WO2021166108A1

WO2021166108A1 - Task abnormality monitoring device, method, and program

Info

Publication number: WO2021166108A1
Application number: PCT/JP2020/006466
Authority: WO
Inventors: 圭祐堀井; 整山本; 寿和加藤
Original assignee: 三菱電機株式会社
Priority date: 2020-02-19
Filing date: 2020-02-19
Publication date: 2021-08-26
Also published as: JP7026870B2; JPWO2021166108A1

Abstract

A task abnormality monitoring device comprising: a deadline table (831) for storing a time at which the deadline of each execution task in a plurality of execution tasks is reached, as a deadline time, in association with each execution task; a wake-up time setting unit (844) for calculating a total period from the deadline time of each of the execution tasks and the abnormality handling period of each of the execution tasks, setting, as a next wake-up time of the monitoring task, a time that is the latest deadline time or later among the deadline times at which the total period is less than a permissible safety period reckoning from the wake-up time of a previous monitoring task and is less than the permissible safety period reckoning from the wake-up time of the previous monitoring task, and awakening the monitoring task at the wake-up time; and a task monitoring unit (83) for executing the monitoring task that has been awakened at the wake-up time.

Description

[Name of invention determined by ISA based on Rule 37.2.] Task abnormality monitoring device, method and program

This disclosure relates to a task monitoring technology for detecting an abnormality in a task and shifting it to a safe state in a system in which a plurality of tasks operate.

In an embedded device that executes a plurality of periodic tasks, the periodic tasks must complete the processing within a predetermined time (deadline). In addition, when the periodic task exceeds the deadline, it is necessary to take measures such as stopping and restarting the task. Therefore, a technique for monitoring the processing status of periodic tasks and monitoring whether or not the deadline is exceeded is being studied.
The method of Non-Patent Document 1 executes a monitoring task at a fixed cycle and confirms the behavior of the periodic task each time it wakes up. In the conventional method, the start time and end time of the process are recorded in the periodic task, and the monitoring task determines whether the elapsed time calculated from the start time and end time of the periodic task is within the deadline. Further, the monitoring task does not perform the determination process every cycle, and the monitoring frequency can be set for each cycle task.

When applying the conventional monitoring method to a system in which tasks with significantly different cycles are mixed, if the wake-up cycle of the monitoring task is lengthened, the processing load can be reduced, but it takes time from the occurrence of an abnormality to the detection. .. On the other hand, if the wake-up cycle is shortened, the occurrence of an abnormality can be detected immediately, but the processing load increases.
An object of the present disclosure is to reduce the processing load while satisfying safety constraints when monitoring a plurality of tasks having different cycles.

The task abnormality monitoring device of the present disclosure is
A deadline table that stores the time when the deadline of each execution task of multiple execution tasks is reached as the deadline time corresponding to each execution task,
The total time that is not guaranteed to be in a safe state is calculated from the deadline time of each execution task and the abnormal treatment time of each execution task, and the total time is calculated from the wake-up time of the previous monitoring task to allow safety. Among the deadline times that are less than the time, the time that is after the latest deadline time and is less than the safe allowable time calculated from the previous wake-up time of the monitoring task is set as the next wake-up time of the monitoring task. A wake-up time setting unit that wakes up the monitoring task at the wake-up time,
It is provided with a task monitoring unit that executes the monitoring task that wakes up at the wake-up time.

In the task abnormality monitoring device of the present disclosure, the processing load can be reduced because the wake-up time setting unit sets the latest time less than the safety allowable time as the wake-up time of the next monitoring task.

The block diagram of the task abnormality monitoring apparatus which concerns on Embodiment 1. FIG. Specific Example 1 of the scheduling table 851 according to the first embodiment. Specific Example 2 of the scheduling table 851 according to the first embodiment. A specific example of the task table 883 according to the first embodiment. A setting example of the task table update state 884 according to the first embodiment. A specific example of the task wake-up time table 882 according to the first embodiment. A specific example of the task execution log 881 according to the first embodiment. Specific examples of the monitoring log position table 832 and the execution log position table 852 according to the first embodiment. A specific example of the deadline table 831 according to the first embodiment. A specific example of the previous deadline timetable 835 according to the first embodiment. A specific example of the abnormality treatment time table 836 according to the first embodiment. A specific example of the search table 837 according to the first embodiment. The flowchart of the initialization processing in the task execution part 85 which concerns on Embodiment 1. FIG. The flowchart of the initialization processing in the task monitoring unit 83 which concerns on Embodiment 1. FIG. The flowchart at the time of a normal operation in the execution task 86 which concerns on Embodiment 1. FIG. The flowchart of the task control unit 87 which concerns on Embodiment 1 at the time of a normal operation. The flowchart at the time of a normal operation in the monitoring task 84 which concerns on Embodiment 1. FIG. FIG. 5 is a flowchart during normal operation of the abnormality determination unit 841, the abnormality treatment unit 842, and the execution time acquisition unit 845 according to the first embodiment. FIG. 5 is a flowchart during normal operation in the deadline table update unit 843 according to the first embodiment. The flowchart at the time of normal operation in the wake-up time setting unit 844 which concerns on Embodiment 1. FIG. The block diagram of the task abnormality monitoring apparatus which concerns on Embodiment 2. FIG. A specific example of the deadline table 831 according to the second embodiment. The flowchart at the time of a normal operation in the task control unit 87 which concerns on Embodiment 2. FIG. The flowchart at the time of receiving the task information in the receiving task 89 which concerns on Embodiment 2. FIG. The flowchart at the time of a normal operation in the monitoring task 84 which concerns on Embodiment 2. FIG.

Embodiment 1.
<Explanation of configuration>

FIG. 1 is a configuration diagram of a task abnormality monitoring device according to the first embodiment. In the first embodiment, a case where the task abnormality monitoring device is mounted on the ECU (Electronic Control Unit) 100 that controls the vehicle will be described as an example. The task abnormality monitoring device includes a CPU (Central Processor Unit) 10, a timer 20, a secondary storage device 30, a communication interface 40, an input / output (Output) circuit 50, and a memory 80 as H / W (Hardware).

The program area 81 in the memory 80 has an execution task 86 of the task execution unit 85, a task control unit 87, and a monitoring task 84 of the task monitoring unit 83 as a task abnormality monitoring program. In the task execution unit 85, a plurality of execution tasks 86 are operated by the task control unit 87. A preferred example of the task control unit 87 is an RTOS (Real Time Operating System). Each execution task 86 is a task for realizing the function of the ECU 100, and is a task for performing vehicle control processing. Further, each execution task 86 is a periodic task that wakes up at a fixed cycle.
The task monitoring unit 83 executes the monitoring task 84 that wakes up at the wake-up time. The monitoring task 84 is a task that performs an abnormality determination process for the execution task 86 each time the user wakes up. The task monitoring unit 83 calculates the wake-up time when the monitoring task 84 should wake up next after the monitoring task 84 performs the abnormality determination process for the execution task 86.

The execution task 86 includes an execution time recording unit 861 that records the processing time in the task execution log 881.
The execution time recording unit 861 stores the time when the processing of the execution task is completed in the task execution log 881 of the ring buffer structure based on the position information indicating the write destination in the ring buffer structure.
The task control unit 87 includes a task scheduling unit 871 that manages the scheduling of the execution task 86.
The task control unit 87 includes a task information update unit 872 that notifies the task monitoring unit 83 of the update of the task configuration.
The task information update unit 872 notifies the task information including the cycle of the execution task, the wake-up time of the execution task, and the deadline time of the execution task.

The monitoring task 84 includes an abnormality determination unit 841 that determines whether or not the execution task 86 exceeds the deadline.
The abnormality determination unit 841 sets the execution task for which the abnormality determination was completed at the time of the previous wake-up of the deadline table 831 to the execution task set at the wake-up time as the abnormality determination target task, and the end time of the abnormality determination target task is the deadline time. Abnormality judgment is performed based on whether or not the value falls between the previous value of and the latest value of the deadline time.
The abnormality determination target task is an execution task in which a deadline time after the wake-up time is set in the deadline table 831.
The monitoring task 84 includes an abnormality handling unit 842 that takes action on the execution task 86 in which an abnormality has occurred.
The abnormality handling unit 842 executes a treatment for the execution task 86 in which the abnormality has occurred, and returns the vehicle to a safe state.
The monitoring task 84 includes a deadline table update unit 843 that generates a deadline table 831 used for determining an abnormality and calculating a wake-up time.
The deadline table update unit 843 calculates the deadline time based on the task information and updates the deadline table 831.
The deadline table 831 stores the time when the deadline of each execution task of the plurality of execution tasks is reached as the deadline time corresponding to each execution task.
The deadline table 831 stores a plurality of execution tasks 86 arranged in order of deadline time.
The monitoring task 84 includes a wake-up time setting unit 844 that sets the next wake-up time of the monitoring task 84.
The wake-up time setting unit 844 sets the latest time less than the safe allowable time of each execution task as the next wake-up time of the monitoring task based on the deadline time of each execution task and the abnormality treatment time, and sets the wake-up time as the wake-up time. Wake up a monitoring task.
The monitoring task 84 includes an execution time acquisition unit 845 that acquires the processing time of the execution task 86 from the task execution log 881.
The execution time acquisition unit 845 reads the task execution log 881 at the time when the processing of the execution task is completed based on the position information indicating the read destination in the ring buffer structure.

The CPU 10 may be either single core or multi-core, but if it is multi-core, the task execution unit 85 and the task monitoring unit 83 may be assigned to different cores.

The following is stored in the data area 82 in the memory 80.
Scheduling table 851 of the task execution unit 85,
Execution log position table 852 of the task execution unit 85,
Deadline table 831, task monitoring unit 83,
Monitoring log position table 832 of task monitoring unit 83,
Monitoring position 833 of task monitoring unit 83,
Wake-up position 834 of task monitoring unit 83,
Last deadline timetable 835 of task monitoring unit 83,
Abnormal action time table 836 of task monitoring unit 83,
Search table 837 of task monitoring unit 83,
Search position 838 of task monitoring unit 83,
Task execution log 881 of the shared unit 88,
Task wake-up timetable 882 of common unit 88,
Task table 883 of the shared unit 88,
Task table update status 884 of the shared unit 88.

The data stored in the shared unit 88 can be accessed from either the task execution unit 85 or the task monitoring unit 83.

The CPU 10 is a processor. The processor is an IC (Integrated Circuit) that performs arithmetic processing. The processor is a device that executes a task abnormality monitoring program that operates in the task abnormality monitoring device. The task abnormality monitoring program is a program that realizes the functions of the task execution unit 85 and the task monitoring unit 83.
A task is an execution unit in a task abnormality monitoring device that is a computer, and a preferred specific example of the task is a program executed by a processor.

The memory 80 is a storage device. Specific examples of the memory 80 are SRAM (Static Random Access SS Memory) and DRAM (Dynamic Random Access SS Memory). The memory 80 holds the calculation result of the processor.

The secondary storage device 30 is a storage device that stores data in a non-volatile manner. A specific example of the secondary storage device 30 is an HDD (Hard Disk Drive). Further, the secondary storage device 30 may be a portable recording medium such as a memory card, a NAND flash, a flexible disk, an optical disk, a compact disk, or a DVD (Digital VerSail Disc).
The secondary storage device 30 is a computer-readable recording medium, and may store information in the program area 81 and the data area 82 of the memory 80.

The input / output circuit 50 has a port to which devices are connected, and data is input / output from each device. A sensor 60 and an actuator 70 necessary for realizing the function of the ECU 100 are connected to the input / output circuit 50.

The communication interface 40 has a communication port for the processor to communicate with another device.

The processor reads and executes the task abnormality monitoring program from the memory 80. In the memory 80, not only the task abnormality monitoring program but also the OS (Operating System) is stored. The processor executes the task abnormality monitoring program while executing the OS. The task abnormality monitoring device may include a plurality of processors that replace the processors. These plurality of processors share the execution of the task abnormality monitoring program. Each processor, like the processor, is a device that executes a task abnormality monitoring program. Data, information, signal values and variable values used, processed or output by the task abnormality monitoring program are stored in the memory 80, the secondary storage device 30, or a register or cache memory in the processor.

The task abnormality monitoring program is a program that causes a computer to execute each process, each procedure, or each process by replacing "department" of the task execution unit 85 and the task monitoring unit 83 with "process", "procedure", or "process". ..

The task abnormality monitoring method is a method performed by the task abnormality monitoring device, which is a computer, executing the task abnormality monitoring program. The task abnormality monitoring program may be provided by being stored in a computer-readable recording medium, or may be provided as a program product.

In the present embodiment, the functions of the task execution unit 85 and the task monitoring unit 83 are realized by software, but as a modification, the functions of the task execution unit 85 and the task monitoring unit 83 are realized by a combination of software and hardware. May be done. That is, a part of the functions of the task execution unit 85 and the task monitoring unit 83 may be realized by a dedicated electronic circuit, and the rest may be realized by software.

Specifically, the dedicated electronic circuit is a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, a logic IC, a GA, an FPGA, or an ASIC. "GA" is an abbreviation for Gate Array. "FPGA" is an abbreviation for Field-Programmable Gate Array. "ASIC" is an abbreviation for Application Special Integrated Circuit.

The processor, memory, and dedicated electronic circuit are collectively called "processing circuit". That is, the functions of the task execution unit 85 and the task monitoring unit 83 are realized by the processing circuit regardless of whether they are realized by software or a combination of software and hardware.

FIG. 2 shows an example of the scheduling table 851. The task scheduling unit 871 schedules tasks according to the scheduling table 851. The cycle here is the wake-up cycle of the execution task 86, and the deadline time is the permissible time from the wake-up of the execution task 86 to the completion of the process. The value of each item in the scheduling table 851 is statically set before the program is generated. Further, each item does not have to be collected in one table and may be managed separately. In the case of the scheduling table 851 of FIG. 2, three tasks are woken up (registered in the ready queue) at the same time, and the tasks with the highest priority are executed in order. When a task with a higher priority than the task being executed reaches the wake-up time, the task scheduling unit 871 switches to the task with a higher priority and executes the process.

FIG. 3 shows an example of a scheduling table 851 having a data structure different from that of FIG. In FIG. 3, different wake-up times are set for each cycle, and it is possible to reduce the number of task switchings by intentionally shifting the wake-up time. The scheduling table 851 may have a structure as shown in FIG.

FIG. 4 shows an example of the task table 883. The task table 883 is used for notifying the task configuration from the task execution unit 85 to the task monitoring unit 83. The task table 883 includes all the data of the scheduling table 851, and an item called a task update type is added. Set either "Add" or "Delete" for the task update type.

FIG. 5 shows a setting example of the task table update state 884. The task table update status 884 is used for notifying the task monitoring unit 83 of the task table status from the task execution unit 85. The task table update state 884 can be set to any of the four patterns shown in FIG. The initial value of the task table update state 884 is "uninitialized (task table state = 0)".

FIG. 6 shows an example of the task wake-up time table 882. The task wake-up time table 882 is used by the task execution unit 85 to notify the task monitoring unit 83 of the wake-up time of each execution task 86. The wake-up time is a time indicating the wake-up timing of the execution task 86. The task wake-up time table 882 is a collection of wake-up times for each task. The wake-up time is not updated every cycle, but is updated only when a task is added, such as when the task is initialized and when the task is restarted. Further, only the latest value is stored in the task wake-up time table 882.
In FIG. 6, the wake-up times of the

execution tasks

1, 2, and 3 are set to 1000, 1002, 1012, but the wake-up times of the

execution tasks

1, 2, and 3 may all be the same time, for example, 1000.

FIG. 7 shows an example of the task execution log 881. The task execution log 881 is a table in which the processing end time of the execution task 86 is recorded. The task execution log 881 is used by the task execution unit 85 to notify the task monitoring unit 83 of the processing end time of each execution task 86. The task execution log 881 can record the end times of a plurality of times for each task, and FIG. 7 shows an example of recording the past five times. The task execution log 881 is a ring buffer structure, in FIG. 7 after recording up to l ₄ is recorded in l _0.

FIG. 8 shows an example of the execution log position table 852 of the task execution unit 85 and the monitoring log position table 832 of the task monitoring unit 83. The execution log position 859 and the monitoring log position 839 indicate the latest positions for each task in the task execution log 881. The task execution unit 85 determines the next writing position according to the execution log position 859. Further, the task monitoring unit 83 determines the position to be read next according to the monitoring log position 839. Since the task execution unit 85 and the task monitoring unit 83 operate asynchronously, the log positions are stored in their respective local areas. The initial values of the execution log position 859 and the monitoring log position 839 are set to 0.
The execution log position 859 and the monitoring log position 839 are position information indicating a write destination and a read destination in the ring buffer structure.

FIG. 9 shows an example of the deadline table 831. The deadline table 831 aggregates the deadline times of the execution task 86 into one table, and is used for determining the task to be determined for abnormality and setting the next wake-up time of the monitoring task 84. The deadline time is the absolute time when each task reaches the deadline.

FIG. 9 shows an example in which the wake-up times of the

execution tasks

1, 2 and 3 are all 1000, and the initial deadline time is 1000. The deadline times of each execution task shown in FIG. 2 are 8, 16, and 24. Can be calculated by adding. The deadline time after the second wake-up can be calculated by adding the

cycles

10, 20, and 30 to the first deadline time.
However, when the deadline table 831 is generated from the scheduling table 851 whose wake-up time is different for each cycle as shown in FIG. 3, each wake-up schedule offset (t _n ) is added to the first deadline time instead of the cycle. The deadline time after the second wake-up can be calculated with.

Also, since the same pattern is repeated for each least common multiple (major cycle) of multiple cycles of multiple execution tasks, the deadline time need only be created for one major cycle. When the execution tasks set in the deadline table 831 are

only tasks

1, 2, and 3 shown in FIG. 4, each cycle is 10, 20, and 30, so the least common multiple of the cycle is 60. Therefore, the major cycle is 60. FIG. 9 shows a deadline table 831 with a major cycle of 60.

The deadline table 831 on the left side of FIG. 9 is the deadline table 831 at the time of initialization. The deadline table 831 is sorted in order of earliest deadline time as shown on the left side of FIG. 9 at the time of initialization. The deadline time in the deadline table 831 is cyclically overwritten after the execution task is executed. The deadline table 831 on the right side of FIG. 9 is a deadline table 831 in the middle of the first cycle, and is a deadline table 831 in which the deadline times of the upper two rows are updated.
The configuration of the deadline table 831 is updated at the time of initialization and at the time of updating the task configuration.

The monitoring position 833 indicates the position of the task to be determined as an abnormality, and the line number on the deadline table 831 is set in the monitoring position 833. The initial value of the monitoring position 833 is 1.
The wake-up position 834 indicates the position of the deadline time that is the wake-up time of the monitoring task 84, and the line number of the deadline table 831 is set in the wake-up position 834. The initial value of the wake-up position 834 is 1.
The search position 838 indicates the position of the deadline time as a wake-up time candidate, and the line number of the deadline table 831 is set at the search position 838. The initial value of the search position 838 is 1.

FIG. 10 shows an example of the previous deadline timetable 835. The previous deadline time is the deadline time that arrived one cycle before, and the previous deadline time table 835 is a collection of the latest values of the previous deadline time for each task. The previous deadline timetable 835 is used for the abnormality determination process of the execution task 86, and is updated every time the abnormality determination process is completed once. The initial value of the previous deadline time is set to 0.

FIG. 11 shows an example of the abnormal treatment time table 836. The abnormal treatment time table 836 summarizes the abnormal treatment time required for the abnormal treatment for each task. The abnormality treatment time is the time from the detection of an abnormality to the completion of the transition to the safe state. FIG. 11 shows an example in which the treatment content differs for each task in which an abnormality has occurred. If the treatment content is the same for all tasks, only one abnormal treatment time needs to be defined. The values in the anomaly treatment time table 836 are statically set before the program is generated.

FIG. 12 shows an example of the search table 837. The search table 837 is for managing the deadline time which is a wake-up time candidate and the non-detection time for each deadline time, and is added every time the search position is updated. The undetected time of each execution task is the time from each deadline time of each execution task to the wake-up time candidate. The undetected time can be calculated by subtracting each deadline time of each execution task from the deadline time which is a wake-up time candidate indicated by the latest search position. The non-detection time is the time during which the monitoring task 84 is not executed, and indicates the time during which the abnormality of the execution task is not detected.

<Explanation of operation>
Hereinafter, the operation according to the first embodiment will be described.

<Initialization procedure>
First, the initialization processing procedure in the task execution unit 85 and the task monitoring unit 83 will be described.

FIG. 13 is a flowchart of the initialization process in the task execution unit 85.

(Step S101)
The task scheduling unit 871 starts task scheduling according to the scheduling table 851.

(Step S102)
The task information update unit 872 updates the task table 883 of the shared unit 88. As the update method, basically, the contents of the scheduling table 851 are diverted, and all task update types are set to "addition".

(Step S103)
The task information update unit 872 updates the task wake-up time table 882 of the shared unit 88. A preferred method for acquiring the time is a method of reading from the timer 20. The time may be the current time or the elapsed time since the system booted. However, the accuracy of the acquired time must be less than or equal to the shortest deadline time among the deadline times of all execution tasks.

(Step S104)
The task information update unit 872 updates the task table update state 884 to "initialized (task table state = 1)", and ends the initialization process of the task execution unit 85.

FIG. 14 is a flowchart of the initialization process in the task monitoring unit 83. It is assumed that the initialization process of the task monitoring unit 83 is started after the initialization process of the task execution unit 85 is completed.

(Step S201)
The deadline table update unit 843 acquires task information from the shared unit 88. Specifically, it is a task table 883 and a task wake-up time table 882.

(Step S202)
The deadline table update unit 843 updates the task table update state 884 to "no task update (task table state = 2)" in order to indicate that the acquisition of the task information added at the time of initialization is completed.

(Step S203)
The deadline table update unit 843 generates the deadline table 831 based on the task table 883 and the task wake-up time table 882 acquired from the shared unit 88. The method of generating the deadline table 831 is as described above.

(Step S204)
The wake-up time setting unit 844 sets the first wake-up time of the monitoring task 84. A flowchart for calculating the wake-up time is shown in FIG. Since the specific calculation method is the same as during normal operation, the details will be described later. If the initialization process takes time, the deadline time is set to the wake-up time for the first few times, and the deadline table 831 is generated and the wake-up time is calculated by dividing it into a plurality of wake-up times. May be good. Further, as a preferable setting method of the wake-up time, a method of putting the monitoring task to sleep after setting the time until the next wake-up in the timer 20 and waking up by the timer interrupt can be considered.

<Normal operation procedure>
Next, the normal operation procedure in the task execution unit 85 and the task monitoring unit 83 will be described.

FIG. 15 is a flowchart of the execution task 86 during normal operation.

(Step S301)
Execution task 86 executes the main process. The main process here is a process for realizing the function as the ECU 100, which has nothing to do with the monitoring function.

(Step S302)
The execution time recording unit 861 records the end time of the main process in the task execution log 881. The end time is acquired by using the timer 20. In addition, the value acquired here must be of the same type as the first wake-up time (current time, elapsed time from the start of startup, etc.). The execution time recording unit 861 writes the end time at the position indicated by the execution log position 859 of the execution task 86 that has executed the main process.

(Step S303)
Since the execution time recording unit 861 has updated the task execution log 881, the execution log position 859 is also updated. Specifically, the value obtained by adding 1 to the current log position may be updated to the remainder when divided by the size of the ring buffer.

FIG. 16 is a flowchart of the task control unit 87 during normal operation.

(Step S401)
The task scheduling unit 871 schedules tasks according to the scheduling table 851.

(Step S402)
The task information update unit 872 confirms whether the task configuration has been updated. As a premise, the task abnormality monitoring device assumes an environment in which the task control unit 87 updates the contents of the scheduling table 851 in response to a task addition request or a task deletion request. Therefore, the task information update unit 872 can confirm the presence / absence of the additional task or the deletion task by referring to the scheduling table 851. If the task configuration has not been updated, it ends without doing anything.

(Step S403)
The task information update unit 872 updates the task table 883 of the shared unit 88 if the task configuration is updated. At this time, the task table update status 884 is confirmed before updating the task table 883. If the task table update status 884 is "task update available (task table status = 3)", it means that the monitoring task 84 has not yet confirmed the information of the task table 883, so that the existing information is retained while leaving the existing information. Add update task information. On the other hand, if the task table update status 884 is "no task update (task table status = 2)", the monitoring task 84 has confirmed all the update information, so the update task information is cleared after clearing the existing information. To add.

(Step S404)
The task information update unit 872 confirms whether the update task type is "addition". This is because, in the case of an additional task, it is necessary to notify the task monitoring unit 83 of the task wake-up time table 882.

(Step S405)
If the update task type is "addition", the task information update unit 872 updates the task wake-up time table 882 of the shared unit 88. The method of acquiring the wake-up time is the same as that at the time of initialization.

(Step S406)
The task information update unit 872 updates the task table update status 884 of the shared unit 88 to "task update available (task table status = 3)" in order to notify the task monitoring unit 83 that the task configuration has been updated. .. Finally, by updating the task table update state 884, it is possible to prevent the task monitoring unit 83 from accessing the task wake-up time table 882 or the task table 883 during the update.

FIG. 17 is a flowchart of the monitoring task 84 during normal operation.

(Step S501)
The abnormality determination unit 841 uses the task execution log 881 and the deadline table 831 to determine whether or not the execution task has exceeded the deadline. The detailed processing procedure of the abnormality determination unit 841 will be described later.

(Step S502)
The deadline table update unit 843 updates the deadline table 831 when the task configuration is updated. If there is no need to update the deadline table 831, nothing is done in this step. Further, in an environment where the task configuration is not updated during operation, this step itself is unnecessary.

(Step S503)
The wake-up time setting unit 844 uses the deadline table 831 to calculate the next wake-up time of the monitoring task 84 and sets it in the timer 20.
However, in an environment where the task configuration is not updated during operation, the wake-up time of the monitoring task 84 can be uniquely determined for each major cycle. In this case, the wake-up time of the monitoring task 84 needs to be calculated only once at the time of initialization, and in this step, the wake-up time setting unit 844 does not calculate the next wake-up time of the monitoring task 84, and the timer 20 is set. Only set. In such an environment, as shown in FIG. 22, an item of wake-up time may be added to the deadline table 831. In FIG. 22, the item of the wake-up time is added to the deadline table 831, and the item of the wake-up time is set to 1 if the deadline time is the wake-up time and 0 if the deadline time is not the wake-up time. Details will be described later.

The detailed operation of each step in FIG. 17 will be described in order.

FIG. 18 is a flowchart of the abnormality determination unit 841 and the abnormality treatment unit 842 during normal operation (step S501).

(Step S601)
First, the abnormality determination unit 841 determines that the execution task indicated by the monitoring position 833 in the deadline table 831 is the abnormality determination target task. The execution time acquisition unit 845 acquires the end time of the task subject to abnormality determination from the task execution log 881. At this time, the end time indicated by the monitoring log position 839 of the task is acquired.

(Step S602)
The abnormality determination unit 841 sets the execution task indicated by the monitoring position 833 of the deadline table 831 as the abnormality determination target task, and acquires the deadline time of the abnormality determination target task as the latest deadline time.

(Step S603)
The abnormality determination unit 841 acquires the previous deadline time of the task subject to abnormality determination from the previous deadline time table 835.

(Step S604)
The abnormality determination unit 841 determines whether or not the execution task 86 has been completed within the deadline time. As a determination method, it is determined whether or not the end time acquired from the task execution log 881 is within the interval between the previous deadline time and the latest deadline time.
"Last deadline time <end time <latest deadline time"
If the wake-up of the execution task 86 fails, the end time becomes a time before the previous deadline time. Therefore, with this determination method, not only the deadline is exceeded but also the wake-up failure can be detected.

(Step S605)
The abnormality treatment unit 842 takes measures for the task determined to be abnormal. Possible actions include saving logs, stopping / restarting tasks, and restarting the entire system. The content of the abnormal treatment may be set individually for each task, or may be the same for all tasks.

(Step S606)
The abnormality determination unit 841 updates the previous deadline time of the previous deadline time table 835 with the latest deadline time for the abnormality determination of the next cycle.

(Step S607)
The abnormality determination unit 841 updates the monitoring position 833 in order to move the abnormality determination target to the next task. As an update method, 1 is added to the current value, and if the value exceeds the last row of the deadline table 831, it is cleared to 0.

(Step S608)
The abnormality determination unit 841 updates the deadline time in the deadline table 831 when the monitoring is completed. This is to prepare for the case where the deadline table 831 makes one round, and it is possible to update the time in the next major cycle by adding the least common multiple of the cycle.

(Step S609)
The abnormality determination unit 841 updates the monitoring log position 839 for the determination of the next cycle. The log position is updated by the method of step S303 in FIG. 15 as in the execution log position 859.

(Step S610)
The abnormality determination unit 841 compares the updated monitoring position 833 with the wake-up position 834, and if the monitoring position 833 becomes a value larger than the wake-up position 834, it is determined that all the abnormality determination processes to be performed at the time of this wake-up have been completed. And end the process. On the other hand, if the monitoring position is equal to or lower than the wake-up position, the undetermined task still exists, so the process returns to step S601 and proceeds to the abnormality determination process of the next task.

FIG. 19 is a flowchart of the deadline table update unit 843 during normal operation (step S502).

(Step S701)
The deadline table update unit 843 determines whether or not the task table update state 884 is "task update available (task table state = 2)", and confirms the update of the task configuration. If the task table update status 884 is other than "task update available (task table status = 2)", the task configuration has not been updated, so it is not necessary to update the deadline table 831, and the deadline table update unit 843 , Finish without doing anything. As a use case when the task configuration is updated during operation, for example, in order to restart the task when an abnormality occurs in the task, the task is temporarily deleted from the scheduling target and the task is restarted. It is conceivable that the task is added to the scheduling target again after completion.

(Step S702)
If the task configuration is updated, the deadline table update unit 843 acquires the update contents (task update type, updated task identifier, cycle, priority, deadline time, etc.) from the task table 883. If the task update type is "addition", the task wake-up time table 882 is also acquired.

(Step S703)
The deadline table update unit 843 confirms whether the task update type is "addition".

(Step S704)
The deadline table update unit 843 adds the deadline time of the additional task to the deadline table 831 when the task update type is "addition". At this time, the deadline time is added for the major cycle before the task is added.

(Step S705)
The deadline table update unit 843 confirms whether the task update type is "delete". If the task update type is neither "add" nor "delete", it is determined that the task table update status 884 is incorrect, and the deadline table 831 ends without updating.

(Step S706)
When the task update type is "delete", the deadline table update unit 843 deletes all the deadline times of the corresponding task from the deadline table 831.

(Step S707)
The deadline table update unit 843 refers to the task table 883 and confirms whether or not there is the next update content. If there is the next update content, the process returns to step S701. When the updated contents are confirmed up to the end of the task table 883, the process proceeds to the next step.

(Step S708)
The deadline table update unit 843 confirms whether or not the major cycle needs to be changed by updating the task configuration. This is because when the major cycle changes, it is necessary to change the range of deadline time registered in the deadline table.

(Step S709)
The deadline table update unit 843 updates the deadline time according to the change in the major cycle. If the major cycle is long, add the deadline time in the shortage range. On the other hand, if the major cycle becomes shorter, the unnecessary deadline time is deleted.

(Step S710)
The deadline table update unit 843 updates the task table update state 884 to "no task update (task table state = 2)" after the update of the deadline table 831 is completed.
The task table 883, the task wake-up time table 882, and the task table update state 884 required for updating the deadline table 831 are data updated from the task execution unit 85. Therefore, when it is necessary to refer to the task table 883, the deadline table update unit 843 prohibits the update from the task execution unit 85 until the task table update state 884 is updated by exclusive control.

FIG. 20 is a flowchart of the wake-up time setting unit 844 during normal operation (step S503).

<First search>
(Step S801)
The wake-up time setting unit 844 searches the deadline table 831 for the next wake-up time of the monitoring task 84. Since the search starts after the current wake-up position 834, the first search position 838 is set to the wake-up position 834 + 1. Since the deadline table 831 is sorted in the order of earliest time, the deadline time closest to the current time is the first wake-up candidate.
FIG. 12 shows the search table 837 when the wake-up position 834 of the deadline table 831 of FIG. 9 is the row number 9. The wake-up time setting unit 844 sets "line number 9 + 1 = line number 10" as the first search position 838 in the first row of the search table 837.

(Step S802)
The wake-up time setting unit 844 acquires the deadline time indicated by the search position 838 from the deadline table 831. Here, since the acquired deadline time is used until the wake-up time is determined, it is registered in the search table 837. This is because the abnormality treatment time differs for each task, so that the line indicated by the first search position 838 does not always take the longest time from the abnormality detection to the completion of the abnormality treatment.
In FIG. 12, the wake-up time setting unit 844 acquires the deadline time 1056 of the task 2 indicated by the search position 838 from the deadline table 831 and registers it in the first row of the search table 837.

(Step S803)
The wake-up time setting unit 844 acquires the abnormal treatment time of the task indicated by the search position 838 from the abnormal treatment time table 836. The wake-up time setting unit 844 acquires the abnormal treatment time 8 of the task 2 indicated by the search position 838 from the abnormal treatment time table 836.

(Step S804)
The wake-up time setting unit 844 calculates the difference between the deadline time acquired in step S802 and each deadline time in the search table 837. The difference between the deadline times is the undetected time for each row in the deadline table 831. The difference in deadline time at the latest search position 838 is naturally 0. The difference between the deadline times calculated here is registered in the search table 837 as the non-detection time.
Since the first row of the search table 837 in FIG. 12 is the first and latest search position 838, the difference in deadline time is 0.
First row of search table 837: 1056-1056 = 0

(Step S805)
The wake-up time setting unit 844 determines whether the total time G obtained by adding the abnormal treatment time of the task to the difference (non-detection time) of the deadline time calculated in step S804 is less than the FTTI (Fault Tolerant Time Interval) of the system. do.
The non-detection time is a time during which the monitoring task is not executed, a time during which the abnormality is not detected, and a waiting time until the abnormality detection is started.
The abnormal treatment time is the time during which the abnormal treatment unit 842 operates, and is the time from the detection of the abnormality to the return to the safe state. As shown in FIG. 11, the abnormality treatment time may be different for each execution task.

Therefore, the total time G is the time from the occurrence of the abnormality to the completion of the abnormal treatment, and indicates the time during which the safe state is not guaranteed.
Undetected time = Deadline time of search position-Total time of each deadline in the search table G = Undetected time + Abnormal treatment time The monitoring execution time of monitoring task 84 is ignored compared to the undetected time and abnormal treatment time. It is supposed to be possible.

When the monitoring execution time of the monitoring task 84 cannot be ignored as compared with the no-detection time and the abnormality treatment time, the total time G is as follows.
Total time G = non-detection time + monitoring execution time + abnormal treatment time FTTI is the permissible time from the occurrence of a failure to the transition to a safe state, and is defined in the functional safety standard ISO26262 for in-vehicle devices. By satisfying that the total time G is less than FTTI, it is possible to prevent the failure factor from spreading to other functions.
FTTI is a value defined for each system.
The time to be compared here is not limited to FTTI as long as it is the allowable time from the occurrence of the abnormality to the completion of the abnormal treatment.

The first row of the search table 837 in FIG. 12 is as follows.
First row of search table 837: No detection time = 1056-1056 = 0
First row of search table 837: Total time G = 0 + 8 = 8

(Step S806)
The wake-up time setting unit 844 considers that if the total time G is less than FTTI, there is still time to execute the monitoring task 84, adds 1 to the search position, and the next row in the deadline table. Proceed with the judgment.
In the first row of the search table 837 in FIG. 12, assuming that FTTI is 25, FTTI> total time G, so 1 is added to the search position and the determination proceeds to the next row in the deadline table.
First row of search table 837: FTTI = 25> total time G = 8

If FTTI> total time G, steps S801 to S806 are repeated as follows.

<Second search>
(Step S801)
The wake-up time setting unit 844 sets "line number 10 + 1 = line number 11" as the search position 838 in the second row of the search table 837.

(Step S802)
The wake-up time setting unit 844 acquires the deadline time 1058 of task 1 indicated by the search position 838 from the deadline table 831 and registers it in the second row of the search table 837.

(Step S803)
The wake-up time setting unit 844 acquires the abnormal treatment time 1 of the task 1 indicated by the search position 838 from the abnormal treatment time table 836.

(Step S804)
The wake-up time setting unit 844 calculates the difference between the deadline time acquired in step S802 and each deadline time in the search table 837 and registers it in the search table 837.

(Step S805)
First row of search table 837: No detection time = 1058-1056 = 2
First row of search table 837: Total time G = 2 + 8 = 10
Second row of search table 837: No detection time = 1058-1058 = 0
Second row of search table 837: Total time G = 0 + 1 = 1

(Step S806)
First row of search table 837: FTTI = 25> total time G = 10
Second row of search table 837: FTTI = 25> total time G = 1
Since FTTI> total time G in each case, 1 is added to the search position, and the judgment is advanced to the next row in the deadline table.

<Third search>
(Step S801)
The search position 838 is "line number 11 + 1 = line number 12", but since there are only 11 rows in the deadline table, the wake-up time setting unit 844 sets the search position 838 as the "line number" in the third row of the search table 837. 1 ”is set.

(Step S802)
The wake-up time setting unit 844 acquires the deadline time 1068 of task 1 indicated by the search position 838 from the deadline table 831 and registers it in the third row of the search table 837.

(Step S805)
First row of search table 837: No detection time = 1068-1056 = 12
First row of search table 837: Total time G = 12 + 8 = 20
Second row of search table 837: No detection time = 1068-1058 = 10
Second row of search table 837: total time G = 10 + 1 = 11
Third row of search table 837: No detection time = 1068-1068 = 0
3rd row of search table 837: Total time G = 0 + 1 = 1

(Step S806)
First row of search table 837: FTTI = 25> total time G = 20
Second row of search table 837: FTTI = 25> total time G = 11
3rd row of search table 837: FTTI = 25> total time G = 1
Since FTTI> total time G in each case, 1 is added to the search position, and the judgment is advanced to the next row in the deadline table.

<Fourth search>
(Step S801)
The wake-up time setting unit 844 sets "line number 1 + 1 = line number 2" as the search position 838 in the fourth row of the search table 837.

(Step S802)
The wake-up time setting unit 844 acquires the deadline time 1076 of the task 2 indicated by the search position 838 from the deadline table 831 and registers it in the fourth row of the search table 837.

(Step S803)
The wake-up time setting unit 844 acquires the abnormal treatment time 8 of the task 2 indicated by the search position 838 from the abnormal treatment time table 836.

(Step S805)
First row of search table 837: No detection time = 1076-1056 = 20
First row of search table 837: Total time G = 20 + 8 = 28
Second row of search table 837: No detection time = 1076-1058 = 18
Second row of search table 837: total time G = 18 + 1 = 19
Third row of search table 837: No detection time = 1076-1068 = 8
3rd row of search table 837: Total time G = 8 + 1 = 9
4th row of search table 837: No detection time = 1076-1068 = 0
Fourth row of search table 837: Total time G = 0 + 8 = 8

(Step S806)
First row of search table 837: FTTI = 25 <total time G = 28
Second row of search table 837: FTTI = 25> total time G = 19
3rd row of search table 837: FTTI = 25> total time G = 9
4th row of search table 837: FTTI = 25> total time G = 8
In the first row of the search table 837, FTTI = 25 <total time G = 28, so the process proceeds to step S807.

(Step S807)
Setting example of wake-up position 834 1
When the total time G exceeds the FTTI, the wake-up time setting unit 844 sets the line number of the search position -1 to the wake-up position 834. This is because, from the result of the determination in step S805, the completion of the abnormal treatment is not in time for FTTI at the latest search position 838, so the search position 838 immediately before is set as the next wake-up position 834.
Wake-up position 834: Search position-1
The deadline time of the search position-1 is the latest deadline time among the deadline times in which the total time G calculated from the deadline time of each execution task and the abnormal treatment time of each execution task is less than the safe allowable time. be. Setting this search position -1 to the wake-up position 834 means that the latest deadline time less than FTTI is set as the next wake-up time of the monitoring task 84.
In the case of FIG. 12, it is as follows.
Wake-up position 834: Search position-1 = Line number 1

As described above, in the setting example 1, the wake-up time setting unit 844 searches the deadline table 831 for an execution task that satisfies the following conditions.
1. 1. The deadline time is an execution task since the last wake-up time,
2. The total time G, which is the difference between the latest deadline time of the execution task and the previous deadline time of the execution task plus the abnormal treatment time of the execution task, is less than the safe allowable time.
3. 3. Among the execution tasks whose total time G is less than the allowable safety time, the execution task has the maximum total time G.
The wake-up time setting unit 844 sets the deadline time of the execution task that maximizes the total time G among the searched execution tasks as the next wake-up time of the monitoring task 84.

Setting example 2 of wake-up position 834
The line number of the search position-1 may be set to the wake-up position 834, and the time T1 may be set as follows, which is obtained by subtracting the time E exceeding the FTTI from the deadline time of the search position. The excess time E is the time during which the time from the occurrence of the abnormality to the completion of the abnormal treatment (total time G) exceeds the FTTI. The time T1 is the time obtained by subtracting the time E from the deadline time of the search position.
Exceeded time E = total time G-FTTI
Time T1 = Deadline time of search position-Exceeded time E
However, when the time T1 is earlier than the deadline time of the search position-1, the setting example 1 adopts the setting example 1 because the execution of the monitoring task 84 is slower.
Wake-up position 834: Search position-1, and time T1
(However, the deadline time of time T1> search position-1)
In this case, the latest time T1 less than FTTI is set at the wake-up position 834 together with the line number of the search position-1. That is, the wake-up position 834 is set to the time T1 at which the FTTI cannot be observed if it is later than this.

In the case of FIG. 12, it is as follows.
Exceeded time E = total time G-FTTI = 28-25 = 3
Wake-up time = Deadline time of search position-Exceeded time E
= 1076-3
= 1073
= Time T1
(Time T1 = 1073> Deadline time of search position-1 = 1068)
At the wake-up position 834, the line number 1 and the time T1 = 1703, which is the wake-up time, are set.
Wake-up position 834: Search position-1 = line number 1, and time T1 = 1703

Setting example 3 of wake-up position 834
Along with the line number of the search position-1, the time T2 between the setting example 1 and the setting example 2 described above is set at the wake-up position 834.
In the case of FIG. 12, the time T2 may be between 1068 and 1073.
As a specific example, when the time between the setting example 1 and the setting example 2 is set to the wake-up position 834, the time is as follows. However, when the time T2 is earlier than the deadline time of the search position-1, the setting example 1 adopts the setting example 1 because the execution of the monitoring task 84 is slower.
Wake-up time = (time of setting example 1 + time of setting example 2) ÷ 2 = T2
(However, the deadline time of T2> search position-1)

In the case of FIG. 12, it is as follows.
Wake-up time = (1068 + 1073) / 2
= 1070.5
= Time T2
(Time T2 = 1070.5> Deadline time of search position-1 = 1068)
At the wake-up position 834, the line number 1 and the time T2 = 1070.5, which is the wake-up time, are set.
Wake-up position 834: Search position-1 = line number 1, and time T1 = 1070.5

Setting example 4 of wake-up position 834
When the abnormal treatment unit 842 sets the abnormal treatment as a common abnormal treatment for all tasks, the abnormal treatment time is the same for all tasks. Therefore, the search table 837 is no longer necessary, and the determination may be made using only the total time G at the first search position 838.
Specifically, each time 1 is added to the search position, the wake-up time setting unit 844 determines whether the total time G obtained by adding the abnormal treatment time to the non-detection time of the first search position 838 is less than FTTI. ..
When the total time G calculated by the first search position 838 exceeds the FTTI, the wake-up time setting unit 844 sets the search position -1 to the wake-up position 834 as in the setting example 1.
Wake-up position 834 = Search position-1

In FIG. 12, assuming that the abnormal treatment time is the same for all tasks and the abnormal treatment time = 11, the total time G calculated by the first search position 838 in step S805 is calculated as follows.
First search: Total time G = Undetected time of first search position 838 0 + 8 = 8
Second search: Total time G = No detection time at first search position 838 2 + 8 = 10
Third search: Total time G = Undetected time of first search position 838 12 + 8 = 20
Fourth search: Total time G = Undetected time of first search position 838 20 + 8 = 28
In the fourth search, the wake-up time setting unit 844 sets the line number 1 of the search position -1 to the wake-up position because the total time G calculated by the first search position 838 exceeds the FTTI. Set to 834.

The abnormal treatment time differs for each execution task, and if the abnormal treatment time of task 1 in FIG. 11 is 16, the third search will result in the following.

(Step S805)
First row of search table 837: No detection time = 1068-1056 = 12
First row of search table 837: Total time G = 12 + 8 = 20
Second row of search table 837: No detection time = 1068-1058 = 10
Second row of search table 837: total time G = 10 + 16 = 26
Third row of search table 837: No detection time = 1068-1068 = 0
Third row of search table 837: Total time G = 0 + 16 = 16

(Step S806)
First row of search table 837: FTTI = 25> total time G = 20
Second row of search table 837: FTTI = 25 <total time G = 26
3rd row of search table 837: FTTI = 25> total time G = 16

In the second row of the search table 837, FTTI = 25 <total time G = 26. The search ends with the total time G calculated by the second search position 838.
As described above, when the abnormal treatment time is different for each execution task, it cannot be determined using only the total time G calculated by the first search position 838.

In this way, the wake-up time setting unit 844 calculates the total time from the deadline time of each execution task and the abnormal treatment time of each execution task, and the total time is calculated from the wake-up time of the previous monitoring task. Then, the time that is after the latest deadline time that is less than the allowable safety time and is less than the allowable safety time calculated from the wake-up time of the previous monitoring task is set as the next wake-up time of the monitoring task. , The monitoring task is woken up at the wake-up time.

(Step S808)
The wake-up time setting unit 844 initializes the contents of the search table 837. This is because the search table 837 is created every time the monitoring task 84 wakes up, and the value of the search table 837 does not need to be carried over to the next cycle.

(Step S809)
When the wake-up time (time T1 or time T2) is not set at the wake-up position 834, the wake-up time setting unit 844 acquires the line number of the wake-up position 834 and sets the dead line number in the deadline table 831. Get the line time as the wake-up time.
When the wake-up time (time T1 or time T2) is set at the wake-up position 834, the wake-up time setting unit 844 acquires the wake-up time set at the wake-up position 834.
The wake-up time setting unit 844 calculates the difference between the wake-up time and the current time, and sets the timer 20 as the dormant time of the monitoring task 84.

<Characteristics of the embodiment>
The task abnormality monitoring device of this embodiment includes the following.
1. 1. Task information update unit 872, which notifies the monitoring task of the execution task cycle, wake-up time, and deadline time.
2. Deadline table update unit 843, which generates a deadline table 831 that stores the time when the execution task calculated from the task information reaches the deadline.
3. 3. Wake-up time setting unit 844, which sets the latest time within the range that satisfies FTTI as the next wake-up time based on the deadline table 831 and the abnormal treatment time for each execution task.
4. In the deadline table 831, the tasks from the task that completed the abnormality judgment at the time of the previous wakeup to the task at the deadline time set at the wakeup time this time are set as the tasks subject to the abnormality judgment, and the end time of the execution task is the previous value of the deadline time. Abnormality determination unit 841 that performs abnormality determination based on whether or not it is within the latest value,
5. Execution time recording unit 861 that writes to the task execution log 881 of the ring buffer structure that stores the time when the processing of the execution task is completed based on the position information indicating the write destination in the ring buffer structure.
6. Execution time acquisition unit 845 that reads the task execution log 881 based on the position information indicating the read destination in the ring buffer structure.

<Effect in the embodiment>
As described above, in the task abnormality monitoring device according to the first embodiment, the deadline table update unit 843 calculates the deadline time of the execution task 86 and generates the deadline table 831. The abnormality determination unit 841 performs abnormality determination processing in order from the task indicated by the monitoring position 833 based on the deadline table 831. Further, the wake-up time setting unit 844 sets the latest time within the range in which the FTTI can be satisfied as the wake-up time of the next monitoring task 84 based on the deadline table 831.

The processing load in the monitoring function can be roughly divided into three types: (1) wake-up processing of the monitoring task 84, (2) determination processing of the task subject to abnormality determination, and (3) abnormality determination processing. In the task abnormality monitoring device according to the first embodiment, since the latest wake-up time is calculated from the deadline time of the execution task 86 and the FTTI, the number of wake-up times of the monitoring task 84 can be minimized, and the number of wake-ups of the monitoring task 84 can be minimized. The processing load can be reduced. Further, since the abnormality determination processing is performed in order according to the deadline table 831, the determination processing of the abnormality determination target task becomes unnecessary, and the processing load of (2) can be reduced.

<Modification example 1>
In the first embodiment, the task wake-up time table 882 is updated only at the time of initialization and at the time of changing the task configuration. However, the wake-up time of the execution task 86 gradually changes due to the accuracy of the timer 20 or the influence of the interrupt task. There is a possibility of deviation. In preparation for such a case, the task information update unit 872 may periodically update the task wake-up time table 882 (such as once in 10 times), and the deadline table update unit 843 may perform an operation procedure for correcting the deviation. .. In that case, the wake-up time update (task table state = 4) is added to the task table update state 884.

<Modification 2>
In the first embodiment, the abnormality determination target task has been described as a periodic task, but the abnormality determination process may be performed including the interrupt task. When the interrupt task is included in the task subject to abnormality determination, the cycle is set to 0 when the task information update unit 872 updates the task table 883. Further, the deadline table update unit 843 adds only one deadline time to the deadline table 831 for the interrupt task, and the abnormality determination unit 841 deletes the interrupt task from the deadline table after the abnormality determination is completed. By adopting such an operation procedure, it is possible to perform the abnormality determination process of the interrupt task as well as the periodic task.

Embodiment 2.
In the first embodiment, an example of passing the task execution log 881, the task wake-up time table 882, the task table 883, and the task table update state 884 from the task execution unit 85 to the task monitoring unit 83 via the shared memory will be described. bottom. The second embodiment is an example in which, among these data, the task wake-up time table 882 and the task table 883 related to the update information of the task configuration are passed by using the inter-task communication instead of the shared memory. In the second embodiment, only the points different from the first embodiment will be described, and the same points will be omitted.

<Explanation of configuration>
FIG. 21 is a configuration diagram of the task abnormality monitoring device according to the second embodiment. The second embodiment is different from the first embodiment in that the task control unit 87 has a task information transmission unit 873 for transmitting task information by inter-task communication, and the task monitoring unit 83 has a reception task 89.
The receiving task 89 includes a task information receiving unit 891 that receives task information by inter-task communication. Further, in the second embodiment, the reception task 89 includes the deadline table update unit 843 and the wake-up time setting unit 844 provided in the monitoring task 84 in the first embodiment.
When the configuration of the execution task is updated, the task information transmission unit 873 transmits task information including the execution task cycle, the wake-up time of the execution task, and the deadline time of the execution task by inter-task communication.
The task information receiving unit 891 receives the task information.

In FIG. 21, the task information transmission unit 873 is included in the task control unit 87, but a task dedicated to the transmission function may be prepared.
The task monitoring unit 83 stores the task wake-up time table 882a and the task table 883a in the data area 82. The task execution unit 85 stores the task wake-up time table 882b and the task table 883b in the data area 82.

FIG. 22 shows an example of the deadline table 831 according to the second embodiment. In the second embodiment, an item called a wake-up time is added on the deadline table 831, and the monitoring task 84 sets the sleep time in the timer 20 according to the wake-up time.

FIG. 23 is a flowchart of the task control unit 87 during normal operation. The operations of steps S401 to S406 of FIG. 23 are the same as the operations of steps S401 to S406 in the flowchart shown in FIG. Therefore, only the newly added step S407 will be described here.

(Step S407)
When the task configuration is changed, the task information transmission unit 873 transmits the task table 883b and the task wake-up time table 882b to the monitoring task. As a preferable transmission method, communication using a queue, socket communication, or the like can be considered. Unlike the first embodiment, the task table 883b and the task wake-up time table 882b are stored in the local area instead of the shared unit, so that exclusive control is not required. Further, since the transmission of the task information means the change of the task configuration, the task information update unit 872 in the first embodiment is also unnecessary.

FIG. 24 is a flowchart at the time of receiving task information in the receiving task 89. The receiving task 89 is a task that wakes up triggered by receiving task information from the task execution unit 85.

(Step S901)
The task information receiving unit 891 stores the task information transmitted from the task execution unit 85 as the task table 883a and the task wake-up time table 882a.

(Step S902)
The deadline table update unit 843 updates the deadline table 831 based on the updated task information. The procedure for updating the deadline table 831 is the same as that except for step S701 and step S710 in FIG.

(Step S903)
The wake-up time setting unit 844 calculates the wake-up time based on the deadline table 831. The procedure for calculating the wake-up time of the wake-up time setting unit 844 is the same as that in FIG. Set to 1. Here, 1 is set in the item of the wake-up time of the line whose deadline time is the wake-up time. Further, by calculating the wake-up time for the major cycle when updating the task configuration, it is not necessary to calculate the wake-up time of the monitoring task 84 by the wake-up time setting unit 844.

(Step S904)
The wake-up time setting unit 844 updates the wake-up position 834 at the wake-up time closest to the current time based on the deadline table 831.

(Step S905)
The wake-up time setting unit 844 sets the timer 20 with the time until the deadline time indicated by the wake-up position 834 as the dormant time.

FIG. 25 is a flowchart of the monitoring task 84 during normal operation.

(Step S1001)
The abnormality determination unit 841 and the abnormality treatment unit 842 perform the abnormality determination process based on the deadline table 831. The operation procedure of the abnormality determination process is the same as that in FIG.

(Step S1002)
The monitoring task 84 updates the wake-up position 834 based on the wake-up time item in the deadline table 831. Specifically, the monitoring task 84 then updates the wake-up position 834 to the line where the wake-up time is set to 1.

(Step S1003)
The monitoring task 84 sets the time until the deadline time indicated by the wake-up position 834 as the dormant time in the timer 20.
In the second embodiment, the receiving task 89 may operate during the operation of the monitoring task 84. Therefore, in the second embodiment, the execution priority of step S1001 in the monitoring task 84 is set to the highest, then the execution priority of the receiving task 89 is set to the highest, and the execution priority of steps S1002 and S1003 in the monitoring task 84 is set. Set the degree to the lowest. By doing so, in the second embodiment, it is possible to always set the wake-up time of the monitoring task 84 according to the latest task configuration. In the monitoring task 84, it is possible to set different execution priorities for each process by adopting a multi-thread configuration.

<Characteristics of the embodiment>
The task abnormality monitoring device of this embodiment includes the following.
1. 1. Task information transmission unit 873, which transmits task information such as the cycle of additional tasks or deletion tasks, deadline time, and wake-up time by inter-task communication when the task configuration is updated.
2. Task information receiver 891, which receives task information by inter-task communication,

<Effect in the embodiment>
In the first embodiment, it has been explained that the monitoring task 84 confirms the update of the task configuration when it wakes up, but there is a possibility that the monitoring task 84 reaches the deadline time of the task added while it is dormant. The second embodiment considers such a possibility. In the second embodiment, the task monitoring unit 83 is immediately notified that the task information updating unit 872 has updated the task table 883. Therefore, in the second embodiment, it is possible to grasp the update of the task configuration in real time, and it is possible to wake up the monitoring task 84 at a time that surely satisfies the FTTI.

100 ECU, 10 CPU, 20 timer, 30 secondary storage device, 40 communication interface, 50 input / output circuit, 60 sensor, 70 actuator, 80 memory, 81 program area, 82 data area, 83 task monitoring unit, 84 monitoring task, 841 abnormality judgment unit, 842 abnormality treatment unit, 843 deadline table update unit, 844 wake-up time setting unit, 845 execution time acquisition unit, 831 deadline table, 832 monitoring log position table, 833 monitoring position, 834 wake-up position, 835 last time Deadline time table, 836 Abnormal treatment time table, 837 search table, 838 search position, 839 monitoring log position, 85 task execution unit, 86 execution task, 861 execution time recording unit, 87 task control unit, 871 task scheduling unit, 872 Task information update unit, 873 task information transmission unit, 851 scheduling table, 852 execution log position table, 859 execution log position, 88 shared unit, 881 task execution log, 882,882a, 882b task wake-up time table, 883,883a, 883b Task table, 884 task table update status, 89 received task, 891 task information receiver.

Claims

A deadline table that stores the time when the deadline of each execution task of multiple execution tasks is reached as the deadline time corresponding to each execution task,
The total time that is not guaranteed to be in a safe state is calculated from the deadline time of each execution task and the abnormal treatment time of each execution task, and the total time is calculated from the wake-up time of the previous monitoring task to allow safety. Among the deadline times that are less than the time, the time that is after the latest deadline time and is less than the safe allowable time calculated from the previous wake-up time of the monitoring task is set as the next wake-up time of the monitoring task. A wake-up time setting unit that wakes up the monitoring task at the wake-up time,
A task abnormality monitoring device including a task monitoring unit that executes the monitoring task that wakes up at the wake-up time.
The deadline table stores the plurality of execution tasks in the order of the deadline time.
The task monitoring unit
An execution task for which a deadline time after the wake-up time is set is set as an abnormality determination target task, and the end time of the abnormality determination target task falls between the previous value of the deadline time and the latest value of the deadline time. The task abnormality monitoring device according to claim 1, further comprising an abnormality determination unit that determines an abnormality based on whether or not the task is abnormal.
An execution time recording unit that stores the time when the processing of the execution task is completed based on the position information indicating the write destination in the ring buffer structure for the task execution log of the ring buffer structure.
The first or second aspect of the task execution log is provided with an execution time acquisition unit that reads the time when the processing of the execution task is completed based on the position information indicating the read destination in the ring buffer structure. Task error monitoring device.
A task information update unit that notifies task information including the execution task cycle, the wake-up time of the execution task, and the deadline time of the execution task.
The task abnormality monitoring device according to any one of claims 1 to 3, further comprising a deadline table update unit that calculates the deadline time based on the task information and updates the deadline table.
When the configuration of the execution task is updated, the task information transmission unit that transmits task information including the execution task cycle, the wake-up time of the execution task, and the deadline time of the execution task by inter-task communication,
The task abnormality monitoring device according to any one of claims 1 to 3, further comprising a task information receiving unit that receives the task information.
From the deadline table, the wake-up time setting unit determines that the deadline time is an execution task after the previous wake-up time, and the deadline time of the execution task and the previous deadline time of the execution task are The execution task whose total time obtained by adding the abnormal treatment time of the execution task to the difference is less than the safety allowable time is searched, and the deadline time of the execution task having the maximum total time among the searched execution tasks is set as the wake-up time. The task abnormality monitoring device according to any one of claims 1 to 5, which is set at a time.
The deadline table stores the time when the deadline of each execution task of multiple execution tasks is reached as the deadline time corresponding to each execution task.
The wake-up time setting unit calculates the total time that is not guaranteed to be in a safe state from the deadline time of each execution task and the abnormal treatment time of each execution task, and the total time is the wake-up time of the previous monitoring task. The time after the latest deadline time, which is less than the allowable safety time calculated from, and less than the allowable safety time calculated from the previous wake-up time of the monitoring task, is the next wake-up time of the monitoring task. Set as a time, wake up the monitoring task at the wake-up time,
A task abnormality monitoring method in which the task monitoring unit executes the monitoring task that wakes up at the wake-up time.
The process of storing the time when the deadline of each execution task of multiple execution tasks is reached in the deadline table as the deadline time corresponding to each execution task,
The total time that is not guaranteed to be in a safe state is calculated from the deadline time of each execution task and the abnormal treatment time of each execution task, and the total time is calculated from the wake-up time of the previous monitoring task to allow safety. Among the deadline times that are less than the time, the time that is after the latest deadline time and is less than the safe allowable time calculated from the previous wake-up time of the monitoring task is set as the next wake-up time of the monitoring task. The wake-up time setting process that wakes up the monitoring task at the wake-up time,
A task abnormality monitoring program that causes a computer to execute a task monitoring process that executes the monitoring task that wakes up at the wake-up time.