JP2000339197A - Program execution abnormality detecting device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To preliminarily prevent the malfunction or runaway of an information processor generated when each sub-routine to be executed is not executed through in a normal sequence in the prescribed processing process of a control program. SOLUTION: In an electronic control unit (CPU) 3 to which this program execution abnormality detecting device is applied, information indicating a sequence in which plural sub-routines to be expected should be executed is stored in a second memory 3d of a memory 3b, and whether or not the sub-routine to be executed the next is proper is judged by a judging part 3g of the CPU 3 based on the stored contents of the second memory part 3d each time the execution of each sub-routine by a control processing part 3f is completed.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a program execution abnormality detecting device for detecting an abnormality in the execution state of a program, and more particularly to an abnormality in the execution state of a control program for an on-vehicle electronic control unit.

[0002]

2. Description of the Related Art FIG. 3 is a block diagram showing a conventional structure of a door lock control system to which the present invention is applied.
In such a control system, an information processing device (here, the on-vehicle electronic control unit 3) is controlled by an electric device to be controlled (here, the door lock) based on the input content from the input means (here, the door lock switch 1). The motor 5) is controlled, and the C of the electronic control unit 3 is controlled.
The PU 3a controls the door lock motor 5 based on a predetermined control program.

In such a control program, generally,
As shown in FIG. 4, a control process is performed by repeating a predetermined round process (predetermined process). In each round process, a plurality of subroutines (here, subroutines SR1 to SR4) are executed. It is supposed to be. Here, the subroutine SR1 performs a process of reading the input content from the door lock switch 1, and the subroutine SR2 performs the process of reading the door lock switch 1.
Is to perform a filtering process to determine whether the input content from is not noise but valid.
The subroutine SR3 performs control content determination processing for determining the control content of the door lock motor 5 corresponding to the input content from the door lock switch 1. The subroutine SR4 directs the determined control content to the door lock motor 5. And output processing for controlling the drive of the door lock motor 5.

In such an electronic control unit 3, as shown in FIG. 4, the electronic control unit 3 is activated, and when the initial processing is performed in step ST1, the subsequent steps ST2 to ST5 are repeated.
Subroutines SR1 to SR4 are repeatedly executed, and control processing of the door lock motor 5 is performed based on the input content from the door lock switch 1.

By the way, in the CPU 3a of the electronic control unit 3 which executes such a control program, while the control program is being executed, the recorded contents of the program counter which indicates the execution position (current position) of the program are stored in the CPU 3a. The program execution position may be moved to an unexpected wrong position without ending the subroutines SR1 to SR4 normally due to the influence of noise or the like. In such a case, runaway of the CPU 3a (electronic control unit 3) may be caused.

For example, as shown in FIG. 5, in the loop processing, when step ST 4 for executing subroutine SR 2 is not executed after execution of subroutine SR 1 in step ST 2 and step ST 4 is executed. Since the subroutine SR2 is not executed, there is a possibility that various information in the control program may be inconsistent, and a malfunction or a runaway may occur. Further, in the round process, the subroutines SR1 to SR4 may be executed unnecessarily and redundantly, or may be executed in an incorrect order, which may also cause a malfunction or the like.

[0007]

However, according to the above-mentioned prior art, each subroutine SR to be executed in each cycle of the control program which is repeatedly executed.
Since no countermeasures have been taken for cases in which steps 1 to SR4 are not executed, are unnecessarily duplicated, or are executed in an incorrect order, the predetermined subroutines SR1 to SR4 are There is a problem that it is not possible to prevent malfunction or runaway of the electronic control unit 3 caused by not being executed in order.

In view of the above problems, the present invention prevents malfunctions or runaway of information processing equipment caused by the fact that subroutines to be executed are not executed in a regular order within a predetermined processing step of a control program. It is an object of the present invention to provide a program execution abnormality detection device that can prevent it before it happens.

[0009]

A technical means for achieving the above object is an information processing apparatus for performing a predetermined information processing by executing a program having a plurality of subroutines to be executed in a predetermined processing step. A program execution abnormality detection device for detecting an abnormality in the execution state of a program in the information processing apparatus, which is to be executed immediately before each of the subroutines to be executed in the processing process of the program First storage means for storing the immediately preceding subroutine information indicating the subroutine for each of the subroutines, second storage means provided in the information processing device, and provided in the information processing device; When each of the subroutines is executed in a processing step, a call subroutine indicating the executed subroutine The chin information is stored in the second storage means, and before the subroutine next to the executed subroutine is executed, the subroutine stored in the first storage means is executed. The contents of the corresponding immediately preceding subroutine information and the second
Is compared with the contents of the call subroutine information corresponding to the subroutine executed immediately before and stored in the storage means, and if the contents of the two are different, it is determined that the program execution state is abnormal. Determining means.

[0010]

FIG. 1 is a block diagram of a door lock control system to which a program execution abnormality detecting device according to an embodiment of the present invention is applied, and FIG. 2 is a control program of the door lock control system of FIG. 6 is a flowchart showing an execution process of the process. In FIGS. 1 and 2, parts corresponding to those in FIGS. 3 and 4 are denoted by the same reference numerals, and description thereof is omitted.

As shown in FIG. 1, the electronic control unit 3 executes a predetermined control program to control the driving of the door lock motor 5 based on the input from the door switch 1; And a memory 3b such as a ROM and a RAM in which control data and the like are recorded. The control program has a plurality of subroutines SR1 to SR4 as described above, similarly to the control program shown in FIG. 4, and the plurality of subroutines SR1 to SR4 are repeatedly executed as shown in FIG. Control is performed.

The memory 3b is provided with first to third memory units 3c to 3e. The first memory 3c stores a control program and control data for a control processing unit 3f of the CPU 3a, which will be described later, to drive and control the door lock motor 5 based on the door lock switch 1.
The second memory unit (first storage unit) 3d shows subroutines SR1 to SR4 to be executed immediately before each of the subroutines SR1 to SR4 to be executed in each cycle of the control program that is repeatedly executed. The immediately preceding subroutine information is stored in association with each of the subroutines SR1 to SR4. In the third memory unit (second storage unit) 3e, call subroutine information indicating each subroutine SR1 to SR4 actually executed in each round process is temporarily recorded by a determination unit 3g of the CPU 3b described later.

The CPU 3a is provided with a control processing section (control processing means) 3f, a determining section (determining means) 3g, and an error processing section (error processing means) 3h.

The control processing unit 3f repeatedly executes subroutines SR1 to SR4 included in the control program based on the control program and the control data stored in the first memory unit 3c of the memory 3b, thereby controlling the door lock switch 1 The drive control of the door lock motor 5 is performed based on the input contents from.

When each of the subroutines SR1 to SR4 is executed by the control processing unit 3f in each of the repeatedly executed rounds of processing, the determination unit 3g recognizes the executed subroutines SR1 to SR4 and recognizes the executed subroutine SR1 to SR4. Call subroutine information indicating SR1 to SR4 is temporarily stored in the third memory unit 3e of the memory 3b, and before the next subroutine SR1 to SR4 of the executed subroutine SR1 to SR4 is executed, 2 recognizes the subroutine SR1 to SR4 to be executed stored in the memory unit 3d, and stores the contents of the immediately preceding subroutine information corresponding to the subroutine SR1 to SR4 to be executed and the third memory unit 3
e, the subroutine SR executed immediately before
The contents of the call subroutine information corresponding to 1 to SR4 are compared, and if the contents of the two are different, it is determined that there is an abnormality in the execution state of the program. Determines that the execution state of the program is normal. Note that the storage content of the third memory unit 3e is updated each time the determination unit 3g performs a writing process.

The error processing unit 3h performs predetermined error processing such as resetting the control processing unit 3c in response to the determination unit 3g determining that there is an abnormality.

In this embodiment, the first configuration (CPU 3a and memory 3b) for executing the control program and controlling the door lock motor 5 includes a second configuration for detecting an abnormality in the execution state of the control program. 2 (the determination unit 3g, the error processing unit 3h, the second and third memory units 3
d, 3e) are integrated, but the whole or a part of the second configuration is made a separate configuration without being integrated, and a dedicated C that bears all or a part of the second configuration
A PU and a memory may be provided. In the present embodiment, the third memory unit 3e is provided in the memory 3b.
The register in 3a may be used as the third memory unit 3e.

Next, the process of executing the control program of the electronic control unit 3 will be described with reference to FIG. When the electronic control unit 3 is started, the process proceeds to step ST1. Step ST1 is composed of step ST1a and subsequent step ST1b. When a predetermined initial process is performed in step ST1a, the process proceeds to step ST1b, and the determining unit 3g determines that the calling subroutine information indicating the subroutine SR4 is the third subroutine information. The information stored in the memory unit 3e, the process proceeds to step ST2, and thereafter, the round process including steps ST2 to ST6 is repeated, so that the abnormality in the execution state of the control program is detected and the input contents from the door lock switch 1 are detected. , The door lock motor 5 is controlled.

Each of steps ST2 to ST5 is performed in step S
T2a to ST5a followed by steps ST2b to S2
T5b, and subsequent steps ST2c to ST5
It consists of three steps c.

In the first steps ST2a to ST5a,
The determination unit 3g performs a process of determining whether there is a program execution abnormality. In this determination process, the steps ST2 to ST2
In step ST5, the subroutine SR1 to SR4 actually executed by the control processing unit 3f is recognized by the determination unit 3g, and the immediately preceding subroutine information corresponding to the recognized subroutine SR1 to SR4 is read from the second memory unit 3d and called. The subroutine information is read from the third memory unit 3e.

At this time, the immediately preceding subroutine information is
If the subroutines SR1 to SR4 to be actually executed in the steps ST2 to ST5 are appropriate, the subroutine SR according to the normal execution order which should have been executed immediately before the subroutines SR1 to SR4
1 to SR4 are shown. On the other hand, the called subroutine information indicates the subroutines SR1 to SR4 actually executed immediately before the subroutines SR1 to SR4 to be actually executed in steps ST2 to ST5.

Then, the subroutine SR1 to SR4 indicated by the subroutine information immediately before the judgment unit 3g,
Subroutine SR1 indicated by the calling subroutine information
It is determined whether or not SR4 matches with subroutine SR4, thereby determining whether or not subroutine SR1 to SR4 to be executed in steps ST2 to ST5 is appropriate.

For example, step ST2 of step ST2
In a, the content of the call subroutine information is the subroutine S which is to be actually executed in step ST2.
Whether the subroutine SR4 indicated by the immediately preceding subroutine information corresponding to R1 is the subroutine SR4, that is, the subroutine actually executed immediately before the subroutine SR1 to be actually executed is the initial processing in step ST1a or the subroutine SR4 in step ST5b. Is determined. At this time, the subroutine SR4
When the subroutine SR1 is about to be executed next to the subroutine SR3, for example, the contents of the call subroutine information do not match the subroutine SR4.

If the determination result in steps ST2a to ST5a is affirmative, the process proceeds to step ST2.
b to ST5b, the control processing unit 3c executes the above-described normal processing contents of the corresponding subroutines SR1 to SR4. When the execution of the normal processing contents is completed, the processing proceeds to steps ST2c to ST5c. If the determination result is negative, the process proceeds to step ST6, where a predetermined error process is performed by the error processing unit 3h.

In steps ST2c to ST5c, the subroutine information indicating the subroutines SR1 to SR4 executed in steps ST2 to ST5 is recorded in the third memory unit 3e by the judging unit 3g.
Proceeding to T2 to ST5, the last step ST5 of the round process
Is completed, the process returns to the initial step ST2, and similarly, steps ST2 to ST5 are cyclically repeated.

In the error processing in step ST6, for example, the processing operation of the control processing unit 3f is temporarily reset (initialized) in order to prevent a malfunction or the like. One cycle processing is repeated.

As described above, according to the present embodiment, in each round processing repeatedly executed by the control program,
The subroutines SR1 to SR4 to be executed are not executed, or are unnecessarily duplicated,
Alternatively, when they are executed in the wrong order, these execution failures are detected by the check of the determination unit 3g performed before executing each of the subroutines SR1 to SR4, and therefore, the execution failure is executed. It is possible to reliably detect that all of the subroutines SR1 to SR4 to be executed have not been properly executed.
Malfunction or runaway of the electronic control unit 3 due to the execution failure of R1 to SR4 can be prevented.

In this embodiment, the case where the present invention is applied to a door lock control system that controls the door lock motor 5 has been described, but the present invention is not limited to this.

[0029]

According to the first aspect of the present invention, in a predetermined processing step of a program, a subroutine to be executed is not executed, is unnecessarily duplicated, or is incorrectly executed. If the subroutines to be executed are executed in the normal order, the execution failures are detected by checking the judgment means before executing each subroutine. Thus, it is possible to reliably detect that the subroutine has not been executed, and to prevent a malfunction or a runaway of the information processing apparatus due to a poor execution of these subroutines.

[Brief description of the drawings]

FIG. 1 is a block diagram of a door lock control system to which a program execution abnormality detection device according to an embodiment of the present invention is applied.

FIG. 2 is a flowchart showing an execution process of a control program of the door lock control system of FIG.

FIG. 3 is a block diagram showing a conventional configuration of a door lock control system as an application example of the present invention.

FIG. 4 is a flowchart showing an execution process of a control program of the door lock control system of FIG. 3;

FIG. 5 is a diagram showing a case where a subroutine is not erroneously executed in a process of executing the control program of FIG. 4;

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Door lock switch 3 Electronic control unit 3a CPU 3b Memory 3c-3e 1st thru / or 3rd memory part 3f Control processing part 3g Judgment part 3h Error processing part 5 Door lock motor

 ────────────────────────────────────────────────── ─── Continued on the front page (72) Inventor Takenari Nakano 1-7-10 Kikuzumi, Minami-ku, Nagoya-shi, Aichi F-term in Harness Research Institute, Inc. (Reference) 5B042 GB08 JJ13 JJ29 LA20 MC25

Claims (1)

[Claims] 1. A program execution abnormality detection device for detecting an abnormality in the execution state of a program in an information processing device that performs predetermined information processing by executing a program having a plurality of subroutines to be executed in a predetermined processing step. The subroutine information immediately before the subroutine, which is provided in the information processing device and indicates the subroutine to be executed immediately before the subroutine to be executed in the processing process of the program, is associated with each subroutine. A first storage unit for storing the information, a second storage unit provided in the information processing device, and a second storage unit provided in the information processing device. Call subroutine information indicating the subroutine that has been stored in the second storage means. Before the subroutine next to the executed subroutine is executed, the contents of the immediately preceding subroutine information corresponding to the subroutine to be executed stored in the first storage means and the second storage means Determining means for comparing the contents of the call subroutine information corresponding to the subroutine executed immediately before and stored in the subroutine, and determining that there is an abnormality in the execution state of the program when the contents of the two are different. A program execution abnormality detection device, comprising: