JP5541201B2 - Program execution status monitoring apparatus and execution status monitoring program - Google Patents

Description

  The present invention relates to a program execution status monitoring apparatus and an execution status monitoring program for monitoring whether or not a program executed in a computer is normally executed.

  Whether the program is executed normally by writing the command contents, return address, etc. into a table when defining a function in the program (when executing a subroutine) as a program execution status monitoring device. There is known one that can check whether or not (see, for example, Patent Document 1).

JP-T-08-510342

However, the program execution status monitoring apparatus has a problem in that a huge storage capacity is required for the table because the contents of the instruction, the return address, and the like are written in the table.
Therefore, in view of such problems, a program execution status monitoring apparatus and an execution status monitoring program for monitoring whether or not a program executed on a computer is normally executed require a large amount of storage capacity. It is an object of the present invention to provide a technique capable of monitoring whether or not a program is normally executed.

  In the program execution status monitoring apparatus having the first configuration configured to achieve such an object, the first updating means includes a first update unit previously recorded in the first recording area as part of the process of the monitoring target program. And the value updated at the most recent time among the second values previously recorded in the second recording area (the one with the closest update time based on the current time) satisfies the predetermined condition. The value which is not updated at the latest time among the first value and the second value is updated to the first new value which is a value obtained by performing the first operation. The operation value generation means generates an operation value obtained by performing a second operation on the first new value as part of the process of the monitoring target program. Then, the second updating unit does not update the first updating unit after the processing by the first updating unit when the monitoring target program is executed in a normal order as a part of the monitoring target program. In the process of updating the first value or the second value, the second new value, which is a value obtained by performing an operation that cancels the first operation and the second operation with respect to the operation value, Of the first value and the second value, the value not updated at the latest time is updated. Further, the correspondence relationship determination output means repeatedly determines whether or not the correspondence relationship between the first value and the second value is a predetermined relationship as a process different from the monitoring target program. Output according to.

  In the present invention, for example, when the first new value obtained by the first updating unit is a value for updating the first value, the second value is used when the second updating unit operates in a normal order. Is updated to the second new value. When obtaining the second new value, the first operation and the operation value generated by performing the second operation on the second value whose relationship with the first value satisfies a predetermined condition are obtained. Thus, since the operation for canceling the first operation and the second operation is performed, the correspondence between the second value and the first value is maintained so as to satisfy a predetermined condition.

  On the other hand, it is assumed that the second updating unit does not operate in a normal order and the second value is updated by another process, and then the first value is updated to the second new value when the second updating unit is operated next. Is done. In this case, since the value that should be the second value is originally the first value, the correspondence between the first new value (first value) and the second new value (second value) is There is a high possibility that the predetermined condition is not maintained. In addition, even when the program counter is destroyed due to the influence of electromagnetic waves or the like and rewritten to an unintended value, the correspondence between the first new value (first value) and the second new value (second value) is There is a high possibility that the predetermined condition is not maintained.

  Therefore, according to such a program execution status monitoring apparatus, the program execution status can be determined by monitoring the relationship between the first numerical value and the second numerical value. Further, in this determination, since it is sufficient to provide a recording area for recording the first value, the second value, and the operation value, it is compared with a configuration in which a table in which executed instructions are recorded is prepared. Thus, it is possible to monitor whether the program is normally executed with a small recording area.

Note that the first updating means may perform the first operation on a predetermined value such as a value that has not been updated at the most recent time among the first value and the second value.
By the way, in the program execution status monitoring apparatus, as in the second configuration, a plurality of first update means, operation value generation means, and second update means are provided as one set. The generation unit generates an operation value by performing a second operation specific to the set to which the first update unit belongs to the first new value, and the second update unit excludes the operation value that has already been read. Reading the latest one of the operation values and performing an operation to cancel the second operation and the first operation performed by the operation value generation unit of the set to which the second update unit belongs with respect to the operation value. The second new value may be calculated with

  According to such a program execution status monitoring apparatus, the operation value generating means generates a different operation value for each set, and the second updating means is the latest one of the operation values excluding the already read operation values. , And an operation for canceling out the second operation that differs for each set with respect to the operation value is performed. Therefore, if an error occurs in the execution order of the program, the second update means can cancel out the second operation. Disappear. As a result, if an error occurs in the execution order of the program, there is a high possibility that the correspondence between the first value and the second value will change. Therefore, a plurality of sets of first update means, operation value generation means, and Even with the configuration provided with the second update means, the execution status of the program can be determined.

  In the present invention, when this set of second update means is implemented immediately after a set of first update means and operation value generation means is implemented, or a set of first update means and operation. After the value generation means is implemented and before this set of second update means is implemented, the first update means, the operation value generation means, and the second update means of another set (may be a plurality of sets). Is executed, the second new value when the execution order of the program is correct is calculated.

  Further, in the program execution status monitoring apparatus, as in the third configuration, the first update means calculates the first new value in the first half of the function definition in the monitored program, and the second update means The second update value may be calculated in the second half of the function definition in which one update means calculates the first new value.

  According to such a program execution status monitoring apparatus, it is possible to confirm whether or not the program in the function definition in which the processing by the first update unit and the second update unit is performed normally operates.

  In the program execution status monitoring apparatus, as in the fourth configuration, the correspondence determination output means outputs when the correspondence between the first value and the second value is not a predetermined relationship. As another example, a signal for resetting the process of executing the monitoring target program may be output.

  According to such a program execution status monitoring apparatus, when the correspondence relationship between the first value and the second value is not a predetermined relationship, that is, when the program execution status is abnormal, the monitored program Can be reset.

  Next, the execution status monitoring program formed to achieve the above object is a program for causing a computer to function as each means constituting the program execution status monitoring device described above. To do.

  According to such an execution status monitoring program, at least the same effects as those of the program execution status monitoring device according to claim 1 can be obtained.

2 is a block diagram illustrating a schematic configuration of an execution status monitoring apparatus 1. FIG. 2 is an explanatory diagram showing a schematic configuration and a hierarchical structure of a main program 13. FIG. It is the flowchart (a) which shows a head macro process, and the flowchart (b) which shows a tail macro process. It is a flowchart which shows an evaluation process. It is explanatory drawing which shows the transition state of each value in the storage area 15 at the time of normal. It is explanatory drawing which shows the transition state of each value in the storage area 15 at the time of abnormality.

Embodiments according to the present invention will be described below with reference to the drawings.
[Configuration of this embodiment]
FIG. 1 is a block diagram showing a schematic configuration of an execution status monitoring apparatus 1 to which the present invention is applied. As shown in FIG. 1, the execution status monitoring device 1 includes a process execution device 10 (program execution status monitoring device) and a watchdog circuit 21, and is executed by the process execution device 10. It has a function of monitoring whether or not the program is normally executed.

  Specifically, the process execution device 10 is configured as a microcomputer including a CPU 11, a main program 13 and a monitoring program 14 stored in a ROM, and a storage area 15 configured as a RAM. The CPU 11 is provided with a clock 12 (timer) for controlling the start timing of the program. The clock 12 sends a signal for causing the CPU 11 to execute the monitoring program 14 every predetermined time (for example, about every 1 second).

  The storage area 15 stores primary storage values calculated for each function definition. Further, when reading the primary storage value stored in the storage area 15, the CPU 11 is set so as to read the latest one of the primary storage values and not read the value once read. Note that the CPU 11 may delete the primary storage value to be read.

  The watchdog circuit 21 outputs a reset signal for resetting the process execution device 10 when an edge signal cannot be obtained from the process execution device 10 within a predetermined time. That is, in the process described later, if the program is executed normally, the process execution device 10 periodically transmits an edge signal to the watchdog circuit 21 to prevent the reset signal from being output from the watchdog circuit 21. However, if the program is not executed normally, the process execution device 10 does not transmit the edge signal to the watchdog circuit 21, and a reset signal is output from the watchdog circuit 21.

  For example, when the execution status monitoring device 1 is mounted on a vehicle, the main program 13 functions as a program for controlling each part of the vehicle. Here, FIG. 2 is an explanatory diagram showing a schematic configuration and a hierarchical structure of the main program 13.

  As shown in FIG. 2, the main program 13 describes the main routine following the start-up routine at the highest layer, layer 0 (the nesting depth is 0). The main routine shown in FIG. 2 includes two function definitions (subroutines) A1 and A2, and the program is described as layer 1 which is one layer below these function definitions A1 and A2.

  In addition, the function definition A1 includes a function definition B1, and the program for the function definition B1 is described as a hierarchy 2 that is one level lower. The function definition B1 includes function definitions C1 and C2, and a program for these function definitions C1 and C2 is described as a hierarchy 3 that is one level lower.

  Here, in each function definition of the present embodiment, a head macro (program) and a tail macro are added in a form that does not affect a normal program (for example, a program for controlling a vehicle). For example, the function definition A1 includes an A1 head macro and an A1 tail macro that are macros for the function definition A1, and the function definition C2 includes a C2 head macro and a C2 tail macro that are macros for the function definition C2. Is added.

[Process of this embodiment]
A specific operation of the leading macro executed in the processing execution apparatus 10 configured as described above will be described with reference to FIG. FIG. 3A is a flowchart showing the leading macro process executed by the CPU 11 as a part of the main program 13, and FIG. 3B is a flowchart showing the tail macro process executed by the CPU 11 as a part of the main program 13.

  Note that the flag t and the variables t1 and t2 are used in the head macro process and the tail macro process. These values are given as t = ON, t1 = 0, t2 = 1 as initial values in the startup routine.

  The head macro process is a process that starts when the head macro is read in each function definition. Specifically, as shown in FIG. 3A, first, the state of the flag t is determined (S110).

  If t is ON (S110: ON), “t1 + 1” (first operation, first new value) is overwritten on t2 (S120: first update means), and “t2 + P” (second operation, operation) Value) is recorded as a primary storage value on the stack in the storage area 15 (S130: operation value generation means). Here, P is an arbitrary value specific to the function definition, and the value P_i of P in a certain function definition i is different from the value P_j of P in another function definition j, and | 1− P_i + P_j | (absolute value) is set so as not to be 1.

  When this process ends, the process proceeds to S160 described later. If the flag t is OFF in the processing of S110 (S110: OFF), “t2 + 1” (first operation, first new value) is overwritten on t1 (S140: first updating means), and “ “t1 + P” (second operation, operation value) is recorded as a primary storage value on the stack in the storage area 15 (S150: operation value generation means). Then, the state of the flag t is reversed (that is, if t is ON, it is turned OFF, and if t is OFF, it is turned ON) (S160), and the head macro process is terminated.

  Next, the tail macro processing is processing that is started when the tail macro is read in each function definition. Specifically, as shown in FIG. (Pop) is read as temp (S210). Then, the state of the flag t is determined (S220).

  If t is OFF (S220: OFF), “temp-1-P” (second new value) is overwritten on t1 (S230: second updating means), and the process proceeds to S250 described later. If t is ON (S220: ON), “temp-1-P” (second new value) is overwritten on t2 (S240: second updating means), and the state of flag t is reversed ( S250), the tail macro process is terminated.

  That is, in the processes of S230 and S240, an operation for canceling the first operation (a process for adding 1) and the second operation (a process for adding P) is performed on the read primary storage value. In the process of updating t1 and t2 (S120, S140, S230, S240) of the head macro process and the tail macro process, the description of the program is considered so that only one instruction is required to avoid the influence from the interrupt task. Has been.

  Next, processing for evaluating whether or not the program is executed normally will be described with reference to FIG. FIG. 4 is a flowchart showing an evaluation process executed by the CPU 11 as the monitoring program 14. The evaluation process is started when a signal to start the process is received from the clock 12.

  In the evaluation process, as shown in FIG. 4, first, it is determined whether or not | t1-t2 | (absolute value) is 1 (S310: correspondence determination output means). If | t1-t2 | is 1 (S310: YES), an edge signal is output to the watchdog circuit 21 (S320: correspondence determination output means), and the evaluation process ends. If | t1-t2 | is not 1 (S310: NO), the evaluation process is terminated without outputting an edge signal.

  In the program configuration shown in FIG. 2, the transition state of each value in the storage area 15 when the top macro process and the end macro process are executed will be described with reference to FIG. FIG. 5 is an explanatory diagram showing the transition state of each value in the storage area 15 at the normal time.

As described above, immediately after the start-up routine is executed, the flag t is set to ON, t1 = 1, and t2 = 1.
When the main routine is started and the A1 head macro is executed, the flag t is turned OFF, and “1 + P_A1” is recorded in the A1 stack of the storage area 15. At this time, t2 remains at 1.

  Subsequently, when the B1 head macro is executed, t1 = 2 and the flag t is turned ON. Then, “2 + P_B1” is recorded in the B1 stack of the storage area 15. Next, when the C1 head macro is executed, t2 = 3 and the flag t is turned OFF. Then, “3 + P_C1” is recorded in the C1 stack of the storage area 15.

  Subsequently, when the C1 end macro is executed, t1 = (3 + P_C1) -1-P_C1 = 2 and the flag t is turned ON. When the C2 head macro is executed, the flag t is turned OFF, and “3 + P_C2” is recorded in the C2 stack of the storage area 15.

  When the C2 end macro is executed, t1 = (3 + P_C2) -1-P_C2 = 2 and the flag t is turned ON. Subsequently, when the B1 tail macro is executed, t2 = (2 + P_B1) -1-P_B1 = 1 and the flag t is turned OFF.

  When the A1 tail macro is executed, t1 = (1 + P_A1) -1-P_A1 = 0 and the flag t is turned ON. Subsequently, when the A2 head macro is executed, the flag t is turned OFF, and “1 + P_A2” is recorded in the A1 stack of the storage area 15. When the A1 tail macro is executed, the flag t is turned ON. Note that t1 = (1 + P_A2) -1-P_A2 = 0, and the value of t1 does not change.

In this way, when the program is executed in a normal order, | t1-t2 | (absolute value) is always 1, and an edge signal is output in the evaluation process.
Next, FIG. 6 is an explanatory diagram showing a transition state of each value in the storage area 15 at the time of abnormality. In FIG. 6, it is assumed that the C1 end macro is erroneously executed after the function definition C2 is executed and before the B1 end macro is executed.

  As shown in FIG. 6, as in FIG. 5, | t1-t2 | (absolute value) is always 1 until the end of the C2 macro. However, when the C1 end macro is executed next to the C2 end macro, t2 = (2 + P_B1) -1-P_C1 = 1 + P_B1-P_C1, and | 1-P_B1 + P_C1 | is not 1 because of the above condition. -T2 | is not 1. Therefore, an edge signal is not output in the evaluation process.

[Effects of this embodiment]
In the execution status monitoring device 1 described in detail above, the CPU 11 of the process execution device 10 performs the first value recorded in the first recording area and the second value in advance as a part of the processing of the main program 13. The first new value that is a value obtained by performing the first operation for the correspondence relationship with the value updated at the most recent time among the second values recorded in the recording area to satisfy the predetermined condition In addition, the value that has not been updated at the most recent time among the first value and the second value is updated, and an operation value obtained by performing the second operation on the first new value is generated. Then, when the main program 13 is executed in a normal order, the CPU 11 updates the first value or the second value that has not been updated after the processing by the CPU 11. A value that is not updated at the most recent time of the first value and the second value is added to the second new value that is a value obtained by performing an operation that cancels the first operation and the second operation. Update. Further, the CPU 11 repeatedly determines whether or not the correspondence relationship between the first value and the second value is a predetermined relationship in a monitoring program 14 different from the main program 13, and according to the determination result. Output.

  According to such a processing execution device 10, the execution status of the program can be determined by monitoring the relationship between the first numerical value and the second numerical value. Further, in this determination, since it is sufficient to provide a recording area for recording the first value, the second value, and the operation value, it is compared with a configuration in which a table in which executed instructions are recorded is prepared. Thus, it is possible to monitor whether the program is normally executed with a small recording area.

  In the process execution device 10, the CPU 11 calculates the first new value in the first half of the function definition and the second new value in the second half of the function definition in each function definition in the main program 13. In particular, the CPU 11 generates an operation value by performing a second operation specific to each function definition with respect to the first new value, and reads the latest one of the operation values excluding the already read operation value. The second new value is calculated by performing an operation that cancels the second operation and the first operation specific to the function definition with respect to the operation value.

  According to such a processing execution device 10, a different operation value is generated for each function definition, and an operation that cancels the second operation that is different for each function definition is performed. The operation of 2 cannot be canceled. As a result, if an error occurs in the execution order of the program, the correspondence between the first value and the second value is likely to change, so whether or not the program in the function definition has been operated normally. Can be confirmed.

  In the process execution device 10, the CPU 11 outputs a signal for resetting the process for executing the main program 13 as an output when the correspondence between the first value and the second value is not a predetermined relationship. .

  According to such a processing execution device 10, when the correspondence between the first value and the second value is not a predetermined relationship, that is, when the program execution status is abnormal, the main program 13 is The process to be executed can be reset.

[Other Embodiments]
Embodiments of the present invention are not limited to the above-described embodiments, and can take various forms as long as they belong to the technical scope of the present invention.

  For example, in the above-described embodiment, “1” is added to t1 or t2 as the first operation, and “P” is added to t1 or t2 as the second operation. Arbitrary calculations such as these may be performed. Further, when checking the correspondence relationship between the first value and the second value, it is only necessary to check whether or not the correspondence relationship corresponds to these arbitrary calculations in the evaluation process.

  For example, when t1 or t2 is multiplied by “2” as the first operation, the evaluation process may check whether t1 is twice or 0.5 times t2.

  DESCRIPTION OF SYMBOLS 1 ... Execution condition monitoring apparatus, 10 ... Processing execution apparatus, 11 ... CPU, 12 ... Clock, 13 ... Main program, 14 ... Monitoring program, 15 ... Storage area, 21 ... Watch dock circuit.

Claims (5)

A program execution status monitoring device for monitoring whether a monitoring target program executed in a computer is normally executed,
As part of the process of the monitoring target program, it is updated at the latest time of the first value recorded in the first recording area and the second value recorded in the second recording area in advance. The first new value, which is a value obtained by performing the first operation for the correspondence relationship with the value to satisfy the predetermined condition, is updated at the most recent time of the first value and the second value. First updating means for updating a value that has not been performed;
An operation value generating means for generating an operation value obtained by performing a second operation on the first new value as part of the process of the monitoring target program;
As a part of the processing of the monitoring target program, when the monitoring target program is executed in a normal order, the first value or the first value not updated by the first updating unit after the processing by the first updating unit or A process of updating a second value, wherein the second new value, which is a value obtained by performing an operation that cancels the first operation and the second operation with respect to the operation value, A second updating means for updating a value not updated at the latest time among the value of 1 and the second value;
As a process different from the monitoring target program, it is repeatedly determined whether or not the correspondence relationship between the first value and the second value is a predetermined relationship, and an output corresponding to the determination result is performed. Correspondence determination output means;
A program execution status monitoring apparatus comprising: In the program execution status monitoring device according to claim 1,
The first updating unit, the operation value generating unit, and the second updating unit are provided as a plurality of sets, and
The operation value generation means generates an operation value by performing a second operation specific to the set to which the first update means belongs to the first new value,
The second update unit reads the latest one of the operation values excluding the operation value that has already been read, and the operation value generation unit to which the second update unit belongs is performed on the operation value. The program execution status monitoring apparatus, wherein the second new value is calculated by performing a second operation and an operation that cancels the first operation. In the program execution status monitoring apparatus according to claim 1 or 2,
The first update means calculates the first new value in the first half of the function definition in the monitoring target program,
The program execution status monitoring apparatus, wherein the second update means calculates the second new value in a second half of a function definition in which the first update means calculates a first new value. In the program execution status monitoring apparatus according to claim 1 or 2,
The correspondence determination output means outputs a signal for resetting the process of executing the monitoring target program as an output when the correspondence between the first value and the second value is not a predetermined relationship. A program execution status monitoring device characterized by:   An execution status monitoring program for causing a computer to function as each means constituting the program execution status monitoring device according to any one of claims 1 to 4.