JPS62241036A - Protecting system for program runway - Google Patents

Abstract

PURPOSE:To detect the program runaway and to stop completely the working of a system where the programs of error processing, etc. are stored in a RAM, by deciding an error flag via the program of a ROM. CONSTITUTION:In case a program 1 has runaway and an error occurs due to an illegal instruction, it is first checked by an error processing program 2 of a ROM whether an under-error processing flag is equal to '1' or not. Then the flag is equal to '0' when occurrence of an error is decided and therefore a flag is set and branching is applied to an error program 3 of a RAM. The program 3 clears the set flag after the error processing is through. If the program 3 is destroyed, the branching is applied again to the program 2 while the flag is set. In such a case, the flag is equal to '1' and therefore the CPU stopping process is applied after the flag is decided. Thus it is possible to detect an error to prevent the program runaway and to stop the system completely even in case the program 3 is destroyed.

Description

DETAILED DESCRIPTION OF THE INVENTION [Field of Industrial Application] The present invention relates to means for preventing malfunction of a computer, and particularly to a protection system when a program runs out of control.

[Conventional technology]

In computer systems that use the stored program method, it is possible that the desired sequence control may be disrupted and unexpected operations may occur due to hardware failure, program errors, or destruction of program contents due to erroneous writing. . This kind of malfunction is called program runaway.

In a control computer, there is a risk that a program runaway may cause a plant under the control of the computer to malfunction, causing a major disaster.

If a program runaway occurs due to the above reasons, it is necessary to promptly detect the runaway and stop computer operation.

Conventionally, there have been two methods for detecting program runaway: a watchdog timer method and an illegal instruction embedding method.

One type of watchdog timer is disclosed in Japanese Patent Application Laid-Open No. 60-2057.
As described in No. 57, a timer that is triggered periodically and a program that resets the timer every unit time are provided, and if the timer is not reset within a certain period of time, it will cause a runaway to the outside. This is a reporting method. In this method, the computer 7 stem itself does not have a means to stop Pζ itself when runaway occurs, and stoppage of runaway is performed by external means 1. Therefore, the computer system is externally connected.

Requires a means to stop the system when runaway is detected;
Also, since time is used as a means of detecting all runaways,
The time from runaway to detection is relatively long.

The illegal instruction embedding method is disclosed in Japanese Patent Application Laid-Open No. 60-14345.
As described in 1., a specific instruction code is embedded in an empty area of memory where no program is stored, and the program runs out of control. This method detects runaway when an instruction in an empty area is executed.

The illegal instruction embedding method is based on the premise that when a program goes out of control, instructions in an empty area are always executed, so failure modes in which the core area is not executed are not considered.

[Problem that the invention seeks to solve]

Conventionally, relatively small computer systems, such as microcontroller 7
In Sudem, the program capacity was small and was used for limited purposes, so the program was read-only, memory (T(, ead ONLY Memory).

(hereinafter abbreviated as ROM) only. However, as the processing power of microprocessors has improved, there has been a need for increased program capacity, versatility, and expandability. Therefore, like the medium-thick system system, programs can be read and written from an external auxiliary storage device (R+andum).
A method of loading data into Access Memory (hereinafter abbreviated as RAM) has come to be used.

The problem in this case is that if the program in the rLAM is erroneously written and destroyed due to a hardware failure or a program error, the program will run out of control. Especially when the corrupted program involves error handling.

It will also no longer be possible to stop the computer.

As stated in 111J that an external stop means is required for the watchdog timer type, it is difficult to separately provide such a means in a small system, and there is a problem that it takes a long time from runaway to detection. be.

Furthermore, in the illegal instruction embedding method, it is difficult to detect runaway if it is caused by erroneous writing.

An object of the present invention is to store programs such as error processing in RAM.
An object of the present invention is to provide a method for detecting runaway programs in a system stored in a system and reliably stopping the system.

[Means for solving problems]

If the program runs out of control, it is easy to imagine that some kind of exception will occur. Normally, one exception handling program is executed, and runaway can be detected. However, the exception handling program also
If it is destroyed, an exception will occur again during execution, so the user 9 will fall into an endless loop and it will be impossible to detect a runaway.

FIG. 3 is an explanatory diagram of the above process. The runaway program 4 is an error processing program 5 when an illegal occurrence occurs.
If an error occurs due to an illegal instruction after destroying the , the error handling at the time of illegal occurrence is executed. However, since this processing program has been destroyed, the same illegal error occurs again, resulting in a loop. Alternatively, another error occurs and other error processing 6 is executed.

Therefore, the present invention detects runaway without falling into the above-mentioned eternal loop.
The program on the OM determines whether or not error processing is in progress.

[Effect]

Seven lags on memory that can be written to by software are set at the start of error processing and are controlled by the program to be cleared at the end. By determining this flag at the start of error processing and by a program in memory that cannot be written to by software, it is possible to detect the 211 error that occurred again during error processing, and prevent the program from running out of control. It can be prevented.

〔Example〕

Next, embodiments of the present invention will be described with reference to the drawings.

First, the process of program runaway will be explained with reference to FIG. When the runaway program 4 destroys the error processing program (including illegal) during execution and some error occurs, in this case an error due to an illegal instruction, error processing at the time of illegal occurrence is executed. However, this processing program has been destroyed.

An error, that is, the same illegal error occurs and an infinite loop is formed, or another error other than illegal occurs,
Other error processing 6 is executed.

Figure 1 is an overall configuration diagram of the present invention, and error processing 3 is performed when program 1 goes out of control and an error occurs due to an illegal instruction.
1170- becomes as follows. First, the error processing program 2 on the ROM determines whether the error processing flag is 11". When an error occurs in the program 1,
Since the flag has been cleared (20), this flag is set as the primary step, and the program branches to error processing program 3 on R and AM. In program 3, the flag is cleared after the error processing is completed. If program 3 is destroyed,
The program branches to program 2 again with the flag set. Since the flag is 11”, CI after flag determination)
U '6-S) - Performs the process of squishing.

FIG. 2 shows the system configuration of the hardware necessary for the present invention. CPUl0 and rLAMll.

ROMI 2. An address bus 14 and a data bus 15 are interfaced between l1013.

Data transfer is performed via this bus. Furthermore, the read signal 16 for controlling this data transfer is
l0. aAMl 1. ROMI 2. 11013. The write signal 17, which is another control signal, is interfaced except for the signal 0M12. In the above configuration, the content of RAMII can be read or written from CPU10, and the content of ROM12 can only be read from CPU10.

Next, the error processing flow in the ROM 12 is as shown in FIG. 1, and in process 21, the error processing flag=1'? Determine whether the If this flag is set to 11, it is a 92-fold failure as an error occurs again during error processing, so to prevent the program from running out of control or from an infinite loop,
The CPU is made to stagger in process 22 without performing error processing. If the flag is 0'', it is not the above-mentioned double failure.In step 23, the error processing flag is set, and in step 24, the process branches to error processing on R and AM.

During error processing 7 lags In R, AMII which can be read or written from CPUl0, when set (1#), it means error processing is in progress; when cleared ('O'), error processing is not in progress. show.

As shown in FIG. 1, the error processing 70- in the RAM performs error processing such as determining the cause of the error and outputting an error message in step 31, and then clears the error processing flag in step 32.

Naturally, there are many causes of failures and errors in computers, both in terms of software and hardware, rather than just one. When an error occurs, the CPU 10 determines the cause, reads the corresponding error processing start address from the error processing vector fi table in which the start address of each error processing is saved, and executes error processing from this read address. conduct. FIG. 4 shows a configuration diagram of a vector table used in the present invention. The start address of the error processing program 2 in the ROM that determines the error processing flag is stored in all error processing vector tables.

〔Effect of the invention〕

As described above, according to the present invention, a program in memory that is write-protected by hardware to prevent it from being destroyed by the program can detect a double error by determining the error flag. is a situation in which it is not possible to detect even if a program runs out of control, °
Alternatively, it is possible to avoid a situation where error processing is not performed for a direct error cause and error analysis becomes complicated, and the program runaway detection time can be reduced and reliability can be improved.

[Brief explanation of drawings]

Figure 1 is an overall configuration diagram of the present invention, Figure 2 is a system configuration diagram of the present invention, Figure 3 is a diagram showing problems with the conventional program runaway protection system, and Figure 4 is a vector table for error handling operation. FIG. 3 is a diagram showing the relationship of processing flows. 1.4... Runaway program, 2... Error processing program on ROM, 3... Error processing program on R=AM, 5... Error processing program during illegal life, 6...・Other error handling programs, 10
...CPU, 11...P-A M, 12...RO
M, 13...Ilo, 14...Address bus, 15
...Data bus, 16...Lead No. 1g, 17...
・Light signal.

Claims (1)

[Claims] 1. In a data processing device in which a control program is stored in a read-only memory and a read/write memory, the control program is set by the program in the read-only memory area at the start of exception processing, and is cleared at the end of the exception processing. 1. A program runaway protection system, comprising a flag, and when an exception occurs while the flag is set, execution of a subsequent control program in a read/write memory area is inhibited.