DE19959247A1 - Microcomputer for vehicle controller/regulator has code coverage memory receiving information about addresses in program and/or data storage memory addressed by program - Google Patents

Abstract

The microcomputer has a code coverage memory connected to a microprocessor in parallel with a program memory and a data memory via an address bus and a data bus. The code coverage memory receives information about which addresses in the program memory and/or data storage memory are addressed during the running of a control/regulation program from the program memory and operation of the vehicle in the context of read and/or write access. Independent claims are also included for the following: a method of determining the code coverage of a control/regulation program.

Description

State of the art

The present invention relates to a microcomputer, especially for use in a control / re gelling device of a motor vehicle. The control / re control device controls various processes the motor vehicle. Such processes concern, for example Internal combustion engine, the exhaust gas purification system, the Gear arrangement, the drive or brake system of the Motor vehicle. The microcomputer has one Microprocessor, an address bus, a data bus, a Program memory and a data memory. The Microprocessor stands over the address bus and the data bus with the program memory and the data memory in Connection. A control / re is in the program memory filing program, which is part of the Control of the process by the microprocessor is processed.

Because the control device often controls safety-relevant functions of the motor vehicle or regulates, are sent to the control program particularly high requirements regarding freedom from errors  posed. Therefore a control program must be used before use in a control device Motor vehicle extensive testing and testing procedures that are supposed to ensure that the Control program in all its states, d. H. also in all vehicle conditions, safely and works reliably. On the one hand, the control / re programs are becoming increasingly complex and on the other hand due to the short software development cycles less time to check and test the programs for Is available comes an efficient examination of the Control program is becoming increasingly important.

As a possible test and test procedure for programs is it is known from the prior art under Laboratory conditions so-called System Execution Analyzer for Determine the code coverage to use. All of them are connected to an external address bus Addresses of the microprocessor for identification (blackening) in a memory overview. Not at the end of the test marked address areas (test gaps) are in the frame implementation of the program has not been addressed and therefore the corresponding program parts are not been gone through. By analyzing the test gaps can z. B. untested functions, faulty Implementation of functional requirements (programming errors) recognize and eliminate. Programming errors can do this cause certain program paths never to go through be or that certain areas of the program and Data storage remain unused. You can also do this perform that as part of the execution of the program an attempt is made to forbidden or nonexistent Access memory areas.

The method known from the prior art for However, determining code coverage has several disadvantages.  

For one, it can only run under laboratory conditions become. The construction of a laboratory motor vehicle with a Control unit in a software laboratory corresponds in principle a towed engine. The controlled systems are mostly open and it deals with the loads and the sensor signals are often replicas. A realistic analysis of the Control program is, if at all, only approximately possible.

Hence the object of the present invention: the determination of the code coverage of a control / re also for use in a motor vehicle to be able to perform while driving the motor vehicle.

To achieve this object, the invention suggests of the microcomputer of the type mentioned above that the microcomputer has a code cover memory, the parallel to the program memory and the data memory via the address bus and the data bus to the microprocessor is connected, in the code coverage memory Information about which addresses of the Program memory and / or data memory during the Execution of a control program from the Program memory by the microcomputer during a Driving the motor vehicle as part of a writing and / or Read access can be addressed.

Advantages of the invention

According to the microcomputer of the control / Re gelungsgeräts a motor vehicle by the Code coverage memory expanded to include one Control program of the microcomputer under check realistic conditions for accuracy can. It is through the microcomputer according to the invention now possible to control / re code coverage  program while driving the motor vehicle to be able to determine over several driving cycles. While of the various driving cycles, the motor vehicle is in different vehicle conditions and therefore also that Control program in different states brought. The goal is to go through so many driving cycles that the control program in every conceivable Condition is brought and if possible all Run through the program paths of the control program become. With the microcomputer according to the invention is now for the first time a realistic analysis of the control / re program possible.

In a control program, the entire functionality of not just one engine type, but an entire engine class (e.g. diesel engines 4-, 5-, 6- Cylinder of a certain vehicle manufacturer). The different equipment variants (e.g. Engine type; Vehicle speed controller; Manual control, Automatic switching) of the individual motor vehicles accounted for by the fact that in the code of the Control program software switch activated or not be activated. A software switch is, for example. a date (e.g. a data byte) that depends on its Value leads through a certain code path or Not.

If by analyzing the control program due to the data content of the code coverage memory it was found that a particular code path was not there are various reasons for this. The cause must follow the review of the Code coverage can be determined. A cause can be aware of the code path through a software switch laid dead or the applicator incorrectly applied (Application error). Another cause can be that  the test conditions were not met, so here one Test gap exists. This is the case, for example, if one Function only at a very low engine temperature deploys during code coverage verification has not been reached. But it is also possible that the Test conditions do not occur because either a Software error, or because of the applicator technically nonsensical (because never occurring) data or Has applied data combinations. Another cause can be a missing hardware trigger (wrong or not wired processor inputs), which at a certain State or change of state actually one Software routine should start. After all, one The cause is a missing software trigger (e.g. incorrectly via Software configured trigger condition), e.g. triggers an interrupt service routine.

So not everyone rests while reviewing the Code path not traversed on a code path Software error. First the analysis of what has not been done Sourcecodes and the wanted or not wanted Functionality allow a related statement. In addition, the degree of code coverage is more wanted Functionality a measure of software quality, because the Software or function test is part of the Software development process.

The code cover memory does not necessarily have to Part of a microcomputer for use in one Control device of a motor vehicle. Rather, it is also conceivable that the Code coverage memory part of an adaptable Additional device for determining the code coverage of a Control program is. The additional device can be through a connector or an electronic Connection for signal decoupling (interface, bus driver)  a microcomputer for use in a control / re gelungsgerät a motor vehicle can be connected. If the processor of the microcomputer to be checked no additional software to control the additional device and for reading out the data in the code coverage memory the additional device must have its own Microprocessor.

It is in the development of control / re gelungsgeräte usual that over to be adapted Additional devices (e.g. ETKs from ETAS) influence the Programs can be taken. The additional device could then be part of determining the code coverage of such an accessory. The advantage is that on the serial board of the control device additional components for the device for determination the code coverage are necessary. The tests can then be done with the conventional series control device be performed.

According to an advantageous development of the present Invention is proposed that in the Code coverage memory Information about whether an address of the program memory and / or the Data storage in the context of a write access or whether it was addressed as part of a read access. By doing Code coverage memories are therefore not just information about whether an address of the program and Data storage was addressed, but also how it was addressed. Thereby, after determining the Control program one code coverage much more accurate and in-depth analysis of the Functionality of the control program be performed.

According to an advantageous embodiment of the present  Invention is proposed that the Code coverage memory is at least as large, that the entire program memory on the Code coverage memory can be mapped. Preferably, the Code coverage memory so large that the entire addressable memory area of the microprocessor is mappable on the code coverage memory. According to the proposed execution farms, it is possible for everyone Address of the code cover memory a corresponding Address of the program memory or the addressable Allocate memory area of the processor. This will on the one hand the filing of information about which addresses the program and data memory as mentioned, and on the other hand reading the code coverage and the type access for further evaluation is crucial facilitated.

The size of the code cover memory can thereby be optimized that for each address of the Code cover memory fewer bits are available, than for each address of the program memory. According to one preferred embodiment of the present invention suggested that each in the code coverage memory Address 2 bits are available. A 16-bit wide Represented location of the code coverage memory So 8 addresses of the programming memory, one 32-bit Accordingly, the wide memory location represents 16 Addresses.

According to another advantageous development of the The present invention proposes that the Code coverage memory logic for address manipulation having. With the help of this logic, a 32 bit Address of the program memory in an 8 bit address of the Code coverage memory to be converted.  

According to a further preferred embodiment of the The present invention proposes that the logic depending on write control signals and read Control signals generated an identifier on the corresponding address in the code coverage memory is discardable. To do this, the write control signals and the Read control signals via corresponding lines to the Logic of the code coverage memory. The of the Logic generated identifier consists, for example, of several bits, depending on a write or read access different bits to an address of the program memory be set to 1 or 0. However, it is also conceivable that the identifier has only one bit, which in Dependence on a write or read access equal to 0 or equal to 1 is set. The identifier is then on the corresponding address in the code coverage memory filed.

The information on whether and how an address of the Program memory or the data memory addressed was in any way in the Code coverage memory are stored. At volatile The information must be stored in the code coverage memory read out before switching off the supply voltage or be buffered by a battery.

According to yet another advantageous development of the The present invention proposes that the Code coverage memory with a read-write memory has random access and a read-only memory that communicate with each other through logic. The Read-write memory is preferably as a RAM memory and the read-only memory as a flash memory educated. Before switching off the supply voltage the information from the read-write memory in the Read-only memory re-stored. This can be done, for example  a run-on phase of the control device be performed. During an initialization phase of the control device, the content of the Read-only memory after switching on the Supply voltage back into the read-write memory be transmitted. The read-write memory then contains the code coverage that used during the previous Driving cycles was determined. The inspection and test procedure can thus continue where it was before the temporary Interruption has ended.

To analyze the code coverage of the control / re program can set the code coverage on Analyzer are transferred. According to a preferred embodiment of the present invention suggested that the microprocessor of the microcomputer a serial interface and / or a parallel one Interface. At this interface, for example. a control unit connector can be connected via which the Code coverage from the code coverage memory to the Analyzer can be transferred.

The read-write memory is advantageously as one Two-port memory (dual-port RAM) is formed. Two-port stores allow two independent Processors to access common data. That has advantages in particular if, on the one hand, information about whether and how on addresses of the program and Data storage is accessed in the Code coverage memories are stored and on the other hand this information about a serial or parallel Interface of the microcomputer to an external one Analyzer are transmitted.

As a further solution to the present problem, the invention proposes, starting from a method for determining the code coverage of the type mentioned at the outset, a method which is characterized by the following steps:

• - commissioning of the motor vehicle;
• - Go through at least one driving cycle with the Motor vehicle;
• - Collect information about which addresses of the Program and data memory during execution of the control program during the Driving cycle as part of a write and / or Read access was addressed; and
• - Storage of the information in a code coverage memory of the microcomputer.

According to an advantageous development of the present Invention is proposed that information about it is recorded whether an address of the program memory and / or the Data storage in the context of a write access or whether it is addressed as part of a read access, and the Specifications are stored in the code coverage memory. This allows, in addition to specifying whether to a specific address the program and data memory was accessed, too the how determined and in the code coverage memory be filed.

To determine how to the addresses of the program and Is accessed, the invention proposes that write control signals and read control signals to the Code coverage memory are performed.

According to another preferred embodiment of the The present invention proposes that certain Corresponding addresses of the code coverage memory Addresses of the program memory and / or the data memory be assigned and that specifying whether and how a Address of the program memory or the data memory  during the execution of the control program is addressed at the corresponding address of the Code coverage memory is stored.

Advantageously, the code coverage memory can be created using a control signal between a recording mode and a read / delete mode can be switched. By doing Recording mode will indicate whether and how an address of the program memory or the data memory addressed is determined and stored in the code coverage memory. As part of the readout mode, the Information stored in the code cover memory, for example external analyzer can be transmitted. As part of the Clear mode clears the code cover memory.

According to an advantageous development of the present Invention it is proposed that the information on the Code coverage in a read-write memory of the Code coverage memory stored with random access become. Advantageously, the information on the Code coverage at the end of the procedure from the Read-write memory in a read-only memory of the Code coverage memory copied. Preferably the Information about the code coverage of previous driving cycles at the beginning of the procedure from the read-only memory in the Read-write memory copied. The read-write memory is designed, for example, as a RAM memory. The Read-only memory is, for example, as a ROM, in particular as an EPROM, EEPROM or a flash EEPROM.

According to a preferred embodiment of the present Invention it is proposed that the information on the Code coverage at the end of the procedure an appropriate Assigned source code of the control program and the run and / or the not run Source code is marked and output. The information about  the code coverage will be the one in the Program memory stored code of the control / re associated program. The one in the program memory stored code is the result of compiler / assembler and linker runs. The code in the program memory is then the corresponding source code of the control / re associated program. The source code is in one any programming language. Over a Assignment of the information about the code coverage to the Source code can determine the areas of the source code be during the processing of the control / re Control program as part of the test and inspection procedure go through or not go through. These areas of the source code are marked and output. By a Analysis of the output source code can then be relative which software commands or Functionalities were not carried out and whether a There is a programming or application error.

The source code is advantageously displayed on a screen issued by a computer. Then on the computer immediately an analysis of the output source code carried out and the programming error removed if necessary become.

drawings

A preferred embodiment of the present In the following, the invention will be explained in more detail with reference to the drawing explained. It shows:

Fig. 1 shows a microcomputer for use in a control device of a motor vehicle according to a preferred embodiment of the invention.

Description of the embodiment

In Fig. 1, a microcomputer in its entirety is designated by the reference number 1 . The microcomputer 1 is used in a control device of a motor vehicle. The control device is used to control / regulate processes in the motor vehicle. Processes to be controlled or regulated are, for example, the internal combustion engine, the exhaust gas cleaning system, the transmission unit, the drive or brake unit of the motor vehicle. The microcomputer 1 has a microprocessor 2 , a program memory 3 , a data memory 4 and a working memory 5 . The program memory 3 , the data memory 4 and the main memory 5 are connected to the microprocessor 2 via several bus lines. The bus lines include in particular an address bus (ADR) 6 , a data bus (DAT) 7 , a write control line (WR) 8 and a read control line (RD) 9 .

The microcomputer 1 also has a code coverage memory 10 which is connected to the microprocessor 2 in parallel with the program memory 3 and the data memory 4 via the address bus 6 and the data bus 7 . The code coverage memory 10 has a logic 11 , a read / write memory 12 and a read-only memory 13 . The read-write memory 12 is designed as a RAM memory and the read-only memory 13 as a flash EPROM. The read-write memory 12 and the read-only memory 13 are connected to one another via the logic 11 . A further control line (mode) 14 runs between the microprocessor 2 and the logic 11 , by means of which the code coverage memory 10 can be switched between a recording mode and a read / delete mode.

First, the recording mode is discussed in more detail. After the motor vehicle has been started up, the motor vehicle runs through at least one driving cycle. Several driving cycles can be carried out in direct succession or with a time interruption, even with the internal combustion engine being switched off in the meantime. The motor vehicle is operated in different driving states in different driving cycles. As a result, various program paths are run through in a control program running on the microcomputer 1 . The aim is to go through so many different driving cycles that as many program paths of the control program as possible are run through. While the motor vehicle is traveling, information is collected about which addresses of the program memory 3 and the data memory 4 are addressed during the execution of the control program. A distinction is made as to whether an address of the program memory 3 or of the data memory 4 is addressed in the context of a write access (WR) or whether it is addressed in the context of a read access (RD). The information as to whether and how an address of the program memory 3 or of the data memory 4 is addressed is stored in the code coverage memory 10 of the microcomputer 1 .

More specifically, the code coverage information is stored in the random access memory 12 of the code coverage memory 10 . The read-write memory 12 is designed so large that the entire program memory 3 can be mapped to the read-write memory 12 . Thus, an address of the read-write memory 12 can be assigned to each address of the program memory 3 . There is a two-bit memory area available in the random access memory 12 for each address. Depending on the write control signals (WR) 8 and the read control signals (RD) 9 , the logic 11 generates an identifier which is stored in the read / write memory 12 at the corresponding address. The identifier consists, for example, in that the first of the two available bits is set to 1 if the corresponding address of the program memory 3 is accessed as part of a write access, and that the second bit is set to 1 if the corresponding one Address was accessed as part of a read access.

The logic 11 also performs address manipulation. The address of the program memory 3 is mapped to a corresponding address of the read-write memory 12 . As part of the address manipulation, it is also possible, for example, to map a 32-bit address of the program memory 3 to an 8-bit address of the read-write memory 12 .

At the end of a driving cycle, but at least before the supply voltage is switched off, the information about the code coverage is copied from the read-write memory 12 via the logic 11 into the read-only memory 13 . This can be done, for example, in a follow-up phase. After the supply voltage is present again, but at least before one or more further driving cycles are run through, the information about the code coverage of previous driving cycles is copied from the read-only memory 13 via the logic 11 into the read-write memory 12 . This can be done, for example, during an initialization phase. This makes it possible to carry out the method for determining the code coverage even with a time interruption between the individual driving cycles. Furthermore, it is conceivable to copy the information about the code coverage from the read-write memory 12 into the read-only memory 13 at regular time intervals or on an explicit command.

When the code coverage recording is complete, the code coverage memory 10 is switched to the readout mode by means of the control signal 14 . In this mode, the information about the code coverage can be read from the read-write memory 12 or from the read-only memory 13 for evaluation. It is conceivable that the microprocessor 2 has the serial and / or parallel interface (not shown), via which the information about the code coverage can be transmitted to an analysis device (not shown). For this purpose, an analyzer plug can be connected to a serial or parallel interface of the microprocessor 2 . The read-write memory 12 is preferably designed as a two-port memory (dual-port RAM), so that both the logic 11 and the evaluation device can access the information about the code coverage in the read-write memory 12 .

In the analyzer, the information about the Code coverage a corresponding source code of the Control program assigned. The run through or the source code that has not been run through is marked and output on a screen of a computer. So can For example, the source code that is output during the Memory areas not addressed during the recording phase calls. Then you can use the specified source code be checked why the memory area is not is addressed. If a programming error is found the source code can be processed on the computer immediately become.

Claims (21)

1. Microcomputer ( 1 ), in particular for use in a control device for controlling a process in a motor vehicle, with a microprocessor ( 2 ), an address bus (ADR; 6 ), a data bus (DAT; 7 ), one Program memory ( 3 ) and a data memory ( 4 ), the microprocessor ( 2 ) being connected to the program memory ( 3 ) and the data memory ( 4 ) via the address bus (ADR; 6 ) and the data bus (DAT; 7 ), thereby characterized in that the microcomputer ( 1 ) has a code coverage memory ( 10 ) which, in parallel to the program memory ( 3 ) and the data memory ( 4 ) via the address bus (ADR; 6 ) and the data bus (DAT; 7 ) to the microprocessor ( 2 ) is connected, in the code cover memory ( 10 ) information can be stored about which addresses of the program memory ( 3 ) and / or the data memory ( 4 ) during the execution of a control program from the program memory ( 3 ) by the microco mputer ( 1 ) during a drive of the motor vehicle in the context of a write and / or read access. 2. Microcomputer ( 1 ) according to claim 1, characterized in that in the code cover memory ( 10 ) information can be stored as to whether an address of the program memory ( 3 ) and / or the data memory ( 4 ) in the context of a write access or whether it is in the frame a read access was addressed. 3. Microcomputer ( 1 ) according to claim 1 or 2, characterized in that the code cover memory ( 10 ) is at least so large that the entire program memory ( 3 ) on the code cover memory ( 10 ) can be mapped. 4. Microcomputer ( 1 ) according to claim 3, characterized in that the code cover memory ( 10 ) is formed so large that the entire addressable memory area of the microprocessor ( 2 ) on the code cover memory ( 10 ) can be mapped. 5. Microcomputer ( 1 ) according to one of claims 1 to 4, characterized in that 2 bits are available per address in the code coverage memory ( 10 ). 6. Microcomputer ( 1 ) according to one of claims 1 to 5, characterized in that the code coverage memory ( 10 ) has logic ( 11 ) for address manipulation. 7. Microcomputer ( 1 ) according to claim 6, characterized in that the logic ( 11 ) in dependence on write control signals (WR; 8 ) and read control signals (RD; 9) generates an identifier which at the corresponding address in the Code coverage memory ( 10 ) can be stored. 8. The microcomputer ( 1 ) according to claim 6 or 7, characterized in that the code cover memory ( 10 ) has a random access memory ( 12 ) and a read-only memory ( 13 ) which are connected to one another via the logic ( 11 ) Connect. 9. microcomputer ( 1 ) according to claim 8, characterized in that the read-write memory ( 12 ) as a RAM memory and / or the read-only memory ( 13 ) is designed as a flash memory. 10. Microcomputer ( 1 ) according to one of claims 1 to 9, characterized in that the microprocessor ( 2 ) of the microcomputer ( 1 ) has a serial interface and / or a parallel interface. 11. Microcomputer ( 1 ) according to one of claims 8 to 10, characterized in that the read-write memory ( 12 ) is designed as a two-port memory (dual-port RAM). 12. A method for determining the code coverage of a control / regulation program of a microcomputer ( 1 ), in particular for use in a control / regulation device for controlling / regulating a process in a motor vehicle, with a microprocessor ( 2 ), an address bus (ADR; 6 ), a data bus (DAT; 7 ), a program memory ( 3 ) and a data memory ( 4 ), the microprocessor ( 2 ) via the address bus (ADR; 6 ) and data bus (DAT; 7 ) with the program memory ( 3 ) and is connected to the data memory ( 4 ), characterized by the following steps:

• - commissioning of the motor vehicle;
• - Running through at least one driving cycle with the motor vehicle;
• - Collecting information about which addresses of the program memory ( 3 ) and the data memory ( 4 ) are addressed during the execution of the control / regulation program during the driving cycle as part of a write and / or read access; and
• - Storage of the information in a code coverage memory ( 10 ) of the microcomputer ( 1 ).

13. The method according to claim 12, characterized in that information is recorded as to whether an address of the program memory ( 3 ) and / or the data memory ( 4 ) in the context of a write access or whether it is addressed in the context of a read access, and the information in the code coverage memory ( 10 ) are stored. 14. The method according to claim 13, characterized in that write control signals (WR; 8 ) and read control signals (RD; 9 ) are passed to the code coverage memory ( 10 ). 15. The method according to any one of claims 12 to 14, characterized in that certain addresses of the code coverage memory ( 10 ) are assigned corresponding addresses of the program memory ( 3 ) and / or the data memory ( 4 ) and that the specification of whether and how an address of the Program memory ( 3 ) or the data memory ( 4 ) is addressed during the execution of the control / regulation program, is stored at the corresponding address of the code cover memory ( 10 ). 16. The method according to any one of claims 12 to 15, characterized in that the code coverage memory ( 10 ) by means of a control signal (mode; 14 ) is switched between a recording mode and a read / erase mode. 17. The method according to any one of claims 12 to 16, characterized in that the information about the code coverage in a read-write memory ( 12 ) of the code coverage memory ( 10 ) are stored with random access. 18. The method according to claim 17, characterized in that at the end of the method, the information about the code coverage from the read-write memory ( 12 ) is copied into a read-only memory ( 13 ) of the code coverage memory ( 10 ). 19. The method according to claim 18, characterized in that at the beginning of the method, the information about the code coverage of previous driving cycles is copied from the read-only memory ( 13 ) into the read-write memory ( 12 ). 20. The method according to any one of claims 12 to 19, characterized marked that the information about the code coverage on A corresponding source code of the Control program can be assigned and the passed through and / or not through the source code marked and output. 21. The method according to claim 20, characterized in that the source code on a computer screen is issued.