JP2017130068A - Programmable controller system, development support device thereof and target device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To inspect presence/absence of double writing from different programs.SOLUTION: A development support device 10 detects a specific command in a program following to processing for compiling a program (source code 21) and converting the program into a machine word object 24, then registers information indicating the specific command in a monitoring object code table 25. A target device 30 determines whether or not a command which is executed currently is the specific command during execution of the machine word object 24, based on the monitoring object code table 25, then acquires and records storage data of a specific register (AX register) at a specific command execution timing.SELECTED DRAWING: Figure 1

Description

  The present invention relates to debugging a program of a programmable controller.

  The program of the programmable logic controller (PLC) is an arbitrary control target control program or the like. The user arbitrarily creates a source code (source program) of this program on the development support apparatus. The generated source code is compiled by the compiler of the development support apparatus and converted into an execution format (machine language object) in the PLC. Along with this, an arbitrary memory area of the PLC is assigned to each variable in the source code.

  In engineering a programmable logic controller (PLC), the user may manually perform memory address allocation of the above variables in order to link with input / output devices and a higher-level monitoring screen. In many cases, the compiler automatically allocates memory for variables. However, for some reason, a human may manually allocate a desired memory address. With regard to this manual memory allocation, for example, when a memory address is assigned to an array A having a plurality of elements corresponding to values that i can take, such as an array A [i] (i is a variable / index), the number of elements In some cases, an address range corresponding to the address is specified. Such an array A can also be regarded as a kind of variable.

  Note that, depending on the array A [i] (i is a variable / index), the memory address to be accessed may be determined / changed at any time during operation (depending on the value of the variable i at that time). is there.

  The address ranges may be assigned to a plurality of programs, respectively, and the plurality of address ranges may be assigned so as to partially overlap each other. This may be accidentally duplicated or may be intentionally duplicated. In the case of intentional duplication, the user may determine that there is no problem in system operation even if there is duplication.

  When the above-described manual memory allocation by the user is performed, if the user mistakes the memory allocation, a situation may occur in which the same memory area is repeatedly accessed (written or the like) from different programs while the program is being executed by the PLC. As a result, there arises a problem that the operation of the system becomes unstable.

  As a countermeasure against the above problem, generally, a program (source code) created by a user is statically analyzed, and the above “abnormality of accessing (writing to, etc.) the same memory redundantly from different programs” Static analysis is performed to check for presence. However, in this static analysis, there is a problem that the inspection cannot be performed, for example, when processing including “a memory address to be accessed is determined / changed at any time during operation” related to an array, a pointer, and the like is included.

  As a conventional technique related to static analysis, for example, Patent Document 1 is known. However, Patent Document 1 does not describe dynamic inspection. In addition, regarding the manual specification of the address range relating to the array A [i] or the like, whether or not a plurality of address ranges overlap each other can be detected by static analysis. However, in an actual operation, not all addresses within the address range are accessed. Therefore, even when a plurality of address ranges overlap each other, it is not known whether or not a situation (duplicate writing or the like) occurs in which the same memory area is accessed from different programs. This is something that cannot be understood unless the program is actually run.

As a conventional technique for dynamically detecting an abnormality, for example, a technique described in Patent Document 2 “a program is executed by a controller, an abnormality is detected and trace data is recorded” is known.
However, the technique disclosed in Patent Document 2 cannot detect double writing related to the above-described case where “the memory address to be accessed is determined / changed at any time during operation”.

For example, the prior art of Patent Document 3 is known.
Patent Document 3 discloses a conventional technique in which a source code is first converted into an intermediate code by a front end compiler, and this intermediate code is converted into a machine language object by a back end compiler.

  In the invention of Patent Document 1, the front-end compiler creates a first correspondence table that is correspondence information between source code and intermediate code, and the back-end compiler creates a second correspondence table that is correspondence information between intermediate code and machine language object. To do.

JP 2004-171064 A JP-A-9-325900 JP 2007-188366 A

  As described above, in the conventional PLC program, for example, with respect to the process of “the memory address to be accessed is determined / changed at any time during operation” related to, for example, an array and a pointer, It was not possible to check for the presence of “abnormality such as redundant access (writing, etc.)”.

  An object of the present invention is to develop a programmable controller system capable of inspecting whether or not there is a duplicate access from different programs even when the controller program includes a process in which the memory address to be accessed is determined / changed at any time during operation. It is to provide a support device and a target device.

  A programmable controller system of the present invention is a programmable controller system having a development support apparatus that performs a compile process for converting a source code of one or more programs into a machine language object, and a target apparatus, and has the following configuration.

The development support apparatus has the following means.
Specific instruction detection means for detecting a specific instruction during the compilation process of each program;
Specific information generating means for generating specific information that is information related to the detected specific command;
Transfer means for transferring the specific information to the target device.

  The target device records the memory address of the access destination at the time of execution of the specific instruction in association with the executed program based on the specific information as each program of the machine language object is executed. Pre-recording means is provided.

  According to the programmable controller system of the present invention, the development support device thereof, the target device, and the like, even if the controller program includes a process in which “the memory address to be accessed is determined / changed at any time during operation”, Can check for duplicate accesses.

It is a block diagram of the programmable controller system of this example. It is a figure which shows the example of a screen for the program description displayed on a development assistance apparatus. It is an example of an intermediate language (intermediate code) generated by compiling a source code written by a user. FIG. 4 is an example of memory allocation related to compilation into the intermediate code of FIG. 3. FIG. (A), (b) is a figure which shows the specific example of the production | generation process of the monitoring object code table. This is a specific example of “write address record table (model)” 23. (A) and (b) are specific examples of the write address record table 42. It is a figure which shows the program execution management function of a target apparatus.

Embodiments of the present invention will be described below with reference to the drawings.
FIG. 1 is a configuration diagram of the programmable controller system of this example.
In this description, the programmable controller may be simply referred to as a controller, or may be referred to as a PLC or the like. In addition, although PLC is shown here as an example of a control apparatus (controller), not only this example but DCS (Distributed Control System) etc. may be sufficient, for example. This system manages programs of control devices such as PLC and DCS.

  The programmable controller system of the example shown in FIG. 1 includes a development support apparatus 10, a “simulator or PLC” 30, and the like. The development support apparatus 10 generates a PLC program (control program or the like) in the “simulator or PLC” 30 and transfers it to the PLC. When the PLC executes this program, the operation (control execution of some control target) is performed.

  However, this method is related to the check of the above-mentioned program performed before the operation, and this check processing may be performed by the PLC or a simulator which is a computer device that simulates the function / operation of the PLC. Good. Thus, as described above, the “simulator or PLC” is used. And in the check process of this method, it is possible to detect the presence or absence of duplicate access from different programs even when the controller program includes a process in which the memory address to be accessed is determined / changed at any time during operation. It becomes.

  Note that the “simulator or PLC” 30 may be referred to as a target device 30. In other words, it can be said that the target device 30 is a simulator or a PLC. Further, in the “simulator or PLC” 30, when it is particularly desired to indicate a PLC, it may be referred to as a PLC 30. Similarly, in the “simulator or PLC” 30, when it is particularly desired to indicate a simulator, it may be referred to as a simulator 30.

  From the above, instead of the PLC (programmable controller), a controller in the DCS may be used, and both may be collectively referred to as a control device without being particularly distinguished. That is, the programmable controller is an example of a control device. From this, it can also be said that the target device 30 is a “simulator or control device”.

  The development support apparatus (loader) 10 includes an interface function unit 11 (including an editor function) that allows a user to create a source code 21 of an arbitrary PLC program. The interface function unit 11 is a well-known existing function, and is not particularly described here.

  The PLC program is a control program or the like that causes the PLC 30 to execute control of an arbitrary control target. In many cases, a plurality of programs (POU, etc.) are created and each program is repeatedly executed at each fixed period. Since the program is repeatedly executed, it does not matter that a certain program repeatedly accesses an arbitrary memory area (rather, it is a natural operation). However, it can be a problem if another program accesses this memory area. For this reason, such a duplicate access (such as double writing) must be detected by the above check process. When duplicate access is detected, for example, a program (source code) is corrected.

  The development support apparatus (loader) 10 also includes compiler function units (a front-end compiler 12 and a back-end compiler 13) that convert the source code 21 created by the user into a machine language object 24 that operates on the target apparatus 30. Have. In this method, the source code 21 is converted into an intermediate language 22 (intermediate code) and then converted into a machine language object 24. The intermediate code is an existing code described in, for example, Patent Document 3 described above, and is not particularly described here.

  First, the front end compiler 12 analyzes the source code 21 and converts it into an intermediate language 22. Subsequently, the back-end compiler 13 converts the intermediate language 22 into a machine language object 24 that operates on the target device 30. Such a conversion function itself into the intermediate language 22 and the machine language object 24 is a well-known existing function and will not be particularly described here.

  As described above, the development support device 10 supports the user in creating the source code 21 of an arbitrary control program, or a format (machine language object) that can be executed by the PLC 30 by compiling the source code 21. 24) and the like.

  Conventionally, the compiler function unit assigns an arbitrary memory address to each variable described in the source code 21 in accordance with the above compilation process. This memory address is an arbitrary address of a memory (not shown) provided in the target device 30 (particularly the PLC 30).

  Here, the compiler function unit (especially the back-end compiler 13) of this example detects a specific instruction (to be described later) along with the generation process of the machine language object 24, and based on this, the monitoring shown in FIG. The process etc. which produce | generate the object code table 25 are also performed. Further, the “write address record table (model)” 23 shown in the figure may also be generated, but this need not be generated.

  The generation of the monitoring target code table 25 and the like will be described in detail later. Generally, a specific instruction (monitoring target instruction) existing in the program is detected during the compiling process, and this monitoring target is detected. Information indicating an instruction is registered in the monitoring target code table 25. In this example, as will be described later, the monitoring target instruction is, for example, “an instruction to write (data) via a (specific) register” (also referred to as “an instruction to write by indirect addressing”). Although the instruction number of the monitoring target instruction is registered as information indicating the monitored instruction, the present invention is not limited to this example.

  From the above, the compiler function unit (especially the back-end compiler 13) of this example has a specific instruction detection function unit (not shown), a specific information generation function unit (not shown), and a transfer function, which will be described later. A part (not shown) or the like may also be considered. However, this is only an example, and these functional units (not shown) may be provided separately from the compiler functional units.

  Further, the development support apparatus (loader) 10 includes a communication function unit 14. For example, communication with the target device 30 can be performed by the communication function unit 14 via a communication line (not illustrated) or the like. Accordingly, for example, the compiler function unit (particularly, the back-end compiler 13) transfers the machine language object 24, the monitoring target code table 25, and the like generated by the above compilation process to the target device 30 via the communication function unit 12. to download. Further, the “write address record table (model)” 23 may also be downloaded to the target device 30, but is not limited to this example (it may not be downloaded).

  The target device 30 can communicate with the development support device (loader) 10 through the communication function unit 31, and thus receives the downloaded machine language object 24 and the like. Then, the received machine language object 24, the monitoring target code table 25, and the like are stored as the illustrated machine language object 41 and the monitoring target code table 43. This is stored in a predetermined storage area such as a memory (not shown) in the own apparatus.

  From the above, the machine language object 24 may be regarded as the machine language object 41, and the monitoring target code table 25 may be regarded as the monitoring target code table 43. In some cases, it may be written without. That is, for example, when the machine language object 24 is described, it may mean the machine language object 24 or the machine language object 41. The same applies to the monitoring target code table.

  The target device 30 has a program execution management function unit 32. When the target device 30 is a PLC, the program execution management function unit 32 executes the machine language object 41 during operation, and thus, The illustrated control target device is controlled.

  However, this method is related to the start of operation, and the program execution management function unit 32 in the PLC 30 controls the control target device (not shown) by executing the machine language object 41 as described above in the normal mode. However, in the case of a specific mode (referred to as a check mode), the program execution management function unit 32 executes a check process for detecting a program abnormality or the like as described below. For example, the user can designate either the normal mode or the check mode. Further, in the case of the simulator 30, there is no normal mode, and the simulator 30 may always operate in the check mode.

  In this example, it is assumed that the program execution management function unit 32 performs the above check process in the check mode. Although this check process will be described in detail later, generally, the write address record table 42 is generated by using the monitoring target code table 43 while executing the machine language object 41. For example, during the execution of the machine language object 41, it is determined at any time whether or not the currently executed instruction is a monitoring target instruction, and the memory address to be accessed when the monitoring target instruction is executed is indicated in the write address recording table. 42. The monitoring target instruction can be determined by referring to the monitoring target code table 43. The write address record table 42 is generated (completed) by performing the above check processing for each machine language object 41 of each of the plurality of programs.

The write address record table 42 may be generated based on the “write address record table (model)” 23, but is not limited to this example.
The program execution management function unit 32 may further determine whether or not there is a duplicate access (such as double writing) from different programs based on the generated write address record table 42. In particular, it is possible to determine whether or not there is a duplicate access in relation to the process of “the memory address to be accessed is determined / changed at any time during operation” related to the array, pointer, and the like. However, the present invention is not limited to this example, and instead of making such a determination, the generated write address record table 42 is simply displayed on the display so that the user can determine whether there is an abnormality. Good.

  The development support apparatus 10 is realized on a general-purpose computer such as a personal computer, and has a general configuration such as a personal computer in terms of hardware. That is, although not shown in particular, it has, for example, a CPU, a storage device such as a hard disk or a memory, and further includes a screen (display) 15 and an input device 16 (keyboard, mouse, etc.) shown in the drawing.

  A predetermined application program is stored in the storage device in advance. When the CPU executes the application program, various function units such as the interface function unit 11, compiler function units (front-end compiler 12 and back-end compiler 13), communication function unit 14, and various types (not shown) to be described later. A processing function unit is realized.

  The compiler function unit is divided into two parts, the front-end compiler 12 and the back-end compiler 13 here. However, the compiler function unit is converted into a machine language object 24 via the intermediate language 22 (intermediate code 22). It may be a compiler. In this case, it is not necessary to output (and temporarily hold) the intermediate code 22.

  Further, although not particularly illustrated, the compiler function unit includes each instruction of the intermediate code 22 (referred to as an intermediate language instruction) and each instruction of a machine language object (referred to as a machine language instruction) in accordance with the compilation process. An intermediate-machine correspondence table (not shown) that associates the data may be generated.

  For example, for each intermediate language instruction, an intermediate-machine association table (not shown) in which a machine language instruction group formed by converting the intermediate language instruction is associated with the intermediate language instruction is generated. . As an association method, information (instruction number or the like) indicating the position of each instruction on the program is used. For example, when the intermediate language instruction on the fifth line in the specific example of the intermediate language 22 shown in FIG. 3 to be described later is converted into the machine language instruction group on the 15th line to the 17th line in a machine language object (not shown), “5” and “15 to 17” are associated with each other.

  Here, for example, each line (one line) in FIG. 3 described later is regarded as one intermediate language instruction. The same applies to a machine language object (machine language instruction group), and each line of a machine language instruction group (not shown) is regarded as one machine language instruction. In general, one intermediate language instruction is often converted into a plurality of machine language instructions (that is, a machine language instruction group).

  The “simulator or PLC” 30 also includes an arithmetic processor such as a CPU / MPU (not shown), a memory, and the like, and a predetermined application program is stored in the memory in advance. When the arithmetic processor executes the application program, various functional units such as the communication functional unit 31 and the program execution management functional unit 32 and various processing functional units (not shown) described later are realized.

The user describes the source code 21 of an arbitrary program on the development support apparatus 10.
FIG. 2 shows a program description example.
FIG. 2 shows an example of a program description screen displayed on the development support apparatus 10.

  In the example shown in the figure, an array variable of the INT type and having five elements is declared, and a predetermined numerical value “10” is further added to the array A [i] (i = 0, 1, 2, 3, 4). A program for substituting is shown. Note that i in A [i] is a variable and is called an index or the like attached to the array. As described above, i is a variable that can take any of 0, 1, 2, 3, and 4.

Since the memory address to be accessed is determined / changed according to the value of the variable i at that time during program execution, the memory location to be accessed cannot be specified by the conventional technique.
As described above, there is a case where the user manually assigns the memory address of the variable as described above. Here, although not particularly illustrated, the user selects, for example, “6154 to 6158” for the array A [i]. ”Address range is specified. The compiler function unit generates, for example, the intermediate language shown in FIG. 3 in accordance with such designation. Although not specifically shown, it is assumed that processing related to determination / change of the value of the variable i is also described in the program.

FIG. 3 shows an example of an intermediate language (intermediate code) generated by the front-end compiler 12 by compiling the source code 21 described by the user.
FIG. 4 is an example of memory allocation related to compilation into the intermediate code of FIG.

Note that the above intermediate language generation and memory allocation mechanism is a technology realized by a general compiler, and therefore will not be described in detail.
Hereinafter, each intermediate language instruction of FIG. 3 will be briefly described.

Here, it is assumed that the memory address 6159 is assigned to the variable i. Further, it is assumed that the memory address 6154 is assigned as the head address of the array A by the designation of the address range “6154 to 6158”. In addition, 1, 2, 3, 4, and 5 shown on the left side of each intermediate language instruction shown in FIG. 3 are numbers (referred to as instruction numbers) indicating the order of each intermediate language instruction from the beginning of the program.
“LD 10” reads constant “10” into the accumulator.
“PLD M, WI, 6159” loads the accumulator value (= 10) on the stack and reads the stored data value (value of variable i) at memory address 6159 into the accumulator.

It is assumed that the process of updating the stored data (value of variable i) at the memory address 6159 is performed by another process (not shown). In the case of the above specific example, the value read into the accumulator should be one of 0, 1, 2, 3, and 4.
“LEAAX M, DU, 6154” sets the memory address 6154 (first address of array A) in the AX register.
“AXADDP DU” stores the value (6154 + i) obtained by adding the value of the accumulator to the value of the AX register in the AX register, and takes the value (= 10) accumulated in the stack into the accumulator.
“ST AX” writes the accumulator value (= 10) to address “6154 + i” indicated by the data stored in the AX register. That is, the data stored in the AX register at this time becomes the memory address of the write target (access destination). For example, when i = 2, the address indicated by the AX register is 6154 + 2 = 6156.

  As described above, since the value of the AX register at the time of executing the “ST AX” instruction indicates the access destination memory address, in this method, the instruction to be executed at any time during the program execution is a specific instruction (“ST AX” If it is a specific instruction (such as “ST AX” instruction), the value of the AX register (= 6156) at that time is recorded.

  This recording method may be various, and the value (= 6156) of the AX register at that time may be additionally stored (accumulated) in the write address recording table 42, but will be described later in this example. The method as shown in FIGS. In other words, this is a method in which a check is made at a corresponding portion of the “write address record table (model)” 23 created in advance. This will be described later with reference to FIGS.

  From the above, it can be said that the “ST AX” instruction is an example of “an instruction to write (data) via a (specific) register” (indirect addressing instruction). The specific register is the AX register in the above example, but is not limited to this example. As described above, since the access destination address is stored in the AX register, the “ST AX” instruction is an instruction to write data to the access destination by obtaining the access destination address from the AX register. Can be said to be “an instruction to write (data) via the AX register”.

  The “instruction for writing (data) via a specific register” such as the “ST AX” instruction is included in the instruction group related to the processing as shown in FIG. 3, for example. The process as shown in FIG. 3 is a process related to the array A [i] and the access destination is determined by the value of the variable i. This is a "process in which the memory address to be accessed is determined / changed at any time during operation" or " It can also be said that the access destination is an example of “variable processing”. As described above, conventionally, double writing from a plurality of programs related to such processing cannot be inspected.

  On the other hand, in this method, whether or not the instruction currently executed during the program execution in the target device 30 is the specific instruction (monitoring target instruction), for example, “via a specific register (data )), And if it is a “command to write (data) via a specific register”, the data stored in the current “specific register” (AX register, etc.) Record the access address in the situation). By executing this for each of a plurality of programs, an actual access destination address group for each program is recorded. Therefore, based on this record, it can be determined whether or not there are overlapping access destination addresses in a plurality of programs.

The “currently executing” may mean any of immediately before execution, during execution, and immediately after execution.
As described above, the “ST AX” instruction is an example of the specific instruction. However, a machine language instruction group obtained by converting the “ST AX” instruction into a machine language (a specific example is not shown) It is assumed to be an example of the specific instruction. In other words, it does not matter whether the specific instruction is an intermediate language instruction or a machine language instruction. In the above example, both the “ST AX” instruction and the machine language instruction group corresponding to the “ST AX” instruction (specific example not shown) may be regarded as specific instructions.

  In order to be able to determine whether or not the instruction currently executed in the target device 30 is a specific instruction as described above, this program is compiled when the program (source code 21) is compiled in the development support device 10. A specific instruction is detected from among these instructions, specific information that is information related to the detected specific instruction is generated, and this specific information is passed to the target device 30. An example of this specific information is a monitoring target code table, but is not limited to this example. Other examples of the specific information include “predetermined marks attached to predetermined positions in the program” and “predetermined instructions inserted into the program”, which will be described later, but are not limited to these examples. Not a thing.

  In the case of the intermediate code shown in FIG. 3, the memory allocation by the compiler accompanying the generation is as shown in FIG. 4, for example. In the example of FIG. 3, the start address of the array A is “6154” as described above, and the elements are 0 to 4. Therefore, for the array A, as shown in FIG. 4, the addresses “6154”, 6155 ”, 6156 ', 6157', 6158 'are assigned. Here, the address “6159” is assigned to the variable i as described above.

  When creating a “write address record table (model)” 23 to be described later, the memory allocation results (addresses “6154”, 6155 ′, 6156 ′, 6157 ′, 6158 ′) to the array A in FIG. Use it.

FIG. 5 is a diagram illustrating a specific example of the process of generating the monitoring target code table 25.
FIG. 5 (a) is a diagram showing an initial state of the monitoring target code table 25. FIG. 5 (b) shows a state in which data is stored from this initial state according to the program examples of FIGS. Show.

In the monitoring target code table 25, the offset position of the monitoring target instruction is registered along with the compilation processing of an arbitrary program in the development support apparatus 10.
In the example illustrated in FIG. 5, the monitoring target code table 25 includes data items of a management number 51, a program name 52, and a monitoring instruction offset position 53.

The management number 51 is a unique number for managing the table internally. In the program name 52, the name of the program to be compiled is registered.
In the monitoring command offset position 53, the offset position (command number or the like) of the monitoring target command is registered.

  Here, a method for detecting a monitoring target instruction will be described. First, the monitoring target instruction is, for example, “an instruction to write via a specific register”. “Instructions to be written via a specific register” are included in, for example, an instruction group related to processing in which “memory address to be accessed is determined / changed at any time during operation”.

  In this example, the “instruction to write via a specific register” is an instruction starting with “ST AX”. As a result, the intermediate language 22 is searched to detect all the instructions starting with “ST AX”, and their offset positions are registered in the monitoring instruction offset position 53.

  The “specific register” in the “command to write via the specific register” is the AX register in the above example, but is not limited to this example. In the above example, the “command to write via a specific register” is a command to write predetermined data (“10” in the above specific example) to the memory area indicated by the storage data (address) of the AX register.

  In the case of the example in FIG. 3, only the “ST AX, WI” instruction on the fifth line (instruction number = “5”) is the instruction to be monitored, so the monitoring instruction offset position 53 is shown in FIG. Thus, only “5” is stored.

  However, the present invention is not limited to this example. For example, an offset position of a machine language instruction corresponding to an intermediate language instruction as a monitoring target instruction is obtained with reference to the intermediate-machine association table, and this is obtained as a monitoring instruction offset position 53. You may make it register to. In the tentative concrete example described above, the offset position of the machine language instruction group corresponding to the intermediate language instruction on the fifth line in FIG. 3 is '15th to 17th lines'. May be registered at the monitoring command offset position 53 as shown.

  FIG. 6 is a specific example of the “write address record table (model)” 23. Note that FIG. 6 can be regarded as showing the initial state of the write address record table 42, and will be described below based on this.

The write address record table 42 (the template 23) includes data items of a memory address 61 and a program name 62.
The development support apparatus 10 registers the target memory address in the memory address 61 field. In the case of the above specific example, the memory allocation result (address corresponding to the array A) shown in FIG. 4 is registered in the memory address 61 column. Thus, as shown in FIG. 6, '6154', 6155 ', 6156', 6157 ', and 6158' are registered in the memory address 61 column.

  In the column of program name 62, the name of the program to be executed by the target device 30 is registered. That is, the name of each compiled program is registered. The name is described in the source code 21 of the program. In the illustrated example, two program names PG1 and PG2 are registered. Thereby, for example, an initial state (model 23) of the write address recording table 42 as shown in FIG. 6 is created.

  Thereafter, this template 23 is downloaded to the target device 30 together with the machine language object 24 that is the compilation result, and is stored as a write address recording table 42 (its initial state) in the target device 30.

  Thereafter, when the above check process is executed in the target device 30, each downloaded program (machine language object) is executed. When executed by the PLC 30, since it is executed in the check mode, not as an operation, no command output or the like to the control target device is performed.

  Then, by repeatedly detecting the memory address actually accessed when executing a specific instruction during the execution of each program and recording the detected memory address in the write address record table 42, the write address record table 42 is completed. In this recording process, in the case of this example, when there is a memory address 61 that matches the detected memory address, a check is made at the corresponding location as shown in FIG.

FIG. 7A is a specific example of the write address record table 42 during the check process, and FIG. 7B is a specific example of the state where the write address record table 42 is completed.
In the example of FIG. 7A, “6156” is detected as “memory address that is actually accessed when executing a specific instruction (monitoring target instruction)” during execution of the program PG1, and as shown in FIG. It shows a state where the corresponding part is checked. Basically, the detected memory address (here, “6156”) is recorded, and an example of the recording method is the above-mentioned “check corresponding part”, and is limited to this example. It is not a thing.

  In this example, based on the monitoring instruction offset position 53 corresponding to the program being executed, it is determined whether or not the currently executed instruction is the monitoring target instruction. As described above, the monitoring instruction offset position 53 may store the position of an intermediate language instruction corresponding to the monitoring target instruction (such as an instruction number in the intermediate language; referred to as an intermediate language instruction number). The position of the corresponding machine language instruction (instruction number in machine language, etc .; referred to as machine language instruction number) may be stored. In the case of the above specific example, the intermediate language instruction number is “5”, and the machine language instruction number is “15”. In any case, it can be said that the monitoring instruction offset position 53 stores information on the position of the specific instruction (position of the monitoring target instruction), which is an example of information indicating the specific instruction.

  If the position of the instruction that is currently executed matches the position of the monitoring target instruction, it is determined that the instruction that is currently executed is the monitoring target instruction. Since the program execution in the target device 30 is to execute a machine language object (machine language instruction group), the position of the currently executed instruction is indicated by the machine language instruction number of the currently executed instruction, etc. This is, for example, a current value of a program counter (PC) described later. When the machine instruction number corresponding to the monitoring target instruction is stored in the monitoring instruction offset position 53, it is determined whether or not the current value of the program counter (PC) matches the monitoring instruction offset position 53. Good. On the other hand, when the intermediate language instruction number corresponding to the monitoring target instruction is stored in the monitoring instruction offset position 53, it is necessary to first convert the intermediate language instruction number into the corresponding machine language instruction number. For this conversion, for example, the intermediate-machine association table may be used.

  In the above specific example, the intermediate language instruction number is “5” and the machine language instruction number is “15”, and one of these is stored in the monitoring instruction offset position 53 corresponding to the program PG1. .

  The monitoring instruction offset position 53 used for the determination is a monitoring instruction offset position 53 corresponding to the program name 52 that is the same as the program name of the currently executing program.

  The specific instruction (monitoring target instruction) is “an instruction to write (write data) via a specific register” in the above example. Further, as an example, the specific instruction can be said to be an instruction related to “a process in which a memory address to be accessed is determined / changed at any time during the process”.

FIG. 8 is a diagram showing a program execution management function of the target device 30.
The source code 21 described by the user is converted into a machine language object 24 that operates on the target device 30 by the compile function of the development support device 10, and this machine language object 24 is transferred to the target device 30 to be used as a machine language object 41. Stored. Therefore, it may be regarded as “machine language object 24 = machine language object 41”.

  For example, in the check mode, the program execution management function unit 32 of the target device 30 actually executes the monitor target instruction while sequentially executing the machine language object 41 (PG1, PG2, etc.) of each program. The memory address to be detected is detected and recorded.

  The execution operation of each program itself may be the same as the program execution operation during operation, that is, may be an existing general operation, and will not be described in detail, but according to the illustrated PG execution list. Each program (machine language object 41; PG1, PG2 in this example) stored in the illustrated program memory is sequentially executed.

  The program execution management function unit 32 of the target device 30 has a pointer that indicates a program execution position, generally called a program counter (PC). When the machine language object 41 is executed by the program execution management function unit 32, the data (instruction) at the position indicated by the PC is fetched at any time, and the fetched instruction is executed by the instruction execution function. Move to the position of the command (for example, increment the PC value by +1). Read and write to the memory according to the execution of the instruction.

  The above is a general program execution operation. In this example, the program execution management function unit 32 detects a memory address that is actually accessed when executing the instruction to be monitored. Processing for recording in the “write address record table” 42 is performed.

A flow of processing for recording data in the “write address recording table” 42 in accordance with the execution of the program will be described below.
Since the PC (program counter) indicates the position (relative address, etc.) of the machine language instruction to be executed, when executing each machine language instruction, the PC value at that time is used as the monitoring instruction offset in the monitoring target code table 43. If they match with the value at the position 53, it is determined that the machine language instruction that is currently executed corresponds to the specific instruction. However, this process is a process in the case where the offset position of the machine language instruction ('15' in the above specific example) is registered in the monitoring instruction offset position 53.

  In the case where the offset position ('5' in the above specific example) of the intermediate language instruction corresponding to the monitoring target instruction is registered in the monitoring instruction offset position 53, refer to the intermediate-machine association table. Thus, it is necessary to perform processing for obtaining the offset position of the machine language instruction corresponding to the intermediate language instruction. If the value of the PC matches the offset position of the machine language instruction, it is determined that the currently executed instruction corresponds to a specific instruction. Of course, in order to realize this process, the intermediate-machine association table (not shown) needs to be downloaded to the target device 30 in advance.

  In any of the above forms, by referring to the monitoring instruction offset position 53 of the monitoring target code table 43, whether or not the machine language instruction executed at that time is related to a specific instruction (monitoring target instruction). This is the same in that it can be determined.

  In the case of this example described above, when a specific instruction is executed, the memory address of the access destination is stored in the AX register. Therefore, the stored data in the AX register at this time is the program being executed (its name, etc.) Are recorded in the write address recording table 42 in association with In this example, in this example, as described with reference to FIG. 7, the column of the memory address 61 in the write address recording table 42 is searched to match the stored data (access destination memory address) of the AX register. It is determined whether there is an address to be used. In some cases, a specific mark (check) is added to the corresponding part. The relevant part is a cell corresponding to the “matching address” in the column in which the program name 62 is the program name of the program currently being executed in the write address recording table 42.

  In the case of the specific example described above, if the program PG1 is being executed, for example, if the value of i is 2, the value of the AX register is 6156 (= 6154 + 2), so as shown in FIG. Check 6156.

  This operation is also performed when the program PG2 is executed, and a check is made at a corresponding portion of the write address record table 42, so that the "write address record table" 42 finally becomes the state shown in FIG. Shall be. That is, the “write address record table” 42 is completed.

  In this example, two programs PG1 and PG2 are shown as a plurality of programs. However, the present invention is not limited to this example, and there may be three or more programs. Basically, for all programs, the above operation is performed at the time of execution, and when there is a specific instruction, a mark (corresponding to the address matching the current value of the AX register at the time of execution) Check).

  For example, by using the completed “write address record table” 42 in FIG. 7B, it is possible to determine an address where there is a duplicate access (such as double writing) from different programs. For example, the completed “write address recording table” 42 in FIG. 7B is displayed on the display. This display display may be performed by the target device 30 or the development support device 10.

  The user can determine addresses that are accessed redundantly from a plurality of programs in the actual operation by referring to the display. It is possible to determine which program and which program are accessed redundantly. For example, in the case of the example of FIG. 7B, it can be determined that the address “6156” is accessed redundantly from the programs PG1 and PG2.

Further, when there is an address that is accessed twice, the user may further determine whether or not this duplicate access is a problem.
Even if there are addresses that are accessed redundantly from a plurality of programs, there are no particular problems if they are intended by the user, but if there are addresses that are not intended by the user, there will be a problem. Since such a determination can only be made by the user, the display on the display is performed to make the user determine.

  For example, based on the completed “write address record table” 42, an address accessed redundantly from a plurality of programs may be extracted and displayed on the display. This searches the completed write address record table 42 and extracts the address of the memory where two or more checks exist. As a result, it is possible to detect and display a double-written address.

  In addition, since the position of the monitoring target instruction can be specified by the “monitoring target code table”, the corresponding source code can be displayed from this position, and the defect can be easily corrected.

  In the case of the above-described embodiment, the target device 30 searches the monitored code table 25 for an address that matches the PC value as the program is executed. However, the table search processing has an overhead. Yes, the execution performance of the program is degraded.

  In view of this, a mode (modification) that does not use the monitoring target code table 25 is proposed. In this modified example, instead of generating the monitoring target code table 25, “predetermined marks added to predetermined positions in the program” or “predetermined instructions inserted in the program” as described below. "Etc." is generated.

  In the modification, for example, when a monitoring target instruction is detected as described above during compilation in the development support apparatus 10, a predetermined mark determined in advance is applied to a machine language instruction obtained by converting the monitoring target instruction. Etc. As a result, the machine language object 24 to be generated is in a state where the predetermined mark is added to a specific position.

  The target device 30 checks whether or not the predetermined mark is attached at the time of execution of each machine language instruction along with the execution of the machine language object. The value of the AX register is recorded in the write address recording table 42.

  Alternatively, a predetermined instruction may be inserted in place of the predetermined mark. In other words, when the development support apparatus 10 detects the monitoring target instruction as described above at the time of compiling, a predetermined instruction determined in advance is set before or after the machine language instruction obtained by converting the monitoring target instruction. Insert it.

  Thus, when the machine language object is executed in the target device 30, the predetermined instruction is executed when the machine language instruction corresponding to the monitoring target instruction is executed (at the timing immediately before / after). The predetermined instruction is to perform the above-described process of “recording data stored in the AX register at that time in the“ write address recording table ”42”.

In this way, it is possible to prevent performance degradation due to table search.
Each of the programs PG1 and PG2 may be considered to correspond to, for example, one POU (Program Organization Unit) of IEC61131-3, but is not limited to this example. In the PLC, usually, a plurality of POUs operate at a fixed cycle with a predetermined cycle assigned to each POU. When a memory (address) accessed when executing a certain POU is also accessed when executing another POU, a problem may occur. However, since a problem does not always occur, there may be a case where the developer intentionally performs programming so that a plurality of POUs access the same address.

  Conventionally, with respect to a program (source code) created by a user, particularly when a process of “the memory address to be accessed is determined / changed at any time during operation” is included (in addition, the user manually assigns a memory address of a variable In this case, there is a possibility that the system may fail due to double writing that is not intended by the user. However, it is difficult to detect such a problem portion in the program. For this reason, the user narrowed down the defective part while confirming a huge program and a memory map.

  In contrast, by using this method, unintended double writing can be detected in advance, and stable operation of the system, trouble investigation due to unintended double writing, and time for countermeasures are not required. Thus, the software development efficiency and quality of the user are improved.

  In this method, when a development support apparatus compiles a program (source code) created by a user, a monitoring target instruction is detected from the program and information indicating the monitoring target instruction is recorded in the “monitoring target code table”. .

  When the target device (controller or simulator) executes the program (machine language), it can be determined based on the “monitoring target code table” whether or not the currently executed instruction is the monitoring target instruction. When the instruction to be executed at present is the instruction to be monitored, the data stored in a specific register at that time is recorded in the “write address record table”. This process is executed for a plurality of programs. Then, an address accessed redundantly from a plurality of programs is detected from the recorded contents of the “write address record table” and notified to the user.

  According to the present invention, double writing from different programs can be detected even when the memory is dynamically accessed. As a result, it is possible to detect a memory write unintended by the user, thereby improving the quality of the program.

Although not particularly illustrated, it can also be said that the development support device (loader) 10 and the target device 30 have various processing function units described below.
The development support device 10 is a device that performs compile processing for converting the source code of each program for the programmable controller into a machine language object.

  The development support apparatus 10 includes a specific instruction detection function unit (not shown) that detects a specific instruction during the compilation process of each program, and generates specific information that is information related to the detected specific instruction. A function unit (not shown), a transfer function unit (not shown) for transferring the specific information to the target device 30, and the like are included.

  The target device 30 records the memory address of the access destination at the time of execution of the specific instruction in association with the program being executed based on the specific information during execution of the machine language object of each program. A pre-recording function unit (not shown) is included.

Specific examples of the specific command (specific command) and specific information have already been described, and will be briefly described here.
That is, the specific instruction is “an instruction to write via a (specific) register”, and the data stored in the specific register at the time of execution of the specific instruction is the memory address of the access destination at the time of execution of the specific instruction. Become. Thus, the real access destination recording function unit (not shown) acquires the data stored in the specific register when the specific instruction is executed as the memory address of the access destination. The specific register is the AX register in the above specific example, but is not limited to this example.

  For example, the specific information may be, for example, information indicating the position of the specific instruction on the program (for example, an instruction number or the like; the intermediate language instruction number, or the machine language instruction number). Good).

  In this example, the real access destination recording function unit (not shown) executes the specific instruction when the current program execution position matches the position indicated by the specific information during execution of the machine language object. Therefore, the memory address of the access destination is recorded in association with the program being executed.

  An example of this processing is processing using the above-described program counter and monitoring instruction offset position 53. In this example, the information indicating the position of the specific instruction on the program is the instruction number of the specific instruction, and the upper real access destination recording function unit (not shown) indicates that the value of the program counter is the value of the specific instruction. When the instruction number matches, it is considered that the specific instruction is executed.

  The “position indicated by the specific information” is, for example, when the specific information is the intermediate language instruction number, converted into a corresponding machine language instruction number (in this case, for example, the intermediate-machine (Association table (not shown) is used).

  Further, for example, the generation of the specific information by the specific information generation function unit (not shown) is, for example, adding a predetermined mark to the specific command on the machine language object. In the case of this example, the transfer of the specific information by the transfer function unit (not shown) means transfer of the machine language object with the predetermined mark.

  In this example, when the actual access destination recording function unit (not shown) detects the mark during execution of the machine language object, the actual access destination recording function unit assumes that the specific instruction is being executed and assumes that the memory address of the access destination is Is recorded in association with the program being executed.

  In addition, for example, the generation of the specific information by the specific information generation function unit (not shown) is performed by executing the memory address of the access destination before or after the specific command in the machine language object as an example. A predetermined command for realizing a process of recording in association with a program is inserted. In the case of this example, the transfer of the specific information by the transfer function unit (not shown) means that the machine language object including the predetermined command is transferred.

  In the case of this example, the actual access destination recording function unit (not shown) simply executes the machine language object, and the above-described “access destination memory address at the time of execution of the specific instruction is executed. The process of “recording in association with the program” is realized.

  For example, the target device 30 may further include a check function unit (not shown) for checking whether or not the same memory address is accessed by the plurality of programs based on the recorded memory address. I do not care.

The specific command is a command related to, for example, “a process in which a memory address to be accessed is determined / changed each time”, but is not limited to this example.
Further, in this description, “/” basically means “or” or “or” (excluding mathematical expressions and the like). Thus, for example, “or / and” means “or or and”.

10 Development support device (loader)
11 Interface Function Unit 12 Front End Compiler 13 Back End Compiler 14 Communication Function Unit 15 Screen (Display)
16 Input device 21 Source code 22 Intermediate language 23 “Write address record table (model)”
24 Machine language object 25 Monitoring target code table 30 Target device 31 Communication function unit 32 Program execution management function unit 41 Machine language object 42 Write address recording table 43 Monitoring target code table 51 Management number 52 Program name 53 Monitoring instruction offset position 61 Memory address 62 Program name

Claims (11)

A development support apparatus that performs a compile process for converting a source code of one or more programs into a machine language object, and a programmable controller system having a target apparatus,
The development support apparatus includes:
Specific instruction detection means for detecting a specific instruction during the compilation process of each program;
Specific information generating means for generating specific information that is information related to the detected specific command;
Transfer means for transferring the specific information to the target device,
The target device records the memory address of the access destination at the time of execution of the specific instruction in association with the program being executed based on the specific information during execution of the machine language object of each program A programmable controller system comprising pre-recording means. The specific instruction is an instruction to write via a specific register,
The programmable controller system according to claim 1, wherein the real access destination recording unit obtains data stored in the specific register when the specific instruction is executed as a memory address of the access destination. The specific information is information indicating a position of the specific command on the program,
The real access destination recording means regards the access destination as the execution time of the specific instruction when the current program execution position matches the position indicated by the specific information during execution of the machine language object. 3. The programmable controller system according to claim 1, wherein the memory address is recorded in association with the program being executed. The generation of the specific information by the specific information generating means is to put a predetermined mark on the specific command on the machine language object,
The transfer of the specific information by the transfer means is to transfer the machine language object with the predetermined mark,
When the real access destination recording means detects the mark during execution of the machine language object, the real access destination recording means records the access destination memory address in association with the program being executed, assuming that the specific instruction is being executed. The programmable controller system according to claim 1 or 2, wherein The generation of the specific information by the specific information generation means is a predetermined implementation that realizes a process of recording the memory address of the access destination in association with the program being executed before or after the specific instruction in the machine language object. Is to insert an instruction,
The transfer of the specific information by the transfer means is to transfer the machine language object including the predetermined instruction,
2. The real access destination recording means records the memory address of the access destination at the time of execution of the specific instruction in association with the program being executed by executing the machine language object. Or the programmable controller system of 2. Information indicating the position of the specific instruction on the program is a machine language instruction number of the specific instruction,
4. The programmable controller system according to claim 3, wherein when the value of the program counter matches the machine language instruction number of the specific instruction, the real access destination recording means considers that the specific instruction is being executed. .   The target device or the development support device further includes check means for checking whether or not the same memory address is accessed by a plurality of programs based on the recorded memory address. The programmable controller system according to 2.   The programmable controller system according to claim 1, wherein the specific instruction is an instruction related to “a process in which a memory address to be accessed is determined / changed each time”.   The programmable controller system according to claim 1, wherein the target device is a control device or a simulator of the control device. A development support device configured to be communicable with a target device that executes a machine language object and that performs a compile process for converting source code of one or more programs into the machine language object,
A specific instruction detecting means for detecting a specific instruction that is an instruction to be written via a specific register in the target device during the compilation process of the program;
Specific information generating means for generating specific information that is information related to the detected specific command;
A development support apparatus comprising: transfer means for transferring the specific information together with the machine language object to the target device and storing the specific information in a storage means of the target device. A target device capable of communicating with a development support device that performs a compilation process of converting source code of one or more programs into machine language objects,
During execution of the machine language object of the program, execution of the specific instruction based on specific information relating to a specific instruction written via the specific register in the target device generated by the development support apparatus during the compilation process A target device comprising: real access destination recording means for recording the memory address of the current access destination in association with the program being executed.