Self-check system and method thereof

A self-check system and a method thereof are disclosed. In the self-check system, a memory stores a safety check program, a main application program and a predetermined checksum data. The safety check program include a circuit check program, a watchdog circuit reset program and a checksum check program. When a chip system is powered on, a processing unit executes the main application program, and then executes an interrupt call to generate an interrupt, so as to execute the safety check program and the circuit check program to check a to-be-checked circuit. The processing unit also executes the watchdog circuit reset program to reset a counting value of a watchdog circuit. The processing unit also executes the checksum check program to calculate a checksum data of the first safety check program, and reset the chip system when the calculated checksum data is not equal to the predetermined checksum data.

CROSS-REFERENCE TO RELATED APPLICATION

This application claims the benefit of Taiwan Patent Application No. 107135449, filed on Oct. 8, 2018, in the Taiwan Intellectual Property Office, the disclosure of which is incorporated herein in its entirety by reference.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to a check system, more particularly to a system capable of ensuring self-check operation of a micro control chip, and a method thereof.

2. Description of the Related Art

When a micro control chip used to control power has false action or malfunction, it easily occurs excessive current to cause danger, such as, burn, fire or explosion. For this reason, in the industry, there is a related organization for regulating a safety check standard, such as IEC60730, and the micro control chip manufacturers are required to provide related documents for demonstrating that their micro control chips meet the safety check standard before delivery. For example, the manufacturer must provide documents related to the program contents inside the micro-controller unit and description of execution process of safe check program, so as to ensure that important systemic circuits of the micro control chip can be periodically checked for safety during operation, and the micro control chip can stop operating in time when the systemic circuit has false action or malfunction, thereby preventing occurrence of danger.

As a result, every time the software or hardware of the micro control chip is updated, the manufacturer must again provide documents related to details of the programs inside the micro-controller unit and description of execution process, and it causes large burdens of the chip manufacturers. Therefore, what is needed is to provide a self-check system which is able to ensure the micro control chip to execute the safety check program periodically during operation and enable the safety standard organization to easily inspect the self-check scheme of the micro control chip.

SUMMARY OF THE INVENTION

In order to solve the above-mentioned problem, the present invention provides a self-check system and a method thereof.

According to an embodiment, a self-check system can be adapted to a chip system comprising at least one to-be-checked circuit and a reset circuit, and the self-check system comprises a memory, a watchdog circuit, and a processing unit. The memory is configured to store a first safety check program, a main application and a preset checksum data. The first safety check program comprises a circuit check program, a watchdog circuit reset program and a checksum check program. The main application comprises an interrupt call, and the preset checksum data corresponds to the first safety check program. After the watchdog circuit is activated, the watchdog circuit starts counting a counting value, and when the counting value overflows, the watchdog circuit triggers the reset circuit to reset the chip system. After the chip system is powered on, the processing unit executes the main application and executes the interrupt call to generate an interrupt, so as to execute the first safety check program. When the processing unit executes the first safety check program, the processing unit also executes the circuit check program to check the to-be-checked circuit. When the processing unit executes the first safety check program, the processing unit also executes the watchdog circuit reset program to reset the counting value of the watchdog circuit. When the processing unit executes the first safety check program, the processing unit executes the checksum check program to calculate checksum data of the first safety check program, when the calculated checksum data is not equal to the preset checksum data, the processing unit triggers the reset circuit to reset the chip system or notifies the main application.

According to an embodiment, the self-check system can comprise a register which stores an execution flag. The first safety check program comprises a flag clearing program, and the main application comprises a second safety check program and a flag setting program. After the processing unit executes the main application, the processing unit can execute the second safety check program to check the to-be-checked circuit, and also execute the flag setting program to set the execution flag of the register, and when the processing unit executes the first safety check program, the processing unit also executes the flag clearing program to check whether the execution flag is set.

According to an embodiment, when the processing unit executes the flag clearing program and confirms that the execution flag is not set, the processing unit triggers the reset circuit to reset the chip system or notifies the main application.

According to an embodiment, when the processing unit executes the flag clearing program and confirms that the execution flag is set already, the processing unit cleans the execution flag.

According to an embodiment, the memory is divided into a security protection read only memory (SPROM) and an application read only memory (APROM), the first safety check program is stored in the SPROM, and the main application is stored in the APROM.

According to an embodiment, the to-be-checked circuit comprises a system clock circuit, and the self-check system checks whether a clock signal outputted from the system clock circuit is correct.

According to an embodiment, the at least one to-be-checked circuit comprises an analog-to-digital converting circuit, and the self-check system checks whether an output digital value of the analog-to-digital converting circuit is correct.

According to an embodiment, the at least one to-be-checked circuit comprises a pulse width modulation (PWM) circuit, and the self-check system checks whether a PWM signal outputted from the PWM circuit is correct.

According to an embodiment, when the at least one to-be-checked circuit does not pass a check operation, the processing unit triggers the reset circuit to reset the chip system or notifies the main application.

According to an embodiment, the present invention provides a self-check method adapted to a chip system which comprises at least one to-be-checked circuit and a reset circuit. The self-check method comprises steps of storing a first safety check program, a main application and a preset checksum data in a memory, wherein the first safety check program comprises a circuit check program, a watchdog circuit reset program and a checksum check program, and the main application comprises an interrupt call, and the preset checksum data corresponds to the first safety check program; disposing a watchdog circuit, wherein after the chip system is powered on, the watchdog circuit is activated to start counting; after the chip system is powered on, executing the main application, and executing the interrupt call to generate an interrupt, so as to execute the first safety check program to execute the circuit check program to check the to-be-checked circuit, and execute the watchdog circuit reset program to reset the counting value of the watchdog circuit, and execute the checksum check program to generate checksum data of the first safety check program, wherein when the calculated checksum data is not equal to the preset checksum data, the reset circuit is triggered to reset the chip system or the main application is notified.

According to an embodiment, the self-check method further comprises steps of providing a register which stores an execution flag, wherein the first safety check program comprises a flag clearing program, and the main application comprises a second safety check program and a flag setting program, and when the main application is executed, the second safety check program is executed to check the to-be-checked circuit, and the flag setting program is executed to set the execution flag of the register, and when the first safety check program is executed, the flag clearing program is executed to check whether the execution flag is set.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

In an application of a specific chip such as a micro control chip for controlling power, if the specific chip has false action or malfunction, it easily occurs excessive current to cause danger. For this reason, in the industry, there is an organization for regulating a safety check standard such as IEC60730, and the micro control chip manufacturers are required to provide documents for demonstrating that the micro control chips meet the standard before delivery. For example, the manufacturer must provide documents related to the program contents inside the micro-controller unit and description of execution process of a safety check program, to demonstrate that the micro control chip is able to periodically check the systemic environment for safety during operation, and is able to stop operating in time when at least one important circuit has false action or malfunction, thereby preventing occurrence of danger.

The self-check system of the present invention is developed to ensure that the safety check program is stored in a memory and the chip system can periodically execute the safety check program during operation.

Please refer toFIG. 1, which shows a block diagram of an embodiment of a self-check system of the present invention. The self-check system is applicable to a chip system comprises at least one to-be-checked circuit30and a reset circuit50. The self-check system comprises a memory10, a watchdog circuit40, and a processing unit20.

The memory10stores a safety check program11, a main application13and a preset checksum data101. In an embodiment, the memory10can be a nonvolatile memory such as a flash memory or an EEPROM. The safety check program11can comprise a circuit check program111, a watchdog circuit reset program112and a checksum check program113. The storage location of the safety check program11corresponds to a hardware interrupt such as IRQ10, so that the processing unit20can execute the safety check program11upon receipt of the predetermined hardware interrupt.

The main application13comprises an interrupt call131and a main function program. In general, after the chip system is powered on, the processing unit20executes the main application13to provide the predominant function of the chip system. In the self-check system of the present invention, the main application13is required to include the interrupt call for requesting, for example, IRQ10, so that the processing unit20can periodically receive the specific hardware interrupt to execute the safety check program11when executing the main application13.

The preset checksum data101corresponds to the safety check program11. That is, the user can calculate the checksum of the safety check program11in advance, and store the calculated checksum in the memory10as the preset checksum data101. The manner of calculating and checking checksum data is well known by a person having ordinary skill in the art, so the detailed description is not repeated herein.

The watchdog circuit40can be implemented by a timer hardware. The watchdog circuit40can comprise a counting value401. After the watchdog circuit40activates, the watchdog circuit40starts counting the counting value401, and when the counting value401overflows, the watchdog circuit40generates the trigger signal. In order to prevent generation of the trigger signal, the counting value401of the watchdog circuit40must be periodically reset. In the self-check system of the present invention, the trigger signal402of the watchdog circuit40is configured to trigger the reset circuit50for resetting the chip system; or, in an embodiment, the trigger signal402of the watchdog circuit40is configured to set an error flag to notify the main application131.

After the chip system is powered on, the processing unit20executes the main application13, and then executes the interrupt call131to generate the interrupt, thereby executing the safety check program11. When the processing unit20executes the safety check program11, the processing unit20can execute the circuit check program111to check the at least one to-be-checked circuit30, and the processing unit20also execute the watchdog circuit reset program112to generate the counting-value reset signal201, so as to reset the counting value401of the watchdog circuit40.

If the main application13does not generate the interrupt periodically to execute the safety check program11and the watchdog circuit reset program112, the watchdog circuit40eventually overflow to generate a trigger signal402to the reset circuit50, so as to reset the chip system. In this case, after the chip system is reset, the chip system is then reset again because the watchdog circuit40overflows eventually, it is obvious that this mechanism can effectively disable the operation of the chip system, which does not periodically execute the safety check program11.

When the processing unit20executes the safety check program11, the processing unit20also executes the checksum check program113to calculate the checksum data of the safety check program11. When the calculated checksum data is not equal to the preset checksum data101, the processing unit20generates the trigger signal202to trigger the reset circuit50to reset the chip system. In an embodiment, the processing unit20can set the error flag to notify the main application131when the calculated checksum data is not equal to the preset checksum data101.

There are many micro control chip manufacturers and application developers in the micro control chip industry. The micro control chip manufacturer can provide micro control chips, fundamental driver programs and safety check programs, and the application developer can develop and program the application into the micro control chip. Therefore, how to confirm that the application developer indeed programs the safety check program into the micro control chip, and to also enable the safety standards organization to easily confirm that the safety check program is programmed in the micro control chip, is an key issue of ensuring safety of the chip system.

The micro-control-chip manufacturer can provide the preset checksum data101of the safety check program to the application developer and the safety standards organization in advance. If the application developer does not store the preset checksum data101in a preset position of the memory10, the checksum check program113can determine that the calculated checksum data is not equal to preset checksum data101, which should be stored in the preset position of the memory10, and the processing unit20can trigger the reset circuit50to reset the chip system or can set the error flag to notify the main application131to perform corresponding countermeasures. As a result, the chip system without the safety check program11is unable to operate normally. Furthermore, the safety standards organization can check whether the preset checksum data101is stored in the preset position of the memory10, to easily confirm the micro control chip programmed with the safety check program.

In an embodiment, the at least one to-be-checked circuit30can comprise a system clock circuit31, and the self-check system can check whether a clock signal outputted from the system clock circuit31is correct. In an embodiment, the at least one to-be-checked circuit30can comprise an analog-to-digital converting circuit32, and the self-check system can check whether an output digital value of the analog-to-digital converting circuit32is correct. In an embodiment, the at least one to-be-checked circuit30can comprise a pulse width modulation (PWM) circuit33, and the self-check system can check whether an PWM signal outputted from the PWM circuit33is correct. When the at least one to-be-checked circuit30does not pass the check operation, the processing unit20can generate the trigger signal202to trigger the reset circuit50to reset the chip system or set the error flag to notify the main application. The detail of check operation will be described in paragraphs below.

Please refer toFIG. 2, which shows a flowchart showing the steps in an operation of an embodiment of a self-check method of the present invention. The self-check method is applicable to the chip system, such as the chip system shown inFIG. 1. The self-check method includes steps S11to S16.

In the step S10, the safety check program11, the main application13and the preset checksum data101are stored in a memory10, and the safety check program11comprises the circuit check program111, the watchdog circuit reset program112, and the checksum check program113. The main application13comprises the interrupt call131. The preset checksum data101corresponds to the safety check program11.

In the step S11, the watchdog circuit40is provided, and after the chip system is powered on, the watchdog circuit40is activated to start counting. In the step S12, after the chip system is powered on, the main application13is executed and the interrupt call131is also executed to generate the interrupt for executing the first safety check program19.

In the step S13, the checksum check program113is executed to generate the checksum data of the first safety check program19and determine whether the calculated checksum data is equal to the preset checksum data101. When the calculated checksum data is not equal to the preset checksum data101, the method executes the step S16, the reset circuit50is triggered to reset the chip system; in an embodiment, the step S16can be the step of setting the error flag to notify the main application131. When the calculated checksum data is equal to the preset checksum data101, the method executes the step S14.

In the step S14, the watchdog circuit reset program112is executed to reset the counting value401of the watchdog circuit40. In the step S15, the circuit check program111is executed to check the at least one to-be-checked circuit30. If the at least one to-be-checked circuit30does not pass the check operation, the method executes the step S16to trigger the reset circuit50for resetting the chip system.

By using the self-check method of the present invention, if the application developer does not store the preset checksum data101in the preset position of the memory10, and the checksum check program113determines that the calculated checksum data is not equal to the preset checksum data101, and the processing unit20can trigger the reset circuit50to reset the chip system. As a result, the chip system without the safety check program11cannot operate normally. Furthermore, the safety standards organization can check whether the preset checksum data101is stored in the preset position of the memory10, thereby easily confirming whether the micro control chip is programmed with the safety check program. Furthermore, if the main application13does not generate the interrupt periodically to execute the safety check program11and the watchdog circuit reset program112, the watchdog circuit40eventually overflows to generate the trigger signal402to the reset circuit50, so as to reset the chip system. After the chip system is power on again, the chip system is then reset eventually because the watchdog circuit40overflows eventually, it is obviously that this mechanism can disable the operation of the chip system, which does not periodically execute the safety check program11.

The self-check method of the present invention can ensure that the safety check program11stored in the chip system, and the chip system periodically executes the safety check program11during operation; otherwise, operation of the chip system is stopped in time.

Please refer toFIG. 3, which shows a block diagram of another embodiment of a self-check system of the present invention. In the embodiment, the self-check system comprises a memory, a watchdog circuit40, a processing unit20and a register60. The memory stores a first safety check program19, a main application18and a preset checksum data101. The first safety check program19comprises a circuit check program191, a watchdog circuit reset program192, a checksum check program193and a flag clearing program194. The main application18comprises a second safety check program182, a flag setting program183and an interrupt call181. The preset checksum data101corresponds to the first safety check program19.

In the embodiment, the memory can be divided into an SPROM and an APROM. The SPROM is primarily used to store basic codes of the chip system, for example, driver codes. The programs developed by the application developer can be stored in the APROM. In the embodiment, the first safety check program19is stored in the SPROM, and the main application13is stored in the APROM. The chip system can comprise the system clock circuit31, the analog-to-digital converting circuit32, and the PWM circuit33.

The difference between previous embodiment and this embodiment is that the safety check program of this embodiment includes a first safety check program19and a second safety check program182, and the chip system comprises a register to check whether the second safety check program182is executed. In actual application, the micro-control-chip manufacturer can develop the first safety check program19which provides basic safety check functions, and the application developer can develop the second safety check program182to provide more safety check functions for the developed application. In an embodiment, when the safety check program developed by the micro control chip manufacturer is too large to store in the SPROM, the safety check program can be divided into the first safety check program19and the second safety check program182, and the first safety check program19and the second safety check program182can be stored in the SPROM and the APROM, respectively.

After the chip system is powered on, the processing unit20executes the main application18, and executes the interrupt call181to generate the interrupt, thereby executing the first safety check program19. When the processing unit20executes the first safety check program19, the processing unit20can execute the circuit check program191to check the at least one to-be-checked circuit30, and the processing unit20also can execute the watchdog circuit reset program192and the checksum check program193. The operations are the same as that of an embodiment shown inFIG. 1, so detailed descriptions are not repeated herein.

Furthermore, when the processing unit20executes the first safety check program19, the processing unit20also executes the flag clearing program194to confirm whether the execution flag601is set as a preset value, such as “1”; if not, the processing unit20can trigger the reset circuit50to reset the chip system; or, in an embodiment, the processing unit20can set the error flag to notify the main application131. When the processing unit20executes the flag clearing program194and confirms that the execution flag601is set as the preset value already, the processing unit20can clean the execution flag601to, for example, “0”.

When the processing unit20executes the main application18, the processing unit20can execute the second safety check program182to check the system clock circuit31, the analog-to-digital converting circuit32and the PWM circuit33, and also execute the flag setting program183to set the execution flag601of the register60as the preset value, such as “1”.

In the embodiment, when the processing unit20executes the first safety check program19, the processing unit20can confirm whether the execution flag601is set as “1”, so as to determine whether the second safety check program182is executed already. In actual application, even the first safety check program19and the second safety check program182are programmed in the memory, the memory possibly is damaged after a long-term use, and the damaged memory fails to execute the second safety check program182. For this reason, the aforementioned mechanism is required to ensure that the chip system can stop operating in time if the second safety check program182is not executed.

Please refer toFIG. 4, which shows a schematic view of a check operation of a system clock circuit of a self-check system of the present invention. As shown inFIG. 4, the system clock circuit31generates at least two clock signals701and702. In order to prevent the chip system operation error caused by a change in frequencies of the clock signals701and702due to environmental factor or damage of the system clock circuit, the self-check system of the present invention can periodically check whether the frequencies of the clock signals701and702is maintained in a certain ratio. As shown inFIG. 4, the counter70can receive the clock signals701and702, and the clock signal with a higher frequency can serve as a counting reference signal, for example, the clock signal701is 1 MHz and the clock signal702is 48 MHz, the counter70can use the clock signal702to serve as the counting reference signal for counting the clock signal701.

Since a ratio of the clock signal701to the clock signal702is preset, the clock signal702can count the clock signal701to obtain a counting value703, and the comparing unit71can compare the counting value703with a preset counting value711. When the difference between the counting value703and the preset counting value711is higher than a threshold value, the processing unit20can determine that the change in the frequencies of the clock signals701and702is too large, and then generate the trigger signal202to the reset circuit50, so as to reset the chip system; or, in an embodiment, the processing unit20can set the error flag to notify the main application131to perform corresponding countermeasures.

Please refer toFIG. 5, which shows a schematic view of a check operation of an analog-to-digital converting circuit of a self-check system of the present invention. In order to check whether the analog-to-digital converting circuit32operates normally, the self-check system can comprise two resistors R and a switch82configured to input different voltages to the analog-to-digital convertor80, respectively. The comparing unit81compares the output digital values801to803, which are outputted from the analog-to-digital convertor80, with the preset digital values811to813, to generate output digital error values804. For example, two resistors R can be electrically connected in series between a power source with a voltage of 5V and ground, so the output digital values801to803outputted from the analog-to-digital convertor80substantially correspond to 5V, 2.5V and 0V, respectively, and the preset digital values811to813also correspond to 5V, 2.5V and 0V, respectively. When one of the differences between the output digital values801to803and the preset digital values811to813is higher than a threshold value, the processing unit20can determine that the analog-to-digital converting circuit32has functional error, and then generate the trigger signal202to the reset circuit50, so as to reset the chip system; or, in an embodiment, the processing unit20can set the error flag to notify the main application131to perform corresponding countermeasures.

Please refer toFIG. 6, which shows a schematic view of check operation of a PWM circuit of a self-check system of the present invention. When a check operation for the PWM circuit is performed, the sampling circuit90generates a preset sampling signal to sample a pulse width modulation signal of the chip system, and each sampling signal latch a latch time91, to obtain a first sampling value901, a second sampling value902, a third sampling value903and a fourth sampling value904. The processing unit20can determine whether the first sampling value901, the second sampling value902, the third sampling value903and the fourth sampling value904are the same as a preset pattern. When one of the first sampling value901, the second sampling value902, the third sampling value903and the fourth sampling value904is different from the preset pattern, the processing unit20can determine that the PWM circuit has functional error, and then generate the trigger signal202to the reset circuit50, so as to reset the chip system; or, in an embodiment, the processing unit20can set the error flag to notify the main application131to perform corresponding countermeasures.

Please refer toFIG. 7, which shows a flowchart showing the steps in an operation of another embodiment of a self-check method of the present invention. The self-check method is applicable to the chip system, such as the chip system shown inFIG. 3. The self-check method includes steps S40to S49. In a step S40, the first safety check program19, the main application18and the preset checksum data101are stored in a memory10, and the first safety check program19comprises the circuit check program191, the watchdog circuit reset program192, the checksum check program193and the flag clearing program194. The main application13comprises the interrupt call131, and the preset checksum data101corresponds to the first safety check program19.

In a step S41, a watchdog circuit40is provided, and after the chip system is powered on, the watchdog circuit40is activated to start counting.

In a step S42, after the chip system is powered on, the main application13is executed and the interrupt call131is also executed to generate the interrupt for executing the first safety check program19. In a step S43, the checksum check program193is executed to generate the checksum data of the first safety check program19and determine whether the calculated checksum data is equal to the preset checksum data101. When the calculated checksum data is not equal to the preset checksum data101, the method executes a step S49, to trigger the reset circuit50to reset the chip system; in an embodiment, the step S49can include an operation of setting the error flag to notify the main application131. When the calculated checksum data is equal to the preset checksum data101, the sequential step is executed.

In a step S44, the watchdog circuit reset program112is executed to reset the counting value401of the watchdog circuit40. In a step S45, the flag clearing program is executed to check whether the execution flag601is set as the preset value such as “1”; if not, the method executes the step S49to trigger the reset circuit50to reset the chip system. After the flag clearing program194is executed already, and it is confirmed that the execution flag601is set as “1”, the execution flag601is cleaned to be, for example, “0”.

In a step S46, the circuit check program191is executed to check the at least one to-be-checked circuit, such as the system clock circuit31, the analog-to-digital converting circuit32, or the PWM circuit. When one of the at least one to-be-checked circuit does not pass the check operation, the method executes the step S49to trigger the reset circuit50to reset the chip system. When the at least one to-be-checked circuit passes the check operation, the method executes the step47.

In a step S47, the second safety check program182is executed to check the at least one to-be-checked circuit, such as the system clock circuit31, the analog-to-digital converting circuit32, or the pulse width modulation (PWM) circuit. When the to-be-checked circuit does not pass the check operation, the method executes the step S49to trigger the reset circuit50to reset the chip system; in an embodiment, the step S49can include an operation of setting the error flag to notify the main application131. When the to-be-checked circuit passes the check operation, the method executes the step48to execute the flag setting program183for setting the execution flag601as, for example, “1”.

It should be noted that the first safety check program19and the second safety check program182are executed in the step S46and the step S47, to check the to-be-checked circuit, respectively. If the to-be-checked circuit comprises a plurality of circuits such as the system clock circuit31, the analog-to-digital converting circuit32, and the PWM circuit, or the check time for the to-be-checked circuit is longer, the system designer can appropriately divide and allocate the check program into the first safety check program19and the second safety check program182, and the allocation and division of the check program is not limited in the present invention. Furthermore, in a condition that a complete check operation needs longer time, in order to maintain normal operation of the chip system, the system designer can divide the whole check operation into multiple partial check operations, and execution of the multiple partial check operations can be completed by executing the first safety check program19and the second safety check program182for many times, so as to complete the whole check.