JPH041831A - Monitor system for program runaway - Google Patents

Abstract

PURPOSE:To automatically restart a system operation with no system down despite the stop of a program operation by deciding the abnormality of a started task if the start information including a flag showing a normal state is not received from the started task even if a fixed time is passed after a start request is received. CONSTITUTION:The time data on a started task 202 registered in a control table 2 are counted before the task 202 is started. Then the normal or abnormal state of the task 202 is decided according to a fact whether the time needed for a start request of a starting task 203 through the reception of the start information of the task 202 is less or more than a fixed time. If the task 202 is abnormal, a reset signal RESET is produced by a CPU reset circuit 3. Thus the abnormality of the task 202 for application is immediately detected and a CPU 10 is reset even if only the interruption routine set up by an OS 200 and the reset routine set up by a timer 30 are normal. Then a monitor system is started.

Description

[Detailed Description of the Invention] (Summary) This invention relates to a program runaway monitoring method that monitors the execution of a computer program and detects when it is not executed normally and becomes abnormal.
Even if the system goes down and the only way to restore the system is to reset the CP[l manually from outside,
With the aim of providing a program runaway monitoring method that can automatically restart the system, flags indicating whether each application task is normal or abnormal are attached to the internal memory of a real-time system controlled by the CPU. It is equipped with means for sending/receiving and detecting additional data, a management table for writing time data necessary for starting each task, and a CPU reset circuit that generates a signal to reset the CPU in the event of an abnormality. Before starting the optical task, the management data necessary for starting is registered in a management table, and when the starting task is started, the time data in the management table is counted by the output of the flag detector, and the starting task is If a startup notification with a flag indicating normality does not arrive from the startup light task to be started even after a certain period of time has passed since the task startup request, the startup light task is assumed to be abnormal and the CPU reset circuit is generated. Signal RESET! The CPU is configured to be reset from this.

[Industrial application field]

The present invention relates to a program runaway monitoring system that monitors the execution of a computer program and detects when it is not executed normally and becomes abnormal.

A computer IJ installed in an unmanned center and remotely controlled from a manned station, like a wireless and transmission monitoring and control device? il's real-time system does not store it in its internal memory.
The system operates by executing a unique program called firmware, generally called a microprogram, but it is not allowed to cause the system to stop working, and even in the worst case, the firmware must automatically restart the system by itself. . Therefore, it is desired that the firmware installed in such a device has a function of constantly checking its own operation and restarting the system by itself if an abnormality is detected.

[Prior art] In a real-time system controlled by a computer CPU,
Conventionally, a timer, the so-called -atch Dog Timer, or WDT, was installed to monitor the execution of a program using hardware, and if the timer WDT is not re-cented within a certain period of time by a program installed in the internal memory, it is determined that the program is abnormal. Based on the hardware, CP
The operation of U is forcibly stopped to prevent any negative impact on the system.

The conventional program runaway monitoring method uses watchdog timers WDT and IQQ controlled by the CPU 10 having a configuration as shown in the block diagram of FIG. timer D within a certain period of time due to an interrupt.
By resetting the T100 counter value, the program was determined to be normal and was monitored.

In this case, to reset the timer DT 100,
Operating System of internal memory 20
stem) 20o from the external circuit 300, or the task 20.stem created for reset. There was a reset routine that was reset by periodic activation from .

Note that 0320° of the internal memory 20 is the external circuit 300.
Interrupt and reset tasks from 203. In response to a control request from each task such as the application tasks 202 and 203, execution control such as starting and stopping of the corresponding task is performed based on stored data.

[Problems to be Solved by the Invention] However, the tasks 202, 20 . If the processing program goes out of control, if 0820° is normal, the watchdog timer WDT 100 will be activated by an interrupt from the external circuit 300.
It is possible to reset. Therefore, if the processing program of the application task 202 goes out of control and the system goes down, the system will become permanently inoperable unless the application task 202 can detect the abnormality and restart itself.

Therefore, if 03200 of the internal memory 20 is normal or only the periodic startup routine from the reset task 20 is normal, but the program of the application task 202 is abnormal, the system will go down permanently and There was a problem that the only way to recover the system was to reset the CPU 10. The problem of the present invention is to solve even such a case.

The purpose of the present invention is to provide a program runaway monitoring method that can automatically restart a system.

[Means to solve the problem]

This task uses a conventional watchdog timer DT 100 controlled by CPIj 10 and uses internal memory 2.
The watchdog timer DT 1 is used as a program runaway monitoring method that has the same function as the conventional monitoring method that confirms the normality of the program by resetting the timer DT within a certain period of time according to the program stored in the watchdog timer DT 1.
Instead of 00, as shown in the principle diagram of FIG. 1 showing its basic configuration, each normal/normal/
A means 11 for adding and transmitting a flag indicating an abnormality, a means 12 for receiving and detecting, a management table 2 for writing time data necessary for starting each task, and a CPU 1 when an abnormality occurs.
It is equipped with a CPU reset circuit 3 that generates a signal RESET for resetting 0, and before the activation source task 203 activates the activation source task 202, management data necessary for activation is registered in the management table 2, and the management data necessary for activation is registered in the management table 2. Original task 20
3 by the detection signal of the flag detector 12 when activated.

The time data of the management table 2 is counted, and if a startup notification with a flag indicating normality does not come from the startup task 202 to be started even after a certain period of time has passed since the startup request of the startup task 203, the startup is started. The signal RES generated by the reset circuit 3 assumes that the original task 202 is abnormal and performs the corresponding CP.
This problem is solved by the program runaway monitoring method of the present invention, which resets the CPU 10 by ET.

[Operation] In the great invention, instead of the conventional watchdog monitoring based on 0320° stored in the internal memory 20 of the CPU 10, each task is added to each of the application tasks 201 to 20° by a flag adder II. A flag indicating normality/abnormality of is detected by a detector 1t, and monitoring is performed by a clock count value of a counter program whose start of counting is controlled by a detection signal from the detector. That is, the initiating task 20. Before starting the activation source task 20z, it counts the time data of the activation source task 202 registered in the management table 2, and calculates the time from the activation request of the activation source task 203 to the arrival of the activation notification of the activation source task 202. The normality/abnormality of the activation source task 202 is determined depending on whether the elapsed time is within a certain period of time or exceeds a certain period of time. If the activation source task 202 is abnormal, the CPU reset circuit 3 generates a reset signal RESET to reset the CPU 10.

Restart the system. Therefore, even if only the interrupt routine by 05200 and the reset routine by timer 30 are normal, if there is an abnormality in the application task 202, it is possible to immediately detect it, reset the CPU 10, and restart the system. So the conventional problem is solved.

〔Example〕

FIG. 2 is an arrangement of management tables for explaining the operation of the program runaway monitoring system of the embodiment of the present invention in the principle diagram of FIG. 1, and FIG. 3 is an arrangement of management tables for explaining the operation of the embodiment of the present invention. FIG. 3 is an access flow diagram of the management table of FIG.

In the management table array of FIG. 2, the first running flag j indicates whether this array is valid or invalid. It becomes a master when a startup request is made by another task (starting task), and turns OFF when a startup notification arrives from the starting task. The counter program in the monitoring routine 200 counts clocks only when this flag is ON.

``The activation source task number, j'' indicates the number of the task to be activated, [the activation source task No., , 3 represents the number of the task to be activated, and the ``activation timer value'' is
The "monitoring timer" indicates the predetermined startup time when the startup task should start, and the "monitoring timer" indicates the elapsed time since the "execution timer" was set to ON. If, for example, 10 times the startup time of the startup task has elapsed, no startup notification with a flag indicating normality has arrived from the startup task, and the "Running flag" does not turn OFF, the startup task is abnormal. It is assumed that

In FIG. 1, one of the application tasks in the internal memory 20, for example task 20. becomes the activation source task, and when starting another task such as task 202, before starting the task, the monitoring routine 200 is called (subroutine call), and the management table 2 contains information about the activation of the destination task 202. Register the necessary data. The monitoring routine 200 based on the management table 2 is executed by the starting task 2.
Apart from the subroutine call from 03, it is directly activated by a periodic interrupt from the timer 30, and the value of the "monitoring timer" in the management table 2 is counted by a counter program to detect a predetermined elapsed time (timeout). At this time, if the monitoring routine 200 does not receive a startup notification from the startup task 202 within the specified time,
The execution flag -1 continues to be ON, and the execution destination task 20
2 is considered to be abnormal, the CPU reset circuit 3 generates a reset signal RESET, and executes reset processing for the CPU 10.

Although not shown, the CPU reset circuit 3 is a circuit that generates a reset pulse RESET at the reset terminal of the CPU 10 at the timing when data is written to a register, for example.

[Effects of the Invention] As explained above, according to the present invention, the CPU III?
In the H real-time system, if the application program in the internal memory goes out of control.

It becomes possible to quickly and accurately detect the runaway including the program operation order, reset the CPU, and restart one system operation. Therefore, even if the firmware installed in a device installed in an unattended location should run out of control, the system will not go down and system operation will be automatically restarted. This has the effect of improving the reliability of the software. Furthermore, since a simple flag detection and management table can be used in place of the conventional watchdog timer, which has a large circuit scale, this has the effect of simplifying the program runaway monitoring circuit.

[Brief explanation of the drawing]

Fig. 1 is a principle diagram showing the basic configuration of the program runaway monitoring system of the present invention, Fig. 2 is an arrangement diagram of a management table for explaining the operation of an embodiment of the present invention, and Fig. 3 is an embodiment of the present invention. FIG. 4 is a block diagram of a conventional program runaway monitoring system. In the figure, 11 is a flag adder, 12 is a flag detector, 2 is a management table, 3 is a CPU reset circuit, 10 is a CPU, 20 is an internal memory, 20° is an O3, 20,...
20z and 203 are tasks, 30 is a timer, and 200 is a monitoring routine.

Claims (1)

[Claims] Means for detecting application tasks (20_1 to 20_3) installed in an internal memory (20) of a real-time system controlled by a CPU (10) by adding flags indicating their normality/abnormality to the flags and sending/receiving them. (1_
1, 1_2), a management table (2) that writes the time data necessary for starting each task, and a management table (2) that writes the time data necessary for starting each task, and
CP that generates a signal (RESET) to reset 0)
Equipped with a U reset circuit (3), the activation source task (20_3
) before starting the startup task (20_2), registers the management data necessary for startup in the management table (2), and when the startup task (20_3) starts, the flag detector (1_2) The management table (2) is created by the output of
), and if a startup notification with a flag indicating normality does not come from the startup task (20_2) that should be started even after a certain period of time has passed since the startup request of the startup task (20_3). A program runaway monitoring system characterized in that the CPU (10) is reset by a signal (RESET) generated by the CPU reset circuit (3), assuming that the startup task (20_2) is abnormal.