor 10, and are reset by reset pulses 36 and 37, respectively, from the microprocessor 10. In a control microprocessor system equipped with interrupt flip-flops (F/F) 12 and 13, and an alarm means for detecting an abnormal state of the microprocessor 10 and outputting an alarm signal 47, the present invention is characterized by: The alarm means detects the state in which the microprocessor 10 is executing interrupt processing by the output signals 34 and 35 output from the interrupt flip-flops 12 and 13 and the reset pulses 36 and 37 output from the microprocessor 10. The OR circuits 14 and 15, the one-shot flip-flop 7' (ISF/F) 16, and the NOR gate 17 as means for detecting and outputting the interrupt execution state signal 42 are connected to the address bus 30 of the microprocessor 10 and A program address decoder 11 serves as a means for decoding that a program is being executed in a set program area and outputs a program area execution status signal 31 representing the status, and only when the microprocessor 10 is not executing interrupt processing. , an AND gate 18 and a D-type flip-flop (
F/F) 19 and a means for outputting an output signal 45 as a first operation pulse signal for a certain period of time, which is set by an output signal 44 which is a program area execution state signal 31 output from this D-type flip-flop 19. as,
First one-shot flip-flop (ISF/F) 2
0, a second one-shot flip-flop (ISF/F) 21 as a means for outputting an output signal 46 as a second operating pulse signal for a certain period of time set by the interrupt execution state signal 42; Output signals 45 and 4 of the first and second one-shot flip-flops 20 and 21
6 and an AND circuit 22 as a logic circuit that performs an AND operation with 6 and outputs an alarm signal 47.

Next, the operation of this embodiment will be explained with reference to the time charts shown in FIGS. 2 and 3.

In FIG. 1, an address bus 30 output from a microprocessor 10 is connected to a program address decoder 1.
Connected to 1. This program address decoder 11
In this case, when the address bus selects the program area where the alarm has been set, the program area execution status signal 3
1 is made active (in this embodiment, the active "low" level) and output. Therefore, when the microprocessor 10 is operating normally, the program area execution state signal 31 should have a waveform like 31 (steady) in FIG. 2. This program area execution status signal 31 is input manually to the D-type flip-flop 19.

On the other hand, interrupt signals 32 and 33 are input to interrupt flip-flops 12 and 13, respectively. The interrupt flip-flops 12 and 13 are connected to interrupt signals 32 and 3.
3 becomes active (in this embodiment, it is set to "high level"), and is reset by the microprocessor 10 when interrupt processing is completed (
In this embodiment, the level is set to "low". ). The reset signals from the microprocessor 10 are referred to as interrupt reset signals 36 and 37.

Of course, the output signals 34 and 35 of these interrupt flip-flops 12 and 13 are input to the interrupt input of the microprocessor 10, and after being logically summed by the OR gate 14, the output signals 34 and 35 are output from the NOR gate 1 as an output signal 38.
7 will be powered by humans.

By the way, the output signals 34 and 35 of the interrupt flip-flops 12 and 13 can be considered as status signals indicating whether or not the microprocessor 10 is performing interrupt processing;
Even if the reset in step 3 is performed at the end of interrupt processing, the actual interrupt processing ends several microseconds after the reset (this time depends on the type of microprocessor,
Depends on clock speed etc. )Become. To solve this problem, the interrupt reset signals 36 and 37 are logically summed by the OR gate 15, and then the output signal 39 is manually input to the one-shot flip-flop 16 in order to buy a few microseconds of time. be done.

The output signal 38 of the OR gate 14 and the output signal 40 of the one-shot flip-flop 16 are input to the NOR gate 17 and are NOR'ed. The output signal of this NOR gate 17 is an interrupt execution state signal 42 (in this embodiment, it is at a "low" level while an interrupt is being executed). The waveform of this interrupt execution state signal 42 is as shown in 42 in FIG.

Further, a time chart for explaining the circuit logic for generating this interrupt execution state signal 42 is shown in FIG. As shown in FIG. 3, the output signal 34 or 35 of the interrupt flip-flop 12 or 13 is input to the interrupt input of the microprocessor 10, and after this output signal 34 or 35 becomes active, the interrupt processing is performed. is started. At this time, the microprocessor 10 outputs a reset pulse 36 or 37 to the interrupt flip-flop 12 or 13 immediately before the interrupt processing ends. The reset pulses 36 and 37 of this interrupt flip-flop are
The falling edge of the reset pulse 36 or 37 is input to the one-shot flip-flop 16, and the one-shot flip-flop 16 generates a fixed-time delay pulse 40. This day pulse 4
0 and the output signal 34 or 3 of the interrupt flip-flop
The NOR with 5 becomes the interrupt state signal 42. This interrupt state signal 42 is indicated by 42 in FIG.

On the other hand, the interrupt status signal 42 and the microprocessor 10
The system clock 41 is connected to the AND gate 18 and a logical product is taken. That is, this AND gate 1
The output signal 43 of 8 maintains a "low" level while an interrupt is being executed, but the system clock 41 is output when a program other than interrupt processing is being executed. The output signal 43 of this AND gate 18 is transmitted to the D-type flip-flop 19.
The clock is human-powered.

This D-type flip-flop 19 latches the state of the program area execution state signal 31 using the system clock 41 and outputs it. However, as mentioned above, since the clock is not manually input to this D-type flip-flop 19 during interrupt processing, the 8-power signal 44 of this D-type flip-flop 19 is used to control programs other than interrupt processing. Only during execution, the program area execution status signal 31 is latched and output. Therefore, if a runaway program occurs for some reason and the microprocessor 10 is executing an address space other than the preset processor area, the output signal 44 of the D-type flip-flop 19 will be at a "high" level. will be maintained. Conversely, if the microprocessor 10 is operating normally, a pulse like the waveform 31 (interrupt) in FIG. 2 is output. This D type flip-flop 19
The output signal 44 is input to the one-shot flip-flop 20 for program area alarm detection.

The output signal 45 of the one-shot flip-flop 20 for program area alarm detection is transmitted to the microprocessor 1.
As long as 0 is operating normally and the program area execution status signal 31 is being output normally, it is necessary to set it with a time constant that maintains the "high" level indicating the normal state. .

Similarly, the output signal 46 of the one-shot flip-flop 21 for interrupt alarm detection is in a normal state as long as the interrupt signal 32 or 33 is normally input manually and the microprocessor 10 is processing the interrupt. It is necessary to set the time constant to maintain the "high" level.

The output signals 45 and 46 of the two one-shot flip-flops 20 and 21 are logically ANDed by an AND gate 22, and an alarm signal 47 is output. As a result, if the output of one or both one-shot flip-flops 20 and/or 21 indicates an abnormal state,
If the signal changes to a "low" level, the output of the AND gate 22 will change to a "low" level. This "low" level state is the alarm signal 47 of the microprocessor 10.

In the above explanation, the input of the one-shot flip-flop 21 is the interrupt execution status signal 42, but if the interrupt processing ends at the same time as the interrupt flip-flops 12 and 13 are reset, the one-shot flip-flop 21 may use the output signal 38 of the OR gate 14 instead of the interrupt execution status signal 42.

〔Effect of the invention〕

According to the present invention, regardless of the type of microprocessor,
The microprocessor malfunctions for some reason,
If interrupt processing is no longer possible, or if the interrupt processing is being performed normally but the program is running out of control, where the program execution address is different from the actual program area. In either case, the alarm state of the control microprocessor system can be detected, which is highly effective.

[Brief explanation of drawings]

FIG. 1 is a block diagram showing an embodiment of the present invention. FIG. 2 is a time chart (1) showing the operation. FIG. 3 is a time chart (2) showing the operation. FIGS. 4(a), 4(a) and 4(c) are block configuration diagrams showing a conventional example. 10.50.55.58...Microprocessor, 1
1...Program address decoder, 12.13...
・Interrupt flip-flop (F/F), 14.15.5
6...OR gate, 16.20.21.52...One-shot flip-flop (l S F/F), 1
7... Noah Gate, 18.22... And Gate,
19...D type flip-flop (F/F), 30...
・Address bus, 31...Program area execution status signal, 32.33...Interrupt signal, 34.35.38.3
9.43-46...Output signal, 36.37...Reset pulse, 40...Delay pulse, 41...System clock, 42...Interrupt execution state signal, 47.
54.57... Alarm signal, 51... Engineering 10 port, 53... Bus, 59... Data bus, 60...
pull-up resistor.

Claims (1)

[Claims] 1. A control microprocessor comprising: a microprocessor; interrupt means for applying an interrupt operation to the microprocessor; and alarm means for detecting an abnormal state of the microprocessor and outputting an alarm signal. In the system, the alarm means includes means for detecting that the microprocessor is executing an interrupt process and outputting an interrupt execution status signal; means for detecting that a set program area is being executed and outputting a program area execution status signal; and means for outputting an alarm signal. 2. A microprocessor, at least one interrupt flip-flop that is set by an interrupt signal, outputs an interrupt signal to the microprocessor, and is reset by a reset signal from the microprocessor, and an abnormal state of the microprocessor; and alarm means for detecting and outputting an alarm signal, wherein the alarm means detects an interrupt signal output from the interrupt flip-flop and a reset signal output from the microprocessor. means for detecting a state in which the microprocessor is executing an interrupt process and outputting an interrupt execution state signal; and a means for decoding that a program is being executed in a preset program area connected to an address bus of the microprocessor. means for outputting a program area execution status signal representing the state thereof; means for latching the program area execution status signal using a system clock of the microprocessor only when the microprocessor is not executing an interrupt process; and this latch. means for outputting a first operation pulse signal for a certain period of time set by the program area execution state signal output from the means for outputting the program area, and a second operation pulse signal for a certain period of time set by the interrupt execution state signal; and a logic circuit that performs a logical operation on the first and second operation pulse signals and outputs the alarm signal.