DE102009010004A1 - Device i.e. digital tachograph, operation monitoring method, involves detecting failure of operation of digital tachograph when actual value of memory stack pointer deviates from reference value of memory stack pointer - Google Patents

Abstract

The method involves determining an actual value (AV) of a memory stack pointer (SP) of a memory stack (ST) at a position within a program sequence of an executable program (PROG). The determined actual value of the memory stack pointer is compared with a preset reference value (STP) of the memory stack pointer. Failure of an operation of a digital tachograph is detected when the actual value of the memory stack pointer deviates from the reference value of the memory stack pointer. An identifier for detection of the failure is stored in an error memory (EM). An independent claim is also included for a device for monitoring an operation of a digital tachograph.

Description

The The invention relates to a method for monitoring an operation of a Device and device adapted for monitoring their operation. The invention particularly relates to a digital Tachographs as the device.

digital Tachographs have at least one computing device and at least a memory on. In the at least one memory is at least a program stored by the at least one computing device executable is. Error in a program execution of the at least one Program can for example, to an undesirable overwriting lead from memory cells or memory areas of the memory. This can be a permanently reliable Operating the tachograph impair.

The The object of the invention is a method for monitoring an operation of a Device and device adapted for monitoring of their operation, to create, by or through which a mistake easily and reliably recognizable in the operation of the device is.

The Task is solved by the characteristics of the independent Claims. Advantageous developments of the invention are characterized in the subclaims.

The Invention is characterized by a method for monitoring an operation of a device and by a corresponding device, the is designed for monitoring their operation. In the device are a stack and a associated Stack memory pointer provided. In the device is at least a program executable. At at least one first position within a program sequence this at least one executable Program is an actual value of the stack pointer of the Stack memory determined. The respective determined actual value of the Stack memory pointer is provided with a respective predetermined setpoint compared to the stack memory pointer. An error of operation of the Device is detected when the respective actual value of the stack memory pointer from the respectively associated The setpoint of the stack pointer deviates.

Of the The advantage is that deviations of the actual value from the nominal value of the Stack memory pointers are very easily recognizable and present such a deviation on a faulty operation of the device can be closed. The operation of the device can be so much easily and reliably monitored can be very and at detecting the error of the operation easy action be initiated to the correct operation of the device again For example, by restarting the device is brought about. Negative effects of faulty operation of the device can be minimized so easily. The device can be so durable reliable operate. Preferably, the respective actual value of the stack memory pointer determined by a respective program instruction, which at the respective first position in the program flow is arranged.

In an advantageous embodiment is the respective predetermined Setpoint of the stack pointer as a respective constant specified. This has the advantage that such a constant in the Compared to a variable better protected against unwanted changes can, for example, by a faulty program flow or operation can be caused. The operation of the device can be so safe and reliable. The respective constant is preferably already in a production predetermined the device.

alternative For this it is advantageous if at least a second position within the program, each of a first position is assigned, in each case the actual value of the stack memory pointer determined becomes. The respective determined at the at least one second position Actual value of the stack memory pointer is given as the respective predetermined Specified setpoint of the stack memory pointer. The advantage is, that then no constant already in the manufacture of the device must be specified. This is very easy. Preferably the respective determined at the at least one second position Actual value of the stack to at least one of the Stack memory pointer different storage location stored. Of the respective setpoint is preferably from this respective at least read a memory location.

In this context, it is advantageous if at least one of the at least one second position in the program sequence is arranged in each case before a call of a respective subroutine and the respectively associated first position in the program sequence is arranged in each case after this call of this respective subroutine. This has the advantage that errors that are related to this particular subroutine and that change the stack memory pointer undesirably, are easily and reliably recognizable. Subroutine calls, for example, optionally provided transfer parameters and / or a return address are stored on the stack and the actual value of the stack memory pointer changed accordingly. After correct execution of the In general, the subroutine must have the actual value of the stack pointer unchanged from the setpoint value of the stack pointer that was determined before the subroutine was called, that is, all elements that were placed on the stack in connection with executing this subroutine must also have been removed. This is so easily verifiable and the error is very easily recognizable.

In In this context, it is also advantageous if the respective Subprogram is assigned a respective identifier and the identifier is stored in a fault memory when the error is detected. The advantage is that the occurrence of the error is so easy to understand is and can be used to improve the device so that the error will not occur in the future. Preferably be with the identifier also the actual value of the stack memory pointer and / or a content of the stack is stored in the error memory.

In a further advantageous embodiment is at least one of at least one second position equal to the associated at least a first position. Determining the respective actual value of the Stack memory pointer for these at least one associated second position and the default as the associated predetermined setpoint only for a first time run of the program run. Determining the respective actual value of the stack pointer for this at least one associated first position and comparing with the respectively associated predetermined Reference values are executed in further executions of the program sequence. Of the Operation of the device is so particularly easy to verify. in the Generally, the actual value of the stack pointer is at a given value The position of the program sequence is the same every time the program is executed, if the operation is faultless. The mistake is so simple and reliable recognizable.

In a further advantageous embodiment of each predetermined Setpoint of the stack pointer to at least three memory locations stored in different memory areas. For the Compare with the respective associated actual value, the respective at least three memory locations are read and will be the one each Value selected as the respective predetermined setpoint, which consists of at least two the at least three memory locations have been read consistently. This has the advantage that this is particularly safe. Even if one of the stored setpoints is overwritten by the error and thus changed should be, the error can be reliably detected.

In a further advantageous embodiment of the device is the Device designed as a digital tachograph. The tachograph is so permanently reliable operated.

embodiments The invention are explained below with reference to the schematic drawings. It demonstrate:

1 a device

2 a first flowchart and

3 a second flowchart.

elements same construction or function are cross-figurative with the same Provided with reference numerals.

A device comprises at least one computing device CPU and at least one memory MEM, which is electrically coupled to the at least one computing device CPU ( 1 ). Furthermore, the device may also include one or more than one interface device IF that is electrically coupled to the at least one computing device CPU. At least one program PROG is stored in the at least one memory MEM that can be executed by the device and in particular by the at least one computing device CPU. The at least one program PROG comprises, for example, at least one subroutine F and preferably at least one control subroutine, for example at least one first control subroutine F1 and / or at least one second control subroutine F2. The at least one subroutine F, first control subroutine F1 and second control subroutine F2 can also be referred to as a function. Furthermore, at least one fault memory EM is preferably provided, which is arranged, for example, in the at least one memory MEM.

The device further comprises at least one stack ST, which may also be referred to as a "stack". The at least one stack ST is preferably arranged in the at least one memory MEM and comprises a predetermined number of memory locations, which is predetermined so that a plurality of elements can be stored on the stack ST, that is, can be stored therein. In particular, the elements comprise local variables within subroutines such as the at least one subroutine F, the at least one control subroutine F1 or the at least one control subroutine F2. However, the elements may also include, for example, return addresses and / or transfer parameters of such subroutines. The respective stack ST is assigned a stack memory pointer SP, which is also known as "Stackpointer" can be called. The stack memory pointer SP is preferably arranged in the at least one memory MEM. However, the stack memory pointer SP can also be arranged, for example, in a register of the at least one computing device CPU.

Preferably is the at least one stack ST and the respective associated stack memory pointer SP while a development or manufacture of the device and in particular of the at least one PROG program through a translation program that too referred to as a "compiler" can be, for example, created or created by a C compiler, such that the at least one stack memory ST and the respectively associated stack memory pointer SP while a program sequence of at least one program PROG available. The at least one stack ST and the respective associated stack memory pointer SP can but also be made available in other ways.

One Actual value AV of the respective stack memory pointer SP points at correct Operation of the device to a storage location of the associated stack ST. If an element is placed on the stack ST, this becomes stored at this memory location and the actual value AV of Stack memory pointer SP changed so that this one on next Storage location of the stack ST shows. With a removal of an element of the stack ST becomes the actual value AV of the Stack memory pointer SP changed so that this to the location of the last deposited element shows and this element is read. An order in relation on changing the actual value AV of the stack memory pointer SP on the one hand and the Saving or reading the element on the other hand can also be the other way around. The at least one stack ST is so according to a "last-in-first-out" principle, or in short: LIFO, operated, that is, the most recently filed Element is removed first again.

The Device is designed in particular as a tachograph and preferably has security devices that unauthorized manipulation Prevent the device or at least make it recognizable. Especially For example, it may be provided a content of the memory To at least partially erase MEM, to prevent unauthorized reading of confidential information, if an unauthorized manipulation of the device, for example, a unauthorized opening a housing the device was detected. In particular, can also be provided be at least one program PROG delete when unauthorized manipulation was detected.

For monitoring an operation of the device, the at least one control subroutine E1 and / or the at least one control subroutine F2 are provided. 2 shows a first flowchart, which in particular essentially represents the at least one first control subroutine F1. This begins in a step S1. A step S2 may be provided, in which the actual value AV of the stack memory pointer SP is determined, for example by reading the memory location at which the stack memory pointer SP is stored. A step S3 may be provided, in which the determined actual value AV of the stack memory pointer SP is specified as a predetermined desired value STP of the stack memory pointer SP. The setpoint value STP of the stack memory pointer SP is preferably stored at at least one memory location, for example in the at least one memory MEM. In 1 this at least one memory location is marked in each case as a stored stack memory pointer SSP. A step S4 may be provided in which the at least one subprogram F is called and executed.

In a step S5, the actual value AV of the stack memory pointer SP determined, for example, by reading the memory location at the the stack memory pointer SP is stored. In a step S6 the predetermined setpoint STP of the stack memory pointer SP is determined, for example, by reading a current value of the at least a stored stack pointer SSP. In one step S7 is checked if the Actual value AV of the stack pointer SP from the setpoint STP of the stack pointer SP deviates. Both agree, then the at least one first control subroutine F1 in a step 58 finished. However, in step S7, a deviation detected, then in a step S9, an error ERR of the operation the device recognized. Preferably, the error ERR is in the stored at least one error memory EM. Preference is the at least one subroutine F each have a unique identifier and this identifier is also in the at least one Error memory EM stored. Furthermore, it may be advantageous in the presence of the error ERR also a content of the stack ST and / or the associated Stack memory pointer SP in the at least one fault memory To save EM. Preferably, measures are taken in step S9 initiated to restore the correct operation of the device. Preferably, the device is restarted automatically.

Preferably, the steps S5 and S6 are executed at a first position P1 of the program flow of the program PROG, and the steps S2 and S3 are executed at a second position P2 of the program flow of the program PROG leads. Preferably, the second position P2 is in each case before and preferably immediately before the call of the at least one subroutine F and the first position P1 in the program sequence is after and preferably immediately after this at least one subroutine F. This undesirable changes the actual value AV of the stack memory pointer SP , which occur in the context of the call and execution of the at least one subroutine F, easily and reliably recognizable.

Especially Alternatively to the steps S2 and S3, a step S10 may also be used be provided in which the setpoint STP of the stack memory pointer SP is specified as a constant C and the setpoint STP of the stack memory pointer SP thus independent predetermined by the respective actual value AV of the stack memory pointer SP is.

The At least one first control subroutine F1 can be designed for this purpose be that at least one subroutine F or calling the at least to encapsulate a subroutine F. Preferably, at the respective Calling the at least one first control subroutine F1 a subroutine pointer Passing FP as transfer parameter, pointing to the at least one subprogram F to be called. Instead of the at least one subroutine F directly in the program PROG call, the at least one control subroutine F1 is called and this the subprogram pointer associated with the subroutine F to call Pass FP. Furthermore, the at least one first control subroutine F1 preferably also pass the identifier FID as a transfer parameter. However, the at least one first control subroutine F1 can also be trained differently.

3 shows a second flowchart, which in particular essentially represents the at least one second control subroutine F2. This starts in a step S11. In a step S12, it is checked whether the at least one second control subroutine F2 is executed for the first time after a start or after a start of operation of the device. If this is the case, then in steps S13 and S14, which essentially correspond to steps S2 and S3, the actual value AV of the stack memory pointer SP is determined and specified as the desired value STP of the stack pointer SP. The at least one second control subroutine F2 ends in a step S15.

Becomes however, in step S12, it is determined that the at least one second control subroutine F2 was previously executed and therefore steps S13 and S14 have already been performed, then be in steps S16 and S17, which are essentially the steps S5 and S6 correspond to the actual value AV of the stack pointer SP and the setpoint STP of the stack memory pointer SP determined. In a step S18 substantially corresponding to the step S7, is checked if the Actual value AV of the stack pointer SP from the setpoint STP of Stack memory pointer SP deviates. If this is not the case, then the at least one second control subroutine F2 in the step S15. Otherwise, in a step S19, which substantially corresponds to the step S9, the error ERR of Operation of the device detected. It can also be provided to store the error ERR in the at least one error memory EM. Furthermore, it may be advantageous, in the presence of the ERR error as well the contents of the stack ST and / or the associated stack memory pointer SP to save in the at least one error memory EM. That at least a second control subroutine F2 ends in step S15. Preferably In the step S19 measures are initiated to restore the correct operation of the device. Prefers the device is restarted automatically. Preferably, the vote first position P1 and the second position P2 match, so the steps S13, S14 on the one hand, and the steps S16, S17 on the other the same position of the program execution of the PROG program.

Preferably, at least one program PROG comprises a program loop and in particular a main program loop ( 1 ). In this program loop, the at least one first and / or second control subroutine F1, F2 are preferably called. The at least one second check subroutine F2 checks whether the actual value AV of the stack pointer SP at the respective position of the program sequence at which the at least one second check subroutine F2 is called is correct, ie has the same value each time it passes through the program loop So it remains unchanged. The at least one first control subroutine F1 preferably encapsulates the respective call of the at least one subroutine F and, in particular, checks whether the actual value AV of the stack memory pointer SP is changed undesirably by executing this respective subroutine F, that is, if the actual value AV of the stack pointer SP after the Execution of the at least one subroutine F is equal to the actual value AV of the stack memory pointer SP before executing the at least one subroutine F.

For example, at least two subprograms F are provided. For example, a first subroutine is called by the at least two subroutines F in the program PROG by the at least one first control sub Program F1 is executed with a first identifier FID1 and a first subroutine pointer FP1 as a transfer parameter. The first identifier FID1 and the first subroutine pointer FP1 are assigned to the first subroutine. Accordingly, a second subroutine is called by the at least two subroutines F in the program PROG by executing the at least one first control subroutine F1 with a second identifier FID2 and a second subroutine pointer FP2 as the transfer parameter. The second identifier FID2 and the second subroutine pointer FP2 are assigned to the second subroutine. The same can be provided for further subprograms F.

It can also be provided that respective program steps of at least a first or second control subroutine F1, F2 immediately in the PROG program and in particular in the program loop of the Program PROG are arranged, so not in a respective subroutine or control subroutine are arranged.

Preferably is the respective set value STP of the stack memory pointer SP stored at least three memory locations. Preferably lie these locations in different memory areas, so that the risk is low, that all of the at least three storage locations unwanted overwritten become. Preferably, in the context of determining the respective Setpoint STP of the stack pointer SP, in particular in the Steps S6 and S17, all of the at least three memory locations read, in which the setpoint STP of the stack pointer SP previously stored has been. Furthermore, it is preferably checked whether the Values of the stored stack pointers SSP match. If these do not match, then preferably a corresponding entry in the at least stored a fault memory EM. Further, it is preferable that one Value specified as the desired value STP of the stack pointer SP, the stored on at least two of the at least three memory locations coincident is.

Claims (9)

Method for monitoring an operation of a Device in which a stack (ST) and an associated stack memory pointer (SP) are provided and in which at least one program (PROG) is executable, in which - at at least one first position (P1) within a program sequence this at least one executable Program (PROG) in each case an actual value (AV) of the stack memory pointer (SP) of the stack (ST) is determined, - the respective determined actual value (AV) of the stack memory pointer (SP) with a each predetermined setpoint (STP) of the stack memory pointer (SP) is compared and - one Error of operation of the device is detected when the respective Actual value (AV) of the stack memory pointer (SP) from the respectively associated setpoint (STP) of the stack pointer (SP). The method of claim 1, wherein the respective Setpoint (STP) of the stack pointer (SP) as a respective one Constant (C) is given. The method of claim 1, wherein - at least a second position (P2) within the program flow, respectively a first position (P1) is assigned, in each case the actual value (AV) of the Stack memory pointer (SP) is determined, and - the on the at least one second position (P2) determined respective Actual value (AV) of the stack memory pointer (SP) as the respectively associated predetermined setpoint (STP) of the stack memory pointer (SP) is specified. The method of claim 3, wherein - at least one of the at least one second position (P2) in the program sequence each before a call of a respective subroutine (F) arranged is and - the respectively associated first position (P1) in the program sequence after each call this respective subroutine (F) is arranged. The method of claim 4, wherein - the respective Subroutine (F) is assigned a respective identifier (FID) and - the identifier (FID) stored in error memory (EM) when the error is detected becomes. Method according to one of claims 3 to 5, in which - at least one of the at least one second position (P2) equal to the associated at least a first position (P1), - Determining the respective Actual value (AV) of the stack pointer (SP) for this at least one associated second Position (P2) and the default as the associated preset setpoint (STP) only for a first time run of the program run be and - the Determining the respective actual value (AV) of the stack pointer (SP) for this at least one associated first position (P1) and the comparison with the respectively associated predetermined Setpoint (STP) for other versions of the program run become. Method according to one of Claims 3 to 6, in which - the respectively predetermined desired value (STP) of the stack memory pointer (SP) is stored at at least three memory locations in mutually different memory areas and - for comparing with the respectively associated actual value (AV) the respective at least three memory locations are read and in each case that value is selected as the respective predetermined setpoint value (STP), which has been read concurrently from at least two of the at least three storage locations. Device adapted for monitoring of their operation and in the - one Stack memory (ST) and - one associated Stack memory pointer (SP) are provided and in the at least a program (PROG) executable is and that is trained - to determine one each Actual value (AV) of the stack memory pointer (SP) of the stack (ST) at at least a first position (P1) within a program sequence this at least one executable Program (PROG), - to the Compare the respective determined actual value (AV) of the stack pointer (SP) with a respective predetermined setpoint (STP) of the stack memory pointer (SP) and - to the Detecting a failure of the operation of the device, if the respective Actual value (AV) of the stack memory pointer (SP) from the respectively associated setpoint (STP) of the stack pointer (SP). Apparatus according to claim 8, which is a digital Tachograph is formed.