Anti-interference design of single chip microcomputer software system

　　To improve the reliability of the MCU application system, we must start with the hardware and software and improve the system's own defense behavior. The following methods to improve reliability are not used alone. Only by effectively combining these methods according to the actual situation can we achieve the best anti-interference effect and make our MCU system work stably and reliably. Of course, the reliability of the MCU system operation will also be affected by other uncertain factors.

　　1. Instruction redundancy
　　The CPU fetches instructions by first fetching the opcode and then the operand. Artificially inserting some single-byte instructions in the key places of the program, or rewriting the valid single-byte instructions is called instruction redundancy. Usually, two or more NOP instructions are inserted after the double-byte instructions and three-byte instructions. In this way, even if the program runs away and flies to the double-byte instructions and three-byte instruction operands. Due to the existence of the narrow operation instruction NOP, the subsequent instructions are prevented from being executed incorrectly, preparing for the program to be put on the right track. In addition, instructions that play an important role in the system flow, such as RET, RETI, LCALI., LJMP, JC, etc., can insert two NOP instructions after these instructions, which can put the runaway program on the right track to ensure the execution of these important instructions. Instruction redundancy can only prevent the CPU from mistakenly executing the operand as the opcode, but it cannot actively reverse the wrong execution direction of the program. To correct the wrong execution direction of the program, the following technology is required.
　　2. Design software "traps"
　　usually fill the unused EPROM space in the program memory with narrow operation instructions NOP, and finally fill in a jump instruction to jump to the runaway processing program, or directly fill in the instruction LJMP 0000H. When the runaway program falls into this area, it can return to the normal track after executing a period of empty operations. If the unused EPROM space is relatively large, you can evenly fill in several empty operation instructions and jump instructions. This structure of several empty operation instructions plus a jump instruction is called a "software trap". The
　　general structure of the software trap is:
　　NOP
　　NOP
　　LJMP FLY
　　FLY is the runaway processing subroutine. If the program is executed normally, the software trap part will never be executed. Only when the program runs into the trap, the software trap will immediately jump the program to the normal track. Even if the program does not run into the trap, it can encounter a software trap after the program executes a period of erroneous operation, thus returning to the normal track. In addition to the blank area of ​​the program memory, a software trap should also be set at the end of the program's data table. If the data table is relatively large, a software trap should also be set in the middle of the data table to ensure that the program can be put back on track in time when it runs away to the data area. In addition, if the space of the program memory is large enough, a software trap can be set between every two subroutines. When the interrupt used is opened due to interference, a software trap is set in the corresponding interrupt service program to capture the wrong interrupt in time. The number of software traps should be determined according to the actual interference situation and the capacity of the program memory. If there are too few, effective runaway interception cannot be performed, and if there are too many, a large amount of program memory space will be occupied.
　　3. Software "watchdog" technology
　　After executing some wrong operations, the runaway program often enters a "dead loop", which is often called "freeze". Usually, the "software watchdog" technology is used to get the program out of the "dead loop". The principle of the software "watchdog" technology is to continuously detect the program loop running time. If it is found that the program loop time exceeds the maximum loop running time, it is considered that the system is trapped in a "dead loop" and error handling is required. In practical applications, the timing interrupt service program is usually used to regularly check the operation of the main program. For example, a byte is selected in the RAM area as the software watchdog register. The main program adds 1 to the register every time it loops, and the interrupt service program of the timer TO decrements the register and checks it once every time it interrupts. If the program executes normally. The watchdog register will not change or change slightly. If the watchdog register changes or changes significantly, it means that the system is trapped in a "dead loop" and error handling is required. In industrial applications, serious interference sometimes destroys the interrupt mode control word, turns off the interrupt, and causes the watchdog to fail. At this time, a ring interrupt monitoring system can be used. Use timer TO to monitor timer Tl, use timer Tl to monitor the main program, and the main program to monitor timer T0.
　　The software "watchdog" using this ring structure has good anti-interference performance and greatly improves the system reliability. For the measurement and control system that needs to frequently use the Tl timer for serial communication, the timer Tl cannot be interrupted, and can be monitored by the serial port interrupt instead. Of course, the maximum cycle of the main program, the timer T0 and the Tl timing cycle should be considered reasonably in the whole. The software "watchdog" technology requires the use of timers, and in most control programs, timers are scarce resources. This limits the practical application of the "software watchdog" technology. We can take some tricks to reuse the same timer for the software "watchdog" program and other timing programs, so that both the timing function and the software "watchdog" function can be completed.
　　4. Check the RAM area flag data to find serious interference in time
　　This method is to select several fixed units in the RAM area and set them to fixed data in the initialization program. As long as the program runs normally, the contents of these units will not change. If the data of any of these RAM units changes due to program "runaway" or other interference, it means that the microcontroller system has been seriously interfered and cannot run reliably. We can check the contents of these RAM units in a timely manner during the execution of the program. Once the data is found to have changed, the LJMP 0000 H statement is immediately executed to force the microcontroller to reset.
　　5. Refresh output port
　　Eliminate serious interference. When the MCU system is seriously interfered, the state of the output port may also change due to interference. During the execution of the program, timely refresh the output port according to the calculation results of the relevant program modules to eliminate the influence of interference on the state of the output port, so that the wrong output state can be corrected in time.
　　6. Perform multiple input sampling
　　Avoid serious interference. Strong interference will affect the input signal of the MCU, causing errors or misreading of the instantaneous sampling of the input signal. To avoid the influence of interference, repeated sampling and weighted averaging are usually adopted.