How to cleverly resist interference in single chip system software

While improving the anti-interference ability of hardware systems, software anti-interference has been increasingly valued for its flexible design, saving hardware resources and good reliability. Taking the MCS-51 single-chip microcomputer system as an example, the software anti-interference method of the microcomputer system is studied.
  1 Research on software anti-interference methods
  In engineering practice, the content of software anti-interference research is mainly: 1. Eliminating the noise of analog input signals (such as digital filtering technology); 2. Methods to get the program back on track when the program is running chaotically. This paper proposes several effective software anti-interference methods for the latter.
  1.1 Instruction redundancy
  The CPU instruction fetching process is to first fetch the opcode and then the operand. When the PC is interfered with and an error occurs, the program will "fly around" off the normal track. When it flies to a double-byte instruction, if the instruction fetching moment falls on the operand, the operand will be mistakenly regarded as the opcode, and the program will go wrong. If it "flies" to a three-byte instruction, the error probability is even greater.
  Artificially inserting some single-byte instructions in key places, or rewriting valid single-byte instructions is called instruction redundancy. Usually, two or more bytes of NOP are inserted after double-byte instructions and three-byte instructions. In this way, even if the flying program flies to the operand, the existence of the no-operation instruction NOP prevents the subsequent instructions from being executed as operands, and the program is automatically put on track.
  In addition, inserting two NOPs before instructions that play an important role in the system flow, such as RET, RETI, LCALL, LJMP, JC, etc., can also put the flying program on track and ensure the execution of these important instructions.
  1.2 Interception technology
  The so-called interception refers to leading the flying program to the specified location and then handling the error. Usually, software traps are used to intercept flying programs. Therefore, the traps must be designed reasonably first, and then the traps must be arranged in appropriate locations.
  1.2.1 Design of software traps
  When the flying program enters the non-program area, the redundant instructions will not work. Through software traps, the flying program is intercepted and led to the specified location, and then error handling is performed. Software traps refer to instructions used to lead the captured flying program to the reset entry address 0000H. Usually, the following instructions are filled in the non-program area of ​​EPROM as software traps:
                       NOP
                       NOP
                       LJMP 0000H,
whose machine code is 0000020000.
  1.2.2 Arrangement of traps
  Usually, 0000020000 is filled in the unused EPROM space in the program. The last one should be filled with 020000. When the flying program falls into this area, it can automatically enter the track. The free units between the modules in the user program area can also be filled with trap instructions. When the interrupt used is opened due to interference, a software trap is set in the corresponding interrupt service program to capture the wrong interrupt in time. For example, although an application system does not use external interrupt 1, the interrupt service program of external interrupt 1 can be in the following form:
                       NOP
                       NOP
                       RETI
  The return instruction can use "RETI" or "LJMP 0000H". If the design of the fault diagnosis program and the system self-recovery program is reliable and perfect, using "LJMP 0000H" as the return instruction can directly enter the fault diagnosis program, handle the fault as soon as possible and restore the program operation.
  Considering the capacity of program memory, software traps generally have 2-3 per 1K space to effectively intercept.
  1.3 Software "watchdog" technology
  If the out-of-control program enters a "dead loop", the "watchdog" technology is usually used to get the program out of the "dead loop". By continuously detecting the program loop running time, if it is found that the program loop time exceeds the maximum loop running time, it is considered that the system is trapped in a "dead loop" and error processing is required.
  The "watchdog" technology can be implemented by hardware or software. In industrial applications, severe interference sometimes destroys the interrupt mode control word and turns off the interrupt. Then the system cannot "feed the dog" regularly, and the hardware watchdog circuit fails. The software watchdog can effectively solve this kind of problem.
  In actual applications, the author uses a ring interrupt monitoring system. Use timer T0 to monitor timer T1, use timer T1 to monitor the main program, and the main program monitors timer T0. The software "watchdog" using this ring structure has good anti-interference performance and greatly improves the system reliability. For the measurement and control system that needs to use T1 timer for serial communication frequently, timer T1 cannot be interrupted, and can be monitored by serial port interrupt instead (if MCS-52 series single-chip microcomputer is used, T2 can also be used instead of T1 for monitoring). The principle of this software "watchdog" monitoring is: set a running observation variable in the main program, T0 interrupt service program, and T1 interrupt service program, assuming MWatch, T0Watch, T1Watch, each time the main program loops once, MWatch increases by 1, and similarly, T0 and T1 interrupt service programs are executed once, T0Watch and T1Watch increase by 1. In the T0 interrupt service program, the change of T1Watch is detected to determine whether T1 is running normally, and in the T1 interrupt service program, the change of MWatch is detected to determine whether the main program is running normally, and in the main program, the change of T0Watch is detected to determine whether T0 is running normally. If it is detected that a certain observation variable changes abnormally, such as it should be added by 1 but is not added by 1, it will be transferred to the error handling program for troubleshooting. Of course, the maximum cycle of the main program and the timing cycle of timers T0 and T1 should be given comprehensive and reasonable consideration. Due to limited space, this article will not be elaborated.
  2 System fault handling and design of self-recovery program The
  reset of the microcontroller system due to interference or after power failure is an abnormal reset. Fault diagnosis should be performed and the state before the abnormal reset should be automatically restored.
  2.1 Identification of abnormal reset
  The execution of the program always starts from 0000H. There are four possibilities for the program to start executing from 0000H: 1. System power-on reset; 2. Software fault reset; 3. Watchdog timeout hardware reset; 4. Task is in the process of executing and then power-on reset. Except for the first case, all of the four cases are abnormal resets and need to be identified.
  2.1.1 Identification of hardware reset and software reset
  Here, hardware reset refers to power-on reset and watchdog reset. Hardware reset has an impact on registers, such as PC=0000H, SP=07H, PSW=00H, etc. after reset. Software reset has no impact on SP and SPW. Therefore, for the microcomputer measurement and control system, when the program is running normally, the SP address is set to be greater than 07H, or the 5th user flag of PSW is set to 1 when the system is running normally. Then when the system is reset, it is only necessary to detect the PSW.5 flag or SP value to determine whether it is a hardware reset. Figure 1 is a program flow chart using PSW.5 as the power-on flag to distinguish between hardware and software resets. [page]

Figure 1 Flowchart of hard and software reset identification   

In addition, since the state of the RAM in the chip is random during hardware reset, while the state before reset can be maintained during software reset, one or two units in the chip can be selected as the power-on mark. Assume that 40H is used as the power-on mark, and the power-on mark word is 78H. If the content of the 40H unit is not equal to 78H after the system is reset, it is considered to be a hardware reset, otherwise it is considered to be a software reset and the error processing is turned to. If two units are used as power-on marks, the reliability of this discrimination method is higher.
  2.1.2 Identification of power-on reset and watchdog fault reset
  Since power-on reset and watchdog fault reset are both hardware resets, non-volatile RAM or EEROM is generally required to correctly identify them. When the system is operating normally, an observation unit with power-off protection is set. When the system is operating normally, the observation unit is kept at a normal value (set to AAH) in the interrupt service program of the timed dog feeding, and the unit is cleared in the main program. Since the observation unit can be protected when power is off, it can be determined whether the watchdog reset occurs by detecting whether the unit is at a normal value when the system is powered on.
  2.1.3 Identification of normal power-on reset and abnormal power-on reset
  Identification of power-on reset and normal power-on reset caused by unexpected situations such as system power failure in the measurement and control system is particularly important for process control systems. For example, a measurement and control system that uses time as the control standard takes 1 hour to complete a measurement and control task. When the measurement and control has been performed for 50 minutes, the system voltage abnormality causes a reset. At this time, if the system is reset and the measurement and control is started from the beginning, it will cause unnecessary time consumption. Therefore, a monitoring unit can be used to monitor the current system operation status and system time, and the control process is decomposed into several steps or several time periods. After each step is executed or each time period is run, the monitoring unit is set to the shutdown permission value. Different tasks or different stages of tasks have different values. If the system is performing a measurement and control task or is executing a certain time period, the monitoring unit is set to an abnormal shutdown value. Then, after the system is reset, the original operation status of the system can be judged based on this unit, and the error handling program can be jumped to restore the original operation status of the system.
  2.2 Programming of system self-recovery after abnormal reset
  For some process control systems with strict sequence requirements, whether the system is abnormally reset or not, it is generally required to resume operation from the module or task that is out of control. Therefore, the measurement and control system should make backups of important data units and parameters, such as system operation status, system process value, current input and output values, current clock value, observation unit value, etc. These data should be backed up regularly and immediately backed up if modified.
  When the system is judged to be abnormally reset, some necessary system data should be restored first, such as initialization of the display module and initialization of the off-chip expansion chip. Secondly, the system status and operation parameters of the measurement and control system should be restored, including the restoration of the display interface. After that, the tasks, parameters, running time, etc. before the reset should be restored, and then the system operation state should be entered.
  It should be noted that to truly restore the system's operating state, it is necessary to back up the important data of the system in great detail and perform data reliability checks to ensure the reliability of the restored data.
  Secondly, for multi-task, multi-process measurement and control systems, data recovery needs to consider the order of recovery. The data recovery process flow chart actually applied by the author is shown in Figure 2.

Figure 2 System self-recovery program flow chart

In the figure, restoring the basic system data means taking out the backup data to overwrite the current system data. The basic system initialization refers to initializing the chip, display, input and output mode, etc. It should be noted that the initialization of the input and output should not cause malfunction. The initialization of the task before reset refers to the execution status and running time of the task.
  3 Conclusion
  Due to the limited space, this article does not discuss some other common methods of software anti-interference, such as digital filtering, RAM data protection and error correction. In engineering practice, several anti-interference methods are usually used together to complement each other to achieve better anti-interference effects. Fundamentally speaking, hardware anti-interference is active, while software anti-interference is passive. It is completely feasible to carefully analyze the interference source, combine hardware and software anti-interference, improve the system monitoring program, and design a stable and reliable single-chip microcomputer system.