JPH0580692B2 - - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION [Field of Industrial Application] The present invention relates to means for preventing malfunction of a computer, and particularly to a protection system when a program runs out of control.

[Conventional technology]

In a computer system using a stored program method, it is conceivable that a hardware failure, a program error, or destruction of program contents due to erroneous writing may disturb desired order control and cause unexpected operations. This kind of malfunction is called program runaway. In a control computer, there is a risk that a program runaway may cause a plant under the control of the computer to malfunction, causing a major disaster.

If a runaway program occurs due to the above reasons, it is necessary to promptly detect the runaway and stop the computer operation.

Conventional methods for detecting runaway programs include the watchdog timer method and the illegal instruction embedding method.

The watchdog timer method was developed in Japanese Patent Application Laid-Open No. 1983-1989.
As described in No. 205757, a timer that is triggered periodically and a program that resets the timer every unit time are provided, and if the timer is not reset within a certain period of time, it will cause a runaway to the outside. This is a reporting method. In this method, the computer system itself does not have a means to stop itself when a runaway occurs, and the runaway is stopped by external means. For this reason, when a runaway of a computer system is detected, an external means for stopping the system is required, and since time is used as a means of detecting runaway, the time from runaway to detection is relatively long. .

The illegal instruction embedding method is
14345, this method embeds a specific instruction code in an empty area of memory where no program is stored, and detects runaway when the program runs out of control and executes instructions in the empty area. The illegal instruction embedding method is based on the premise that when a program runs out of control, an instruction in an empty area is always executed, so failure modes in which the area is not executed are not taken into account.

[Problem that the invention seeks to solve]

Traditionally, relatively small computer systems, such as microcomputer systems, have small program capacities.
Because it was used for a limited purpose, the program was stored in read-only memory (Read Only memory).
Memory (hereinafter abbreviated as ROM) only. However, as the processing power of microprocessors improves, program capacity increases, versatility increases,
Expandability is now required. Therefore, like in medium- and large-sized systems, programs can be read and written from an external auxiliary storage device (Randum Access Memory).
The method of loading data into memory (hereinafter abbreviated as RAM) has become popular.

The problem in this case is that if the program in the RAM is accidentally written and destroyed due to a hardware failure or a programming error, the program will run out of control. Especially when the corrupted program is related to error handling,
It will also no longer be possible to stop the computer.

As mentioned earlier, the watchdog timer method requires an external stopping means, but it is difficult to separately provide such a means in a small system, and the problem is that it takes a long time to detect a runaway. There is.

In addition, in the illegal instruction embedding method,
If it is caused by erroneous writing, it becomes difficult to detect runaway.

SUMMARY OF THE INVENTION An object of the present invention is to provide a method for detecting program runaway in a system in which programs such as error processing programs are stored in RAM, and reliably stopping the system.

[Means for solving problems]

If the program runs out of control, it is easy to imagine that some kind of exception will occur. Normally, an exception handling program is executed and runaway can be detected. However, if the exception handling program is also destroyed,
During execution, an exception occurs again, resulting in an endless loop, making it impossible to detect a runaway.

FIG. 3 is an explanatory diagram of the above process. If an error occurs due to an illegal instruction after the runaway program 4 destroys the error handling program 5 when an illegal occurs, error handling when an illegal occurs is executed. However, because this processing program has been destroyed, the same illegal error occurs again and the process loops. Alternatively, another error occurs and other error processing 6 is executed.

Therefore, in order to detect runaway without falling into the endless loop, the present invention provides a means for indicating that error processing is in progress in a program that executes error processing, and when a runaway of the program occurs, this means is provided. , detects the occurrence of an error in a program that executes error processing by making a determination using a program on the ROM that is never written, and when this error occurrence is detected, performs processing to stop the computer system. This is how it was done.

[Effect]

A means for indicating that error processing is in progress on a memory that can be written by software is set at the start of error processing, and controlled by the program so that it is cleared at the end. By determining this means of indicating that error processing is in progress at the start of error processing and by a program in memory that cannot be written to by software, it is possible to detect a double error in which an error occurs again during error processing. This prevents the program from running out of control.

〔Example〕

Next, embodiments of the present invention will be described with reference to the drawings. First, the process of program runaway will be explained with reference to FIG. Runaway program 4
However, if an error occurs after the error processing program (including illegal ones) is destroyed during execution, in this case an error caused by an illegal instruction, the error handling at the time of illegal occurrence is executed. However, since this processing program is destroyed, an error, that is, the same illegal error occurs, forming an infinite loop, or another error other than the illegal error occurs, and another error processing 6 is executed.

FIG. 1 is an overall configuration diagram of the present invention, and the error processing flow when the program 1 goes out of control and an error occurs due to an illegal instruction is as follows. first,
The error processing program 2 on the ROM determines whether the error processing flag is "1". When an error occurs in program 1, the flag is cleared (=0), so this flag is set next and the program branches to error processing program 3 on RAM. In program 3, the flag is cleared after the error processing is completed. If program 3 is destroyed, the program branches to program 2 again with the flag set. Since the flag is “1”,
After determining the flag, perform processing to stop the CPU.

FIG. 2 shows the hardware system configuration necessary for the present invention. CPU10, RAM11,
Address bus 1 is connected between ROM12 and I/O13.
4 and a data bus 15, and data transfer is performed via this path. Furthermore, the read signal 16 for controlling this data transfer is also sent to the CPU 10, RAM 11, ROM 12, I/O
It is interfaced between 13 and 13. The write signal 17, which is another control signal, is transmitted to the ROM 12.
Except for the interface. In the above configuration, the content of RAM 11 can be read or written from CPU 10, and CPU 10 can read or write the contents of RAM 11.
From this point on, the contents of the ROM 12 can only be read.

Next, the error processing flow in the ROM12 is
As shown in the figure, in process 21, is the error processing flag = 1? Determine if it is. If this flag is "1", it is a double failure in which an error occurred again during error processing, so in order to prevent the program from running out of control and ending up in an infinite loop, the CPU is stopped in process 22 without error processing. let If the flag is "0", there is no double failure as described above. In process 23, an error processing flag is set, and in process 24, the process branches to error processing on the RAM.

The error processing flag is located in the RAM 11 which can be read or written by the CPU 10, and when set, ie, "1", it indicates that error processing is in progress, and when cleared, ie, "0", it indicates that error processing is not in progress.

The error processing flow in the RAM is shown in FIG. 1. In process 31, the cause of the error is determined and error processing such as outputting an error message is performed, and then in process 32, the error processing flag is cleared.

Naturally, there are many causes of failures and errors in computers, both in terms of software and hardware, rather than just one. CPU when error occurs
10 determines the cause, reads the corresponding error processing start address from the error processing vector table in which the error processing start addresses are saved, and performs error processing from this read address. FIG. 4 shows a configuration diagram of a vector table used in the present invention. Determine the error processing flag in all error processing vector tables
Stores the start address of the error processing program 2 in the ROM.

〔Effect of the invention〕

As described above, according to the present invention, a double error can be detected by a program determining the error flag on memory that is write-protected by hardware so that it is not destroyed by the program. It is possible to avoid situations where a runaway program cannot be detected, or where error processing is not performed for the direct cause of the error, making error analysis complicated. can improve sex.

[Brief explanation of the drawing]

Figure 1 is an overall configuration diagram of the present invention, Figure 2 is a system configuration diagram of the present invention, Figure 3 is a diagram showing problems with the conventional program runaway protection system, and Figure 4 is a diagram showing a vector table for error handling. FIG. 3 is a diagram showing the relationship of processing flows. 1, 4...Runaway program, 2...Error processing program on ROM, 3...Error processing program on RAM, 5...Error processing program when illegal occurs, 6...Other error processing programs, 10... ...CPU, 11...RAM, 12...
ROM, 13...I/O, 14...Address bus, 15...Data bus, 16...Read signal,
17... Light signal.

Claims (1)

[Claims] 1. In a program runaway protection method for a computer system in which an error handling program performs error processing when a program runs out of control, the error handling program is provided with means for indicating that error processing is in progress, and when a program runaway occurs, for,
Detecting the occurrence of an error in the error processing program by determining the means indicating that the error processing is in progress using a program stored in a read-only memory, and stopping the computer system when the error occurrence is detected. A program runaway protection method that performs processing that