JP3137025B2 - Runaway detection method for data processing system - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to a runaway detection method for a data processing system, and more particularly to a runaway detection method for a data processing system using a computer.

[0002]

2. Description of the Related Art As one of methods for detecting runaway in a data processing system using a computer, a method using a watchdog timer has been conventionally known (Japanese Patent Application Laid-Open No. Sho 62-175840). FIG. 7 is a block diagram showing an example of a runaway detection method of the conventional data processing system. FIG. 8 shows an example in which the processing program 750 processed by the means 701 in FIG. 7 is described in more detail.

Referring to FIG. 7, a runaway detection method includes a predetermined processing program 750 and a processing means 701 for processing the same.
A watchdog timer 711 that is reset while the processing program 750 is running by the processing unit 701;
It comprises a runaway detection signal 721 generated by an overflow of the watchdog timer 711.

The processing program 750 corresponds to a processing program indicated by reference numeral 751 in FIG.
1) After the first processing (step 802) is sequentially executed, the watchdog timer is reset (step 80).
3) After the second process is looped n times (step 80)
4) and reset the watchdog timer (step 8)
05), returning to step 802 again and executing the first process are repeated. Steps 803 and 805 are resets of the same watchdog timer, and are shown in different steps for the sake of convenience in the following description.

In FIG. 7, a watch dog timer 71
Assuming that T is the time until 1 overflows, Ta is the processing time of the first processing in step 802 in FIG. 8, and Tb is the processing time of the second processing in step 804 in FIG.
Step 80 so that <T and n × Tb <T
Watchdog timer reset positions 2 and 804 are set.

As described above, in the processing means 701 in which the watchdog timer reset is set, the overflow of the watchdog timer 711 does not occur during the normal operation, and the runaway detection signal 721 does not occur.

On the other hand, when a runaway occurs in the processing means 701, one of the first processing and the second processing is stopped halfway, or the number of times of the second processing exceeds n times and becomes abnormal. If the watchdog timer 711 is not reset beyond the time T when an unexpectedly long processing time such as a long processing time occurs, the watchdog timer 711 overflows and the runaway detection signal 721 is generated. With the above-described conventional configuration of FIG. 7, runaway detection can be performed.

By the way, in today's data processing systems, processing is multiplexed by using subroutines and interrupt processing, and processing items are grouped into one.
It is common to modularize programs that are separate from other processing programs. These are general methods used to improve the immediacy of processing by providing high-priority processing, and to promote program reusability and development efficiency. With ever-increasing numbers, it is not uncommon for even a small microcomputer to have a program size of tens of thousands of steps in total. For this reason, these methods are becoming indispensable in order to secure immediacy in a long program and to improve the efficiency of program development.

However, when such multiplexing and program modularization are performed, it is very difficult to determine how often and how often the reset of the watchdog timer is inserted into the program.
This is a major problem in modularizing programs.

FIG. 9 shows a different example of the details of the processing program 750 processed by the processing means 701 of the conventional method of FIG. 9, the same processes as those in FIG. 8 are denoted by the same reference numerals. Processing program 752 shown in FIG.
Corresponds to the processing program 750 in FIG. 7, and includes an initial process (step 801), a first process (step 802)
Are sequentially executed, the watchdog timer is reset (step 803), the second process is looped n times (step 804), and then the watchdog timer is reset (step 805). Execution of the process 1 is repeated.

The above is the same as the processing program 751 in FIG. 8, but the processing program 752 further processes the interrupt processing I1 during the processing of the first processing (step 806), and executes the processing of the second processing. Interrupt processing I during the period
2 is processed (step 807). The interrupt processes I1 and I2 are processes that require immediacy and are processes that occur periodically. The difference between the processing program 751 in FIG. 8 and the processing program 752 in FIG. 9 is that the processing program 752 in FIG. 9 considers multiplexing by these interrupt processes.

In FIG. 7, a watch dog timer 71
T is the time until 1 overflows, Ta is the processing time of the first processing in FIG. 9, Ti1 is the processing time of the interrupt processing I1, Tb is the processing time of the second processing, and Ti2 is the processing time of the interrupt processing I2. Then, Ta + Ti1 <
The reset position of the watchdog timer in step 803 and the reset position of the watchdog timer in step 805 are set so that T and n × (Tb + Ti2) <T.

In the example of FIG. 9, runaway is detected as in the example of FIG. However, when the interrupt processes I1 and I2 occur irregularly, the configuration of the processing program 752 as shown in FIG. 9 cannot be used. This is because, for example, a plurality of interrupt processing I
When 1 or I2 occurs, the reset interval of the watchdog timer becomes Ta + n1 × Ti1 + n2 × Ti2> T (n1 is the number of times interrupt processing I1 has occurred, n2 is the number of times interrupt processing I2 has occurred), and processing is performed normally. This is because the watchdog timer 711 may overflow during these interrupt processing periods.

The overflow time T of the watchdog timer and the reset position of the watchdog timer in steps 803 and 805 should be set in consideration of such a possibility.
In particular, microcomputers have many peripheral functions, interrupt factors often exceed 10, and the processing time varies widely from tens of microseconds to several milliseconds. It is extremely difficult to set the time T and the reset of the watchdog timer while eliminating the characteristics.

Even if the interrupt processes I1 and I2 are periodically generated, if the processing time of these processes is extended due to a program modification or the like, step 803 is executed.
And 805, the reset position of the watchdog timer is set to Ta + Ti1 <T and nx (Tb + Ti2) <
Since it is necessary to modify T to satisfy T, it has been difficult to modularize the program.

FIG. 10 shows a third example of the processing program 750 processed by the processing means 701 when the conventional configuration of FIG. 7 is used. 10, the same processes as those in FIG. 9 are denoted by the same reference numerals. The processing program 753 shown in FIG.
7 corresponds to the processing program 750 of FIG. 7 described above. After the initial processing (step 801) and the first processing (step 802) are sequentially executed, the watchdog timer is reset (step 803), and the second processing is performed n times. After the loop (step 804), the watchdog timer is reset (step 805), and the process returns to step 802 again to execute the first process.

The above is the same as the processing program 751 in FIG. 8, but the processing program 753 further executes the interrupt processing I1 after resetting the watchdog timer during the processing of the first processing (step 808). Then, after resetting the watchdog timer during the processing period of the second processing (step 809), the interrupt processing I2 is processed (step 81).
1). The interrupt processes I1 and I2 are processes that require immediacy and are processes that occur periodically.

In FIG. 7, a watch dog timer 71
10, T is the processing time of the first processing in FIG. 10, T1 is the processing time of the interrupt processing I1, Tb is the processing time of the second processing, and Ti2 is the processing time of the second processing in FIG. Then, Ta + Ti1
The reset position of the watchdog timer in step 803 and the reset position of the watchdog timer in step 805 are set so that <T and n × (Tb + Ti2) <T.

In the example of FIG. 10, runaway is detected as in the examples of FIGS. Further, in the example of FIG. 10, even at the head of the interrupt processing I1 and I2, step 808,
By resetting the watchdog timer at 810, it is possible to solve the problem that the watchdog timer 711 overflows when a plurality of interrupt processes, which have been a problem in the processing program 752 of FIG. 9, occur. .

However, the processing program 75 shown in FIG.
If the processing program 753 shown in FIG. 10 is set to 0, the watchdog timer 711 is reset every time during the interrupt processing I2 even if the runaway of the number of loops occurs in n loops of the second processing. Therefore, a new problem that such runaway cannot be detected occurs.

On the other hand, as a runaway detection method having a configuration different from that of the conventional method shown in FIG. 7 and focusing on multiplex processing, a method disclosed in Japanese Patent Application Laid-Open No. Sho 62-175840 is known.
FIG. 11 shows a conceptual diagram of an example of a conventional runaway detection method described in this publication. In FIG. 11, a processing program 901 having a multi-level structure includes a processing program A having the highest level,
It comprises a next-level processing program B, a lowest-level processing program C, and reset programs a, b, and c that are executed after the execution of each of these processing programs A, B, and C. Further, in this conventional method, the timer 9 which starts the highest level processing program A at a predetermined cycle is used.
02, watchdog timers 903a, 903b and 903c reset by reset programs a, b and c, OR gate 904 and fault occurrence detection circuit 90
5 is used.

The timer 902 always starts the highest level processing program A at a predetermined period T. When the processing program A ends, the reset program a resets the watchdog timer 903a, and then the execution of the next level processing program B is started. When the execution of the processing program B is completed, the execution of the processing program C of the lowest level is started after the reset program b resets the watchdog timer 903b. When the processing program C ends, the watchdog timer 903c is reset by the reset program c, and the processing device shifts to an idle state. Thereafter, the processing from the processing program A is repeated again by the signal of the cycle T from the timer 902.

If the end of the processing programs B and C cannot be completed in time for the restart of the processing program A from the timer 902 due to the load fluctuation, the processing of the programs B and C is interrupted at that time and the state is saved. After the processing of the level program is performed, when the level at the time of evacuation is reached again, the previous processing is restarted.

According to the conventional method described in this publication, the setting of the time until the watchdog timer 903a overflows is performed in accordance with the load fluctuation because the processing program A for resetting the watchdog timer 903a is always started in the cycle T. It is set to a value of, for example, about 1.5T in consideration of the variation in the execution time based on the execution time. Also,
The time until the watchdog timers 903b and 903c overflow is set to, for example, about 3T and 6T, respectively, in consideration of the variation of the reset intervals based on the levels of the processing programs B and C and the load fluctuation. I have.

Watchdog timers 903a to 903c
When an overflow occurs in any of the above, a fault occurrence detection circuit 905 is notified via an OR gate 904, a fault occurrence detection signal is output, and an alarm is generated and switching to a standby device is performed.

[0026]

However, FIG.
In the conventional runaway detection method described with reference to FIG. 10, it is very difficult to cope with program multiplexing. Also, in the conventional runaway detection method shown in FIG. 11, it is very difficult to properly estimate how much load variation will occur, as described above with reference to FIGS. 7 and 9.

In the conventional runaway detection method described with reference to FIGS. 7 to 10, it is difficult to modularize a program. Even in the conventional runaway detection method shown in FIG. 11, if the processing time of the upper-level processing program is extended due to a program modification or the like, the reset position of the watchdog timer of the lower-level processing program is shifted, so that the lower-level processing is performed. It is necessary to correct the program at the same time or to correct the overflow time of the watchdog timer corresponding to the lower-level processing program, and it is difficult to modularize the program.

The reason for the problem of these conventional methods is that, although the programs to be processed are all multiplexed in a time division manner, the operation of the watchdog timer corresponding to each processing program is multiplexed in the time division manner. This is because the operation is not synchronized with the program to be processed.

The present invention has been made in view of the above points,
An object of the present invention is to provide a method for detecting runaway of a data processing system, which is suitable for multiplexing programs and, as a result, facilitates development of programs having multiplex processing.

Another object of the present invention is to provide a method for detecting runaway of a data processing system, which is suitable for modularizing a program, thereby contributing to resource utilization of the program and improving reusability. It is in.

[0031]

According to the present invention, there is provided a runaway detecting method for detecting runaway of a data processing system which executes a plurality of processing programs in a priority order according to a level. , A plurality of watchdog timers respectively corresponding to a plurality of processing programs are arranged, and these plurality of watchdog timers can be reset only in the corresponding processing program, and supply of a clock to the plurality of watchdog timers Is performed only for the watchdog timer corresponding to the processing program being processed at that time, and detects the occurrence of runaway of the data processing system based on the overflow of the plurality of watchdog timers.

In the runaway detection method of the present invention, the operation of each watchdog timer is time-divisional and exclusive according to the processing program being processed at that time. In other words, while the programs to be processed are multiplexed in a time-division manner, the watchdog timers corresponding to each processing program are also multiplexed in a time-division manner, so that the operation of the watchdog timer at different levels is considered. You don't have to. Therefore, since there is no time relationship between the processing time of the interrupt processing and the watchdog timer corresponding to the processing program being processed before the interrupt, the problem of the conventional runaway detection method " Occurrence of overflow of watchdog timer due to interrupt processing that occurs ”can be solved.

Further, the present invention solves the conventional problem that when the size of the interrupt processing program is changed, the watchdog timer reset position must be changed in another program.

Further, according to the present invention, when the first interrupt processing is performed based on a first interrupt request that occurs periodically or irregularly during the processing period of each processing program of the plurality of processing programs, Supplies a clock only to a first interrupt processing watchdog timer different from the watchdog timers of a plurality of processing programs , and supplies a clock to a watchdog timer of the processing programs.
The supply of the clock is stopped, a reset signal is supplied to the watchdog timer for the first interrupt processing at the end of the interrupt processing, and the processing of the processing program that was being processed immediately before the first interrupt request is restarted. In addition, the clock is switched and supplied only to the watchdog timer corresponding to the restarted processing program, and the runaway of the data processing system is detected based on the overflow of the watchdog timer for the first interrupt processing. is there.

According to the present invention, the runaway of the data processing system can be detected not only for a plurality of processing programs but also for the first interrupt request based on the overflow of the watchdog timer for the first interrupt processing. When setting the reset of the watchdog timer, it is not necessary to consider the influence of multiplexing due to interrupt processing or the like.

Further, according to the present invention, during the processing of the first interrupt processing, the second interrupt processing is performed based on a second interrupt request that occurs more regularly or irregularly and requires more immediacy. The clock is supplied only to the second interrupt processing watchdog timer,
And the first interrupt processing watchdog timer
The supply of the clock is stopped, a reset signal is supplied to the watchdog timer for the second interrupt processing at the end of the interrupt processing, and the processing of the first interrupt processing performed immediately before the second interrupt request is performed. Resume,
In addition, the clock is switched and supplied only to the watchdog timer corresponding to the restarted first interrupt processing, and the runaway of the data processing system is detected based on the overflow of the watchdog timer for the second interrupt processing. And

According to the present invention, the runaway of the data processing system can be detected for the second interrupt request having a higher priority than the first interrupt request based on the overflow of the watchdog timer for the second interrupt processing.
When setting the reset of the watchdog timer in each processing program, it is not necessary to consider the influence of multiplexing due to interrupt processing or the like.

The reset positions of the plurality of watchdog timers are set to values longer than the total processing time of the corresponding processing program.

[0039]

Next, embodiments of the present invention will be described with reference to the drawings. FIG. 1 shows a configuration diagram of a first embodiment of a runaway detection method according to the present invention. In the first embodiment, a processing program 201 and a processing program 20
2 when the processing program 202 is started from the processing program 201 and when the processing program 2
02 ends and returns to the processing program 201, a signal INT indicating the state of the program being processed at that time,
Processing means 101 for generating RETI, processing means 101
And a reset / clock switching circuit 111 for generating a reset signal and a clock based on the INT signal and the RETI signal output from the CPU, a first watchdog timer 121 and a second watchdog timer 122, and an OR gate 131 Have been.

The reset / clock switching circuit 111 causes the processing means 101 to execute the processing program 201 based on the INT signal and the RETI signal output from the processing means 101.
When the processing unit 101 is processing the processing program 202, the reset signal and the clock are supplied only to the watchdog timer 122. The OR gate 131 is a watchdog timer 121
And the overflow signal output from the watchdog timer 122 is ORed to generate a runaway detection signal.

FIG. 2 is a diagram showing the processing programs 201 and 202 processed by the processing means 101 in FIG. 1 in more detail. In FIG. 2, a first level processing program 2
01 is after sequentially executing an initial process, a first process, a first watchdog timer reset, n second processes, and a second watchdog timer reset (step 21).
1 to 215), returning to the first processing, and thereafter, to step 211
To 215 are repeated. The second level processing program 202 resets the interrupt processing I1 and the watchdog timer during the processing of the first processing (step 22).
1, 222), and interrupt processing I2 and the watchdog timer are reset during the processing of the second processing (steps 223, 224). The interrupt processes I1 and I2 are processes that require immediacy, and are processes that occur regularly or irregularly.

In FIG. 1, the watchdog timer 12
Assuming that the time until 1 overflows is T121, the processing time of the first processing in FIG. 2 is Ta, and the processing time of the second processing is Tb, Ta <T121 and n × Tb
The reset position of the watchdog timer in steps 213 and 215 in FIG. 2 is set so as to be <T121.

In FIG. 1, the time until the watchdog timer 122 overflows is represented by T122.
The processing time of the interrupt processing I1 is Ti1, the interrupt processing I
2 is Ti2 <T122 and Ti2 <T122, assuming that the processing time of Step 2 is Ti2, Step 2 in FIG.
The reset position of the watchdog timer in each of the interrupt processing of step 22 and step 224 is set.

Next, the operation of the first embodiment of the present invention will be described with reference to FIGS. The processing unit 101 in FIG. 1 first executes an initial process of the processing program 201 of the first level in FIG. 2 (step 211).
In this initial processing, the watchdog timers 121 and 122 enter an operating state and are reset. Thereafter, the first process is started (Step 212). At this time, while the processing unit 101 is executing the first processing, the clock is supplied only to the watchdog timer 121 and the clock is not supplied to the watchdog timer 122.

Next, when an interrupt request occurs, the processing means 101 interrupts the execution of the first processing, and the interrupt processing I
1 (step 221), and generates an INT signal to the reset / clock switching circuit 111. The reset / clock switching circuit 111 stops supplying the clock to the watchdog timer 121 by the INT signal, and starts supplying the clock to the watchdog timer 122 instead. When the interrupt processing I1 ends, the watchdog timer 122 is reset (step 222), but a reset signal for this reset is supplied only to the watchdog timer 122 by the reset / clock switching circuit 111.

Thereafter, the processing means 101 restarts the first processing and generates a RETI signal to the reset / clock switching circuit 111. The clock supply to the watchdog timer 121 is restarted by the reset / clock switching circuit 111, and the clock supply to the watchdog timer 122 is stopped. When the first processing is completed, the watchdog timer is reset (step 213).
Accordingly, the reset signal for this reset is supplied only to the watchdog timer 121.

Subsequently, n loop processes of the second process are started (step 214). At this time, the processing means 10
While 1 is executing the second processing of the n loop processing, the clock is supplied only to the watchdog timer 121 and the clock is not supplied to the watchdog timer 122.

Next, when an interrupt request occurs, the processing means 101 interrupts the execution of the second processing, and the interrupt processing I
2 is started (step 223), and an INT signal is generated for the reset / clock switching circuit 111. The reset / clock switching circuit 111 stops supplying the clock to the watchdog timer 121 by the INT signal, and starts supplying the clock to the watchdog timer 122 instead. When the interrupt processing I2 ends, the watchdog timer 122 is reset (step 224). A reset signal for this reset is supplied only to the watchdog timer 122 by the reset / clock switching circuit 111.

Thereafter, the processing means 101 restarts the second processing and generates a RETI signal to the reset / clock switching circuit 111. The clock supply to the watchdog timer 121 is restarted by the reset / clock switching circuit 111, and the clock supply to the watchdog timer 122 is stopped. When the processing of the second processing is completed, the watchdog timer is reset (step 215).
Accordingly, the reset signal for this reset is supplied only to the watchdog timer 121.

As described above, while the processing means 101 is executing the first processing, the watchdog timer 12
1 only operates, the watchdog timer is reset only for the watchdog timer 121, and only the watchdog timer 122 operates while the processing unit 101 is executing the interrupt processing I1, and the watchdog timer is reset. It is understood that only watchdog timer 122 is of interest.

The processing time Ta of the first processing and the overflow time T121 of the watchdog timer 121, and the processing time Ti1 of the interrupt processing I1 and the overflow time T122 of the watchdog timer 122 are Ta <T121 and Ti1 <T122, respectively. Thus, during normal operation, the watchdog timers 121 and 122 are always reset before an overflow occurs, and no runaway detection signal is generated.

On the other hand, if a runaway occurs during the execution of the first process and the execution time of the first process becomes abnormally long,
Since the watchdog timer 121 is not reset, the watchdog timer 121 overflows, and the runaway detection signal is output from the watchdog timer 121 through the OR gate 131. Further, if a runaway occurs during the execution period of the interrupt processing I1 and the processing time of the interrupt processing I1 becomes abnormally long, the watchdog timer 122 is not reset, so that the overflow of the watchdog timer 122 occurs. Then, a runaway detection signal is output from the watchdog timer 122 through the OR gate 131.

The same applies to the second processing.
During normal operation, watchdog timers 121 and 12
Since 2 is always reset before the overflow occurs, no runaway detection signal is generated. On the other hand, if the processing time of the interrupt processing I2 becomes abnormally long, the reset of the watchdog timer 122 is not performed, so that an overflow of the watchdog timer 122 occurs, and the runaway detection signal is output from the watchdog timer 122 to the OR gate 131. Is output through

As described above, it is understood that runaway detection is possible in the multiplexed processing according to the first embodiment of FIG.

By the way, in the first embodiment shown in FIG. 1, it is necessary to modify the first processing, and when the processing time of the first processing is increased, the modification of the program is performed by the first processing.
By modifying the first processing so that the processing time Ta of the processing and the overflow time T121 of the watchdog timer 121 satisfy the relationship of Ta <T121, it is not necessary to modify other processing at all. This means
The same applies to the second process, the interrupt process I1 and the interrupt process I2, and these four processes can be modified independently of the other processes.

FIG. 3 is a circuit diagram showing an example of the reset / clock switching circuit 111 in FIG. 2-input OR gate 31
4 and 315, input terminals 311 and 31
2, an INT signal and a RETI signal are input, and the other input terminal is connected to the other output terminal to constitute a flip-flop. As a result, when an interrupt process occurs, the INT signal is output from the processing means 101 in FIG. 1 and is input to one input terminal of the NOR gate 314 via the terminal 311, and a “1” signal is output from the NOR gate 315. . When the RETI signal is input to the NOR gate 315 via the terminal 312, a signal of “0” is output from the NOR gate 315.

Next, the operation of this circuit will be described.
The clock generation circuit 321 starts generating a clock from the time when the operation of the watchdog timer is permitted during the initial processing. This clock is supplied to AND gates 317 and 3
20 respectively. Also, at the time of starting the system and starting from the interrupt processing, the processing unit 101 of FIG.
Is input to the NOR gate 315 via the terminal 312, and "0" is output from the NOR gate 315.
Is input to one input terminal of each of the AND gates 319 and 320, and these are set to the gate “closed” state.

At the same time, a signal of "1" is input to one input terminal of each of the AND gates 317 and 318 via the inverter 316, and these are set to the gate "open" state. On the other hand, a watchdog timer reset signal is input to the input terminal 313 from the processing means 101 and supplied to the AND gates 317 and 319, respectively.

Thus, during the execution of the first processing and the second processing, the clock from the clock generation circuit 321 is supplied to the watchdog timer 1 through the AND gate 318.
The reset signal is supplied to the AND gate 31 only.
7, and is supplied only to the watchdog timer 121.

On the other hand, when the interrupt processing occurs, the INT signal generated from the processing means 101 in FIG.
11 to the NOR gate 314, the NOR gate 315 outputs a signal of "1", and the AND gate 31
9 and 320 are input to one of the input terminals, and these are set to the gate "open" state. At the same time, a signal of "0" is input to one input terminal of each of the AND gates 317 and 318 via the inverter 316, and these are set to the gate "closed" state. Thus, during the execution period of the interrupt processing, the clock from the clock generation circuit 321 is supplied to the watchdog timer 12 through the AND gate 320.
2 and the reset signal is supplied to the AND gate 319
Is supplied only to the watchdog timer 122 through

Next, a second embodiment of the present invention will be described. FIG. 4 shows a configuration diagram of a second embodiment of the runaway detection method according to the present invention. The second embodiment includes a processing unit 401 that processes a processing program 501, a processing program 502, and a processing program 503, and generates signals P1 and P2 indicating the priority of the program being processed at that time. A reset / clock switching circuit 41 for generating a reset signal and a clock based on the priority signals P1 and P2 output from the means 401;
1, a first watchdog timer 421, a second watchdog timer 422, a third watchdog timer 423, and an OR gate 431.

The reset / clock switching circuit 411 allows the processing means 401 to execute the processing program 50 based on the signals P1 and P2 indicating the priority output from the processing means 401.
1 is supplied with the reset signal and the clock only to the watchdog timer 421, and when the processing means 401 is processing the processing program 502, the reset signal and the clock are supplied only to the watchdog timer 422. When the processing means 401 is processing the processing program 503, it supplies a reset signal and a clock only to the watchdog timer 423. The OR gate 431 calculates the logical sum of the overflow signals output from the watchdog timers 421, 422, and 423, and generates a runaway detection signal.

FIG. 5 is a diagram showing the processing programs 501, 502 and 503 processed by the processing means 401 in FIG. 4 in more detail. In FIG. 5, a first level processing program 501 sequentially executes an initial process, a first process, a first watchdog timer reset, n second processes, and a second watchdog timer reset. Thereafter (steps 511 to 515), the process returns to the first process, and thereafter, the processes of steps 511 to 515 are repeated.

The second level processing program 502 is:
During the processing of the first processing, the interrupt processing I1 and the watchdog timer are reset (steps 521 and 52).
2). Also, the third level processing program 503 is:
During the processing period of the interrupt process I1, the interrupt process I2 and the watchdog timer are reset (steps 531 and 531).
32), interrupt processing I3 and watchdog timer reset during the processing period of the second processing (step 533,
534). The interrupt process I1 is a process that requires immediacy, and is a process that occurs periodically or irregularly. The interrupt processes I2 and I3 are processes that require more immediacy than the interrupt process I1, and are processes that occur periodically or irregularly.

In FIG. 4, watchdog timer 42
Assuming that T421 is the time until 1 overflows, Ta is the processing time of the first processing in FIG. 5, and Tb is the processing time of the second processing in FIG. 5, Ta <T421 and n × Tb
The reset position of the watchdog timer in steps 513 and 515 in FIG. 5 is set so that <T421 is satisfied.

In FIG. 4, the time until the watchdog timers 422 and 423 overflow is represented by T.
422, T423, the processing time of the interrupt processing I1 is Ti
1. Assuming that the processing time of the interrupt processing I2 is Ti2 and the processing time of the interrupt processing I3 is Ti3, Ti1 <T422, Ti2 <T423, Ti3 <T42
3 so that step 522 and step 532 in FIG.
Then, the reset position of the watchdog timer for each interrupt processing in step 534 is set.

The difference between the first embodiment of FIG. 1 and the second embodiment of FIG. 4 is that, in the first embodiment of FIG. 1, the switching of the reset clock to each watchdog timer is performed. An INT signal generated when the processing means 101 shifts the processing from the first level processing program 201 to the second level processing program 202, and the processing of the second level processing program 202 to the first level processing. In contrast to the RETI signal generated when returning to the program 201, in the embodiment of FIG. 4, the level of the processing program that the processing means 401 is processing is directly generated as the P1 and P2 signals. , P
1, in that switching is performed based on the P2 signal. Further, in the embodiment of FIG. 1, the processing is double-multiplexed, whereas in the embodiment of FIG. 4, the processing is triple-multiplexed.

Next, the operation of the second embodiment of the present invention will be described with reference to FIGS. The processing unit 401 in FIG. 4 first executes an initial process of the first level processing program 501 in FIG. 5 (step 511).
In this initial processing, the watchdog timers 421 to 4
23 is reset upon entering the operating state. afterwards,
The first process is started (Step 512). At this time,
While the processing unit 401 is executing the first process, the clock is supplied only to the watchdog timer 421,
No clock is supplied to the watchdog timers 422 and 423.

Next, when an interrupt request occurs, the processing means 401 interrupts the execution of the first processing, and the interrupt processing I
1 (step 521), and generates signals P1 and P2 to the reset / clock switching circuit 411. The reset / clock switching circuit 411 stops the supply of the clock to the watchdog timer 421 by the signals P1 and P2, and
Start supplying the clock to.

Further, when an interrupt request having a higher priority occurs during the processing of the interrupt processing I1, the processing means 401 interrupts the processing of the interrupt processing I1 and starts the processing of the interrupt processing I2 (step 531). . At this time, the reset / clock switching circuit 411 stops supplying the clock to the watchdog timer 422 by the signals P1 and P2, and starts supplying the clock to the watchdog timer 423 instead.

When the interrupt processing I2 ends, the watchdog timer 423 is reset (step 532). A reset signal for this reset is supplied only to the watchdog timer 423 by the reset / clock switching circuit 411.

Thereafter, the processing means 401 executes the interrupt processing I
1, the clock supply to the watchdog timer 422 is restarted by the reset / clock switching circuit 411 and the watchdog timer 4
The clock supply to 23 is stopped. Thereafter, when the interrupt processing I1 is completed, the watchdog timer is reset (step 522).
This reset is performed only by the watchdog timer 422 by the clock switching circuit 411.

Thereafter, the processing means 401 restarts the execution of the first processing. At this time, the clock supply to the watchdog timer 421 is restarted by the reset / clock switching circuit 411 and the watchdog timer 422 is restarted.
The supply of the clock to is stopped. When the execution of the first process ends, the watchdog timer is reset (step 513). This reset is performed by the reset / clock switching circuit 411 by the watchdog timer 42.
This is done for only one.

Subsequently, the loop processing of the second processing is started n times (step 514). At this time, the processing means 40
While 1 is executing the second processing of the loop processing n times, the clock is supplied only to the watchdog timer 421, and the clock is not supplied to the watchdog timers 422 and 423.

Next, when an interrupt request occurs, the processing means 401 interrupts the execution of the second processing, and the interrupt processing I
3 (step 533), and outputs signals P1 and P2 to the reset / clock switching circuit 411. As a result, the reset / clock switching circuit 111 stops supplying the clock to the watchdog timer 421 and starts supplying the clock to the watchdog timer 423 instead. When the interrupt processing I3 ends, the watchdog timer 423 is reset (step 534). A reset signal for this reset is supplied only to the watchdog timer 423 by the reset / clock switching circuit 411.

Thereafter, the processing means 401 restarts the second processing and generates signals P1 and P2 to the reset / clock switching circuit 411. The reset / clock switching circuit 411 resumes the clock supply to the watchdog timer 421 and stops the clock supply to the watchdog timer 423. When the second processing is completed, the watchdog timer is reset (step 515). The reset / clock switching circuit 411 supplies a reset signal for this reset only to the watchdog timer 421.

As described above, while the processing means 401 is executing the first processing, the watchdog timer 42
1 only operates, the watchdog timer is reset only for the watchdog timer 421, and only the watchdog timer 422 operates while the processing unit 401 is executing the interrupt processing I1, and the watchdog timer is reset. It is understood that only watchdog timer 422 is of interest. Further, it is understood that only the watchdog timer 423 operates while the processing unit 401 is executing the interrupt processing I2 or I3, and the reset of the watchdog timer is performed only by the watchdog timer 423.

Here, the processing time Ta of the first processing and the overflow time T421 of the watchdog timer 421
And the processing time Ti1 of the interrupt processing I1, I2, I3,
Ti2, Ti3 and watchdog timers 422, 423
As described above, the overflow times T422 and T423 of Ta <T421, Ti1 <T422, and Ti2 <T42
3, since Ti3 <T423, the watchdog timers 421, 4
22 and 423 are always reset before an overflow occurs, and no runaway detection signal is generated.

On the other hand, if a runaway occurs during the execution of the first process and the execution time of the first process becomes abnormally long,
Since the reset of the watchdog timer 421 is not performed, an overflow of the watchdog timer 421 occurs, and a runaway detection signal is generated. If a runaway occurs during the processing of the interrupt processing I1 and the execution time of the interrupt processing I1 becomes abnormally long, the watchdog timer 4
Since reset to 22 is not performed, overflow of the watchdog timer 422 occurs, and a runaway detection signal is generated.

Further, if a runaway occurs during the execution of each of the interrupt processes I2 and I3 and the execution time of the interrupt processes I2 and I3 becomes abnormally long, the watchdog timer 423
Is not performed, an overflow of the watchdog timer 423 occurs, and a runaway detection signal is generated.

As described above, it can be understood that runaway detection is also possible in the multiplexed processing according to the second embodiment shown in FIG. It is also understood that the runaway can be detected even in the loop including the multiplex processing even in the second embodiment shown in FIG.

In the second embodiment shown in FIG. 4, when the first processing needs to be modified, and when the processing time of the first processing is increased, the modification of the program is performed by the processing time of the first processing. By modifying the first processing so that Ta and the overflow time T421 of the watchdog timer 421 satisfy Ta <T421,
No other processing needs to be modified.

This means that the second processing, the interrupt processing I
The same applies to 1 to I3. These processes can be modified completely independently of other processes.

FIG. 6 is a circuit diagram showing an example of the reset / clock switching circuit 411 in FIG. 6, the clock generation circuit 624 starts the operation from the point in time when the operation of the watchdog timer is permitted during the initial processing of step 511 in FIG. 5, generates a clock, and outputs the two-input AND gates 619, 621, and 623. Input to one of the input terminals. When an interrupt process occurs, the processing means 401 generates the P1 and P2 signals of FIG. 5 during the process of the interrupt process according to the priority of the interrupt process.

During the processing period of the first processing of Step 512 and the second processing of Step 514 in FIG. 5, P1 = 0,
Since P2 = 0, the signal P1 from the input terminal 611 in FIG. 6 is input via the inverter 616, and the signal P2 from the input terminal 612 is input via the inverter 617. The output signal of the AND gate 614 Becomes "1", and the output signal of the AND gate 615 to which the signal P1 is directly inputted becomes "0". Therefore, the AND gates 618 and 619 to which the output signal of the AND gate 614 is inputted are in the gate "open" state, respectively. Becomes

On the other hand, the AND gates 620 and 621 to which the output signal of the AND gate 615 is input and the AND gates 622 and 623 to which the signal P2 is input are both in the gate "closed" state. Therefore, during the processing period of the first processing and the second processing, the reset signal from the input terminal 613 is output from the input terminal 613 through the AND gate 618.
21, and the clock from the clock generation circuit 624 is output only to the watchdog timer 421 through the AND gate 619.

During the processing of the interrupt processing I1,
Since P1 = 1 and P2 = 0, the output signal of the AND gate 615 is “1” and the output signal of the AND gate 614 is “1”.
0 "and the input terminal 61 through the AND gate 620.
3 is output only to the watchdog timer 422, and the clock from the clock generation circuit 624 is supplied to the watchdog timer 4 via the AND gate 621.
22 only.

Further, since P2 = 1 during the processing period of the interrupt processing I2, I3, the AND gates 614 and 6
15 is “0”, and the AND gates 622 and 623 are in the “open” state, respectively.
3 is output only to the watchdog timer 423, and the clock from the clock generation circuit 624 is supplied to the watchdog timer 4 via the AND gate 623.
23 only.

[0089]

As described above, according to the present invention,
Since the programs to be processed are multiplexed in a time division manner, the watchdog timers corresponding to each processing program are also multiplexed in a time division manner. Therefore, it is possible to easily multiplex programs, and as a result, it is possible to easily develop a program having multiplex processing.

According to the present invention, when the reset of the watchdog timer is set in each processing program,
Since it is not necessary to consider the effects of multiplexing due to interrupt processing or the like, the program can be easily modularized. As a result, the resources of the program can be achieved and the reusability can be improved.

[Brief description of the drawings]

FIG. 1 is a configuration diagram of a first embodiment of the present invention.

FIG. 2 is a diagram showing in more detail a processing program processed by a processing means in FIG. 1;

FIG. 3 is a circuit diagram of an example of a reset / clock switching circuit in FIG. 1;

FIG. 4 is a configuration diagram of a second embodiment of the present invention.

FIG. 5 is a diagram showing in more detail a processing program processed by the processing means in FIG. 4;

FIG. 6 is a circuit diagram of an example of a reset / clock switching circuit in FIG. 4;

FIG. 7 is a diagram showing an example of a conventional runaway detection method.

FIG. 8 is a flowchart of a first example of the processing program of FIG. 7;

FIG. 9 is a flowchart of a second example of the processing program of FIG. 7;

FIG. 10 is a flowchart of a third example of the processing program of FIG. 7;

FIG. 11 is a diagram showing another example of a conventional runaway detection method.

[Explanation of symbols]

101, 401 Processing means 111, 411 Reset / clock switching circuit 121, 122, 421, 422, 423 Watchdog timer 131, 431 OR gate 201, 202, 501-503 Processing program

Claims (2)

(57) [Claims] 1. A runaway detection method for detecting the occurrence of a runaway of a data processing system that executes a plurality of processing programs in a priority order according to a level, wherein the plurality of processing programs individually correspond to the plurality of processing programs. A watchdog timer is arranged, and during a processing period of each processing program of the plurality of processing programs, when a first interrupt processing is performed based on a first interrupt request that occurs periodically or irregularly, Supplying a clock only to a watchdog timer for a first interrupt process different from the watchdog timers of the plurality of processing programs, and stopping supplying a clock to a watchdog timer of the processing program; At the end of the interrupt processing, a reset signal is sent to the watchdog timer for the first interrupt processing. And restarts the processing of the processing program that was being processed immediately before the first interrupt request, and switches and supplies the clock only to the watchdog timer corresponding to the restarted processing program. A runaway detection method for a data processing system, comprising detecting a runaway of the data processing system based on an overflow of a watchdog timer of a program or an overflow of a watchdog timer for the first interrupt processing. 2. When the second interrupt processing is performed based on a second interrupt request that needs to be immediate and that occurs periodically or irregularly during the processing of the first interrupt processing. Supplies a clock only to a second watchdog timer for interrupt processing, and stops supplying a clock to the watchdog timer for first interrupt processing. A reset signal is supplied to the watchdog timer for interrupt processing of the second interrupt processing, the processing of the first interrupt processing which has been processed immediately before the second interrupt request is restarted, and the restarted first interrupt processing is performed. The clock is switched and supplied only to the watchdog timer corresponding to the interrupt processing of
2. The runaway detection method for a data processing system according to claim 1, wherein the runaway of the data processing system is detected based on an overflow of the watchdog timer for the second interrupt processing.