JP2010160716A - Verification device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a verification device of a program, wherein influence of presence/absence of a verification code on temporal behavior of a code amount or a control system is reduced. <P>SOLUTION: This verification device verifying an execution time of a task by a CPU 50 includes: a storage means 10 storing a program described with a task code of the task executed by the CPU 50, a first instruction for starting a timer 15 described immediately before the task code; a second instruction for stopping the timer 15 described after the task code; a means 12 starting the timer 15 by only once executing only the first instruction, and means 17, 15, 18, 19, 14 stopping the timer 15 by only once executing only the second instruction, measuring the execution time, and applying statistical processing to a plurality of the execution times obtained by a plurality of pieces of the execution of the task. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a verification apparatus that verifies whether a task is executed as designed, and more particularly to a verification apparatus that measures the execution time of a task.

  In the control system, very severe restrictions are imposed on the task execution timing. For example, even if the control system moves according to the program flowchart, it does not operate as expected if the task execution timing deviates beyond an allowable range. For this reason, development often proceeds while verifying whether a task is executed as designed (see, for example, Patent Document 1). Patent Document 1 discloses that a verification program for verifying the influence of interrupt generation timing on the operation time of a control system is executed without consuming CPU instruction execution time. The verification apparatus which verifies the control system by eliminating the influence on the system is described.

  However, the verification device described in Patent Document 1 has a problem that the cost is increased because the interrupt test device needs to be mounted separately from the CPU. In addition, only the influence of the interrupt on the operation time of the control system can be verified.

  By the way, there is known a method for verifying whether a task execution timing satisfies a design specification using a timer. In this method, a verification code for verification for measuring the task execution time is described in the control system, and the task execution time is strictly measured together with the execution of the control system. By recording the measurement result of the execution time, it is possible to verify whether or not the design specification is satisfied, and if so, how much room is available for the specification.

  FIG. 1 is a diagram illustrating an example of a conventional verification code. This verification code describes a procedure for measuring the execution time of a “Timing Critical Job” task corresponding to an interrupt caused by the occurrence of an interrupt factor, for example.

  Before executing the “Timing Critical job” task, create a new timer instance with “Timer_inst ()” and start the timer with “Timer_start ()”. When the timer is started, the "Timing Critical job" task is executed.

  When the “Timing Critical job” task ends, the timer is stopped by “Timer_stop ()”. The execution time is stored in the memory. Here, the same task may be repeatedly executed in the control system, but even if it is the same task, the execution time is not completely the same depending on I / O waiting, execution status of other tasks, and the like. For this reason, the verification code is stored without overwriting the execution time each time the “Timing Critical job” task is executed.

  Then, the execution time statistical data is calculated by executing the verification code. That is, the minimum execution time of a plurality of execution times is determined by “Calc_min ()”, the maximum execution time of a plurality of execution times is determined by “Calc_max ()”, and “Calc_average ()” An average value of a plurality of execution times is calculated. Further, in order to determine whether or not the execution time satisfies the specification, for example, a difference between the maximum execution time and the maximum allowable time is calculated by “Check_dedline ()”.

By writing verification code in the task program in this way, it is easy to check whether the task execution time meets the specifications even when the control system program is installed on different hardware. Can be verified.
Japanese Patent Laid-Open No. 06-019752

  However, the verification code is not necessary when it is installed in an actual product. For this reason, shipping a product while the verification code is described together with the program leads to enlargement of the program and deterioration of performance.

  Therefore, it is desirable to delete the verification code from the program and ship the product. However, if the verification code is deleted, the temporal behavior of the entire control system changes. For example, as shown in FIG. 1, a compiled program is compiled into object code and then executed by the CPU. “Timer_inst ()” is compiled into object codes “Timer_inst0x2123” and “Timer_inst0x2124”, and “Timer_start ()” is compiled into object codes “Timer_start0x1234” and “Timer_start0x1235”. Similarly, "Timer_stop ()" is "Timer_stop0x5892" and "Timer_stop0x5893", "Calc_min ()" is "Calc_min0x7278" and "Calc_min0x7279", "Calc_max ()" is "Calc_max0x5290" and "Calc_max0x5291", "Calc_average () "Is compiled into" Calc_average0x0821 "and" Calc_average0x822 ", and" Check_dedline () "is compiled into" Check_dedline0x2122 "and" Check_dedline0x2123 ", respectively. The numerical value “0x...” Indicates the address of the memory where the object code is stored.

  In this way, even if the verification code is one instruction, the object code can be executed over a plurality of instructions, or the execution of the object code for measuring the execution time such as the execution of the object code of one instruction may consume a plurality of clocks depending on the instruction. Takes a relatively long time. Because the execution time is measured, if the behavior of the control system changes over time, the execution time of the “Timing Critical Job” task will also be affected, so it cannot be guaranteed that the specification is satisfied. For this reason, conventionally, products are shipped with the verification code written in the program.

  That is, conventionally, since the presence or absence of the verification code has a large influence on the code amount and the temporal behavior of the control system, there is a problem that it is not appropriate to delete the code as it is or to leave it mounted.

  In view of the above problems, an object of the present invention is to provide a program verification apparatus that can reduce the influence of the presence or absence of a verification code on the code amount and the temporal behavior of a control system.

  In view of the above problem, the present invention provides a verification device for verifying the execution time of a task by a CPU, a task code of a task executed by the CPU, a first instruction for starting a timer described immediately before the task code, A second instruction for stopping the timer described after the task code; a storage means for storing the program described therein; a means for starting the timer by executing only one first instruction; Means for stopping the timer and measuring the execution time by executing only one instruction and performing statistical processing on a plurality of execution times obtained by executing the task a plurality of times.

  It is possible to provide a program verification apparatus capable of reducing the influence of the presence or absence of a verification code on the code amount and the temporal behavior of a control system.

The best mode for carrying out the present invention will be described below with reference to the drawings.
FIG. 2 is an example of a diagram schematically illustrating the measurement of the execution time of the “Timing Critical job” task by the verification apparatus 100 of the present embodiment. The verification apparatus 100 of this embodiment has the following features.
(1) The CPU 50 executes measurement of execution time and statistical processing measured by software.
(2) In the verification code, describe the start of the timer with one instruction and the statistical processing with one instruction.

  For example, “Timer_inst_start ()” is an instruction for causing the CPU 50 to start a timer, and “Timer_stop_calc ()” is an instruction for causing the CPU 50 to execute a statistical process by stopping the timer. That is, the CPU 50 starts a timer when executing “Timer_inst_start ()”, and performs a series of statistical processing when executing “Timer_stop_calc ()”. Since each instruction is one instruction, the influence on the code amount and the temporal behavior of the control system is in a range that can be ignored as an error. For this reason, even if the program including the verification code is directly installed in an actual product, the program will not be enlarged and the performance will not be deteriorated.

  The execution time and the result of statistical processing are stored in the memory of the CPU 50. Since the execution time and the result of statistical processing can be read from the memory of the CPU 50 using a JTAG (Joint Test Action Group) tool 30 or the like, a code for reading the execution time or the result of statistical processing is described. There is no need.

  In addition, “1 instruction” is one instruction that is read by one instruction fetch, for example, when compiled into an object code. In the case of the object code “opcode, operand 0, operand 1...”, One opcode corresponds to “1 instruction” in the present embodiment. It does not matter whether or not it has an operand.

  FIG. 3 shows a description example of a program including a verification code and an example of an object code. As shown in Fig. 3 (a), one instruction of "Timer_inst_start ()" is described at the beginning of a program of a task in which strict restrictions are imposed on the execution timing, and one instruction of "Timer_stop_calc ()" is described at the end of the task. ing. The object code shown in FIG. 3B is obtained by compiling the program by the compiler. This object code is stored in an EEPROM (Electrically Erasable and Programmable Read Only Memory) 10 connected to the CPU 50.

  One instruction “Timer_inst_start ()” of the program is compiled into an object code “Timer_inst_start () 0x1111” with one instruction, and one instruction “Timer_stop_calc ()” of the program remains with one instruction “Timer_stop_calc () 0x2222” Is compiled into object code. Such an object code corresponds to the instruction set of the CPU 50, and the compiler and the CPU 50 correspond to verification of execution time by one instruction. The numerical value “0x...” Indicates the address of the memory where the object code is stored.

  FIG. 4 shows an example of a schematic configuration diagram of the verification apparatus 100 of the present embodiment. The verification apparatus 100 has a verification code stored in the CPU 50 and the EEPROM 10 as a substance. When the verification is completed, the CPU 50 is mounted on an ECU (Electronic Control Unit) mounted on the vehicle, for example. Since the verification method of the present embodiment is suitable for a control system, it is applied to, for example, an engine ECU, a powertrain ECU, a brake ECU, or the like. In addition to the CPU 50 and the EEPROM 10, a RAM, a ROM, an ASIC (Application Specific Integrated Circuit), an input / output terminal, and the like are provided.

  The CPU 50 fetches “Timer_inst_start () 0x1111” stored in the instruction register, decodes it by the decoder 11, and outputs a signal for starting the timer 15 to the timer start circuit 12. The timer start circuit 12 starts a timer 15 that counts clock signals and measures time. The initialization process is executed as necessary. The timer start circuit 12 outputs a signal to the counter circuit 13. The counter circuit 13 counts up each time a signal is received, and counts the number of times of execution of the “Timing Critical job” task. Thereafter, the CPU 50 executes a “Timing Critical job” task.

  When the “Timing Critical job” task ends, the CPU 50 reads “Timer_stop_calc () 0x2222” stored in the instruction register, decodes it by the decoder 11, and outputs a signal for stopping the timer 15 to the timer stop circuit 17. The value of the timer 15 when the timer 15 is stopped is the execution time. Further, the CPU 50 executes “Timer_stop_calc () 0x2222”, whereby the following series of processes is executed.

  After the timer 15 is stopped, the execution time measured by the timer 15 is output to the comparison circuit 18, the comparison circuit 19, and the total addition circuit 16. The comparison circuit 18 compares the execution time measured by the timer 15 with the stored min value, and replaces the execution time with a new min value only when the execution time is smaller. By doing so, the minimum execution time is always stored in the comparison circuit 18.

  The comparison circuit 19 compares the execution time measured by the timer 15 with the stored max value, and replaces the execution time with the max value only when the execution time is smaller. By doing so, the maximum execution time is always stored in the comparison circuit 19.

  The total addition circuit 16 is a circuit that accumulates execution time each time the timer 15 stops. The total adding circuit 16 stores an accumulated time in which all past execution times are accumulated. The total adding circuit 16 outputs the accumulated time to the average calculating circuit 14 at the timing at which the accumulated time is calculated.

  When the accumulated time is input, the average calculation circuit 14 reads the number of executions from the counter circuit 13 and performs a predetermined calculation (division) to calculate an average value of the execution times. The average calculation circuit 14 stores the latest average value. The average calculation circuit 14 outputs the average value to the comparison circuit 21 at the timing when the average value is calculated.

  The comparison circuit 21 stores a predetermined maximum allowable time. The comparison circuit 21 calculates and stores the difference between the maximum allowable time and the average value. The maximum allowable time is written by the JTAG tool 30 before verification. Further, the comparison circuit 21 may calculate the difference between the min value or the max value instead of the difference between the average value and the maximum allowable time.

  When the execution of the program ends, the user reads the verification result from the CPU 50 using the JTAG tool 30. That is, the min value is read from the comparison circuit 18, the max value is read from the comparison circuit 19, the average value is read from the average calculation circuit 14, and the difference between the maximum allowable time and the average value is read from the comparison circuit 21.

  Accordingly, since the maximum allowable time and the difference between the average values can be calculated within a few clocks from the stop of the timer 15, the temporal behavior of the control system may be changed even if the program is mounted on the product while including the verification code. There is no. Further, since the code amount is one instruction for the start of the timer 15 and one instruction for the statistical processing, the code is not enlarged.

  In FIG. 4, the verification code executing means is implemented as hardware, but a series of processing may be executed by executing a microprogram composed of a plurality of microinstructions. In this case, the execution time measured by the timer 15 is stored every time “Timer_stop_calc () 0x2222” is executed. Then, the micro program calculates the min value, the max value, the average value, and the difference between the average value and the maximum allowable time. Each calculation result is stored in a register.

By the way, in this embodiment, although it demonstrated as if there was one "Timing Critical job" task, in fact, there are many "Timing Critical job" tasks in one control system. In this case, by describing IDs as operands in one instruction for starting the timer 15 and one instruction for statistical processing, the execution time of each of the “Timing Critical job” tasks can be measured and statistical processing can be performed. .
"Timer_inst_start () ID"
"Timer_stop_calc () ID"
The ID is a finite number of 0 to 0xffff, but about 1 to 32 is actually sufficient.
Further, an ID as an operand is associated with a hardware ID (hereinafter referred to as HWID) of the mounting unit on the CPU 50 side in a table.
ID0 → HWID0
ID1 → HWID1
ID2 → HWID2
ID3 → disable
ID4 → disable
ID5 → disable
ID6 → HWID3
In this way, the CPU 50 can determine which mounting unit should be used when executing “Timer_inst_start () ID” or “Timer_stop_calc () ID”. Such a table is stored in, for example, the EEPROM 10 and can be dynamically corrected and added as necessary by the JTAG tool 30. In the initial state, all correspondences are “disable”. When “Timer_inst_start () ID” or “Timer_stop_calc () ID” designates “disable” ID, the CPU 50 processes as NOP (No Operation) (does nothing).

It is a figure which shows an example of the conventional verification code. It is an example of the figure which illustrates typically the measurement of the execution time of the "Timing Critical job" task by a verification apparatus. It is a figure which shows the example of a description of the program containing a verification code, and an example of an object code. It is an example of the schematic block diagram of a verification apparatus.

10 EEPROM
15 Timer 30 JTAG tool 50 CPU
100 Verification device

Claims (1)

In the verification device that verifies the execution time of the task by the CPU,
A task code of the task to be executed by the CPU; a first instruction for starting a timer described immediately before the task code; and a second instruction for stopping a timer described after the task code. Storage means for storing the described program;
Means for starting a timer by executing only one of the first instructions;
Means for stopping the timer by measuring only the second instruction and measuring the execution time, and performing statistical processing on the plurality of execution times obtained by executing the task a plurality of times;
The verification apparatus characterized by having.

Images