The present invention relates to a microcomputer system with a watchdog timer, and in particular to such a microcomputer system with watchdog timer which incorporates a safety enhancing system for detecting faults in the hardware of the system.
In a conventional microcomputer system, a watchdog timer of a per se known sort is provided externally to the microcomputer, and the clock signal source for the watchdog timer circuit is provided separately from the system clock of the microcomputer, so that, in the event of any failure in the clock signal source for the system clock, the watchdog timer circuit may be able to detect any failure in the hardware of the microcomputer. However, in such a per se conventional system, because the clock signal source of the watchdog timer circuit is independent from the system clock signal source, in the event of a failure of the clock signal source and/or the counter of the watchdog timer circuit, it is impossible to detect the fact from the outside of the system, i.e., by the user. As a result, even if the clock signal source and the counter unit of the watchdog timer circuit should fail, the microcomputer keeps on operating independently from it, and therefore, even if the microcomputer should run wild, i.e. the system should run into a certain locked cycle or should not behave normally, due to any failure in the system, the watchdog timer circuit cannot stop it.
Therefore, in Japanese Patent Application No. 59-78061, which was filed on Apr. 18, 1984, and which it is not hereby intended to admit as prior art to this application except to the extent otherwise required by law, the assignee of the present patent application, as Japanese applicant, proposed to include a process in the system program of the microcomputer for monitoring the timer clock of the watchdog timer circuit and in case of any abnormal behavior thereof for producing an output to the outside indicating such an occurrence.
With such a construction, in the case of any failure in the watchdog timer circuit, the microcomputer can detect it, and the safety in case of any failure in the hardware of the system may be enhanced.
However, according to such a construction, a monitoring clock source is provided for the watchdog timer separately from the clock source from the system clock, and there is a problem that, should this monitoring clock source fail, even when the system action of the microcomputer is normal, it becomes impossible to detect any abnormality of the watchdog timer circuit.