EP2619667A1 - Verfahren zum überwachen von mindestens zwei mikrocontrollern - Google Patents

Verfahren zum überwachen von mindestens zwei mikrocontrollern

Info

Publication number
EP2619667A1
EP2619667A1 EP11760737.4A EP11760737A EP2619667A1 EP 2619667 A1 EP2619667 A1 EP 2619667A1 EP 11760737 A EP11760737 A EP 11760737A EP 2619667 A1 EP2619667 A1 EP 2619667A1
Authority
EP
European Patent Office
Prior art keywords
microcontroller
watchdog
response
contribution
message
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
EP11760737.4A
Other languages
German (de)
English (en)
French (fr)
Inventor
Sandeep Bisht
Jochen Weber
Andreas Heyl
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Robert Bosch GmbH
Samsung SDI Co Ltd
Original Assignee
Robert Bosch GmbH
Samsung SDI Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Robert Bosch GmbH, Samsung SDI Co Ltd filed Critical Robert Bosch GmbH
Publication of EP2619667A1 publication Critical patent/EP2619667A1/de
Ceased legal-status Critical Current

Links

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00Error detection; Error correction; Monitoring
    • G06F11/07Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/0703Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
    • G06F11/0751Error or fault detection not based on redundancy
    • G06F11/0754Error or fault detection not based on redundancy by exceeding limits
    • G06F11/0757Error or fault detection not based on redundancy by exceeding limits by exceeding a time limit, i.e. time-out, e.g. watchdogs
    • GPHYSICS
    • G05CONTROLLING; REGULATING
    • G05BCONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B19/00Programme-control systems
    • G05B19/02Programme-control systems electric
    • G05B19/04Programme control other than numerical control, i.e. in sequence controllers or logic controllers
    • G05B19/042Programme control other than numerical control, i.e. in sequence controllers or logic controllers using digital processors
    • G05B19/0428Safety, monitoring
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00Error detection; Error correction; Monitoring
    • G06F11/07Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/0703Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
    • G06F11/0706Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment
    • G06F11/0736Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment in functional embedded systems, i.e. in a data processing system designed as a combination of hardware and software dedicated to performing a certain function
    • G06F11/0739Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment in functional embedded systems, i.e. in a data processing system designed as a combination of hardware and software dedicated to performing a certain function in a data processing system embedded in automotive or aircraft systems
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00Error detection; Error correction; Monitoring
    • G06F11/07Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/0703Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
    • G06F11/0751Error or fault detection not based on redundancy
    • G06F11/0754Error or fault detection not based on redundancy by exceeding limits
    • G06F11/076Error or fault detection not based on redundancy by exceeding limits by exceeding a count or rate limit, e.g. word- or bit count limit
    • GPHYSICS
    • G05CONTROLLING; REGULATING
    • G05BCONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B2219/00Program-control systems
    • G05B2219/20Pc systems
    • G05B2219/25Pc structure of the system
    • G05B2219/25158Watchdog

Definitions

  • the present invention relates to a method for monitoring at least two microcontrollers
  • Microcontrollers by means of a watchdog, a circuit arrangement which is adapted to carry out the inventive method, and a battery and a motor vehicle, which comprise the circuit arrangement according to the invention.
  • Microcontroller an external hardware watchdog with independent time base and fixed time window is used.
  • a watchdog is used, for example, in the context of the monitoring of engine control units in which a so-called three-level concept is used.
  • a first level comprises the software for controlling the engine
  • a second level the software for monitoring the engine control
  • a third level the software for
  • Hardware watchdog is used here in the third level to check a microcontroller used in the first or second level.
  • the monitoring of the microcontroller by means of the watchdog can be done in a simple
  • the watchdog can submit test questions to the microcontroller and check its correctness and timing responses.
  • Such a method for monitoring a microcontroller may have the following sequence: The watchdog randomly asks the microcontroller one of several possible questions. The microcontroller provides an answer to this question by combining two answers. The first answer results from a check of the logic of the microcontroller. The second answer results from a function-specific check of a predetermined plurality of
  • Software modules preferably with additional conditions such as correct order and a predetermined number of calls of each module.
  • Answer submissions are combined and transmitted to the watchdog within a specific time frame.
  • the watchdog verifies the response to correct contents and timing, and increments an error counter if an error is detected, or resets the error counter if no error is detected. Thereafter, the watchdog continues the verification process by asking a new question.
  • the watchdog causes a safety-relevant process step, which may consist, for example, in that the output stages of the system controlled by the microcontroller are switched off via a shutdown path so that operation is no longer possible.
  • Microcontrollers provided by means of a watchdog.
  • the watchdog is assigned to a first microcontroller and monitors the message of a message of the first microcontroller within a time interval of predetermined duration. If a first component of a second component notifies a message, in particular a question or answer, this may mean in the context of the invention that the first component of the second component sends the message, for example on a bus system, or that it provides the message, for example, by filing in a register, and the second component queries this message.
  • the watchdog is usually supplied with a different clock signal from the clock signal of the microcontroller, so that it can check the correct time input of the message. It is intended that the watchdog of the first
  • Microcontroller message contains a post, which due to a
  • Microcontroller in addition to that of the first microcontroller.
  • two microcontrollers can be monitored by a watchdog.
  • An additional watchdog for the second microcontroller and also a second microcontroller associated Abschaltpfad can thus be saved.
  • the invention is not limited to monitoring two microcontrollers. Rather, a plurality of microcontrollers can be monitored together by a watchdog.
  • the second microcontroller does not have to be directly connected to the first microcontroller. Rather, it is sufficient that it is indirectly, for example via a third microcontroller, connected to the first microcontroller.
  • the third microcontroller can serve as a transmission unit of the messages exchanged between the first and second microcontroller, and according to the invention both the second and the third microcontroller can be monitored by the watchdog.
  • the message from the first microcontroller may include a response to a question previously communicated to the first microcontroller by the watchdog.
  • the watchdog notifies the first microcontroller of the issue at a time which forms the beginning of the time interval of predetermined duration. The watchdog thus detects a proper functioning of both microcontrollers only if both question and answer within the time interval
  • the answer be a first contribution, which of the first
  • Microcontroller is formed, and a second contribution, which of the second
  • Microcontroller formed and communicated to the first microcontroller includes.
  • the question may be communicated to the second microcontroller by the first microcontroller before the second contribution of the response is formed by the second microcontroller.
  • this message also happens within the given time interval. It is furthermore preferred that the first contribution of the answer, that of the first
  • Microcontroller is formed, a component-specific component, which results from a review of system components of the first microcontroller, in particular the logic of a main processor of the first microcontroller, and / or a function-specific component, which results from a review of a plurality of software modules of the first microcontroller, includes.
  • the second contribution of the response may also include a component-specific component and / or a function-specific component, as is also provided in the first contribution of the answer.
  • the second contribution of the response may consist only of a digital word, with individual bits of the digital word the
  • Microcontroller represent.
  • the second contribution of the answer can be supplemented by a question-specific component, which is formed in particular by reading out a table stored in the second microcontroller.
  • the watchdog can increment at least one detected error of the first or second microcontroller, an error counter, or, if the error counter has reached a predetermined value, cause a safety-relevant process step, for example, a shutdown of the output stages of the system controlled by the microcontroller.
  • Another aspect of the invention relates to a circuit arrangement having a first microcontroller, a watchdog associated therewith, and at least one second microcontroller connected to the first microcontroller.
  • the Circuit arrangement is designed to carry out the method according to the invention.
  • Lithium-ion battery with a battery management unit, which the
  • Circuit arrangement according to the invention comprises, as well as a motor vehicle, which comprises a battery according to the invention.
  • the motor vehicle may be an electric motor vehicle, in which the battery is connected to a drive system of the motor vehicle.
  • FIG. 1 shows a battery with a circuit arrangement according to an embodiment of the invention
  • FIG. 2 shows a flow chart of a method for monitoring two microcontrollers according to an embodiment of the invention.
  • FIG. 1 shows a battery designated overall by 100, preferably one
  • Lithium-ion battery which is a circuit arrangement according to a
  • Embodiment of the invention comprises.
  • a hardware watchdog 10 is associated with a first microcontroller 12 and connected to it via a bus 14, being exchanged over the bus 14 in both directions messages,
  • Both the watchdog 10 and the first microcontroller 12 have shutdown paths 16, 18, which are detected at a
  • the first microcontroller 12 is connected to a second microcontroller 20 via a bus 22, via which messages are also exchanged in both directions, in particular a question of the watchdog 10 forwarded by the first microcontroller 12 and an associated response of the second microcontroller 20. Due to the fact that the second microcontroller 20 receives a question from the watchdog 10 via the first microcontroller 12 and returns an associated response in the same way, the watchdog 10 can check the proper functioning of the second microcontroller 20 and, upon detection of an error, check the
  • FIG. 2 shows a flow chart of the method according to the invention. in the
  • a question from watchdog 10 is polled by first microcontroller 12.
  • the question of the watchdog 10 is communicated to the second microcontroller 20 by the first microcontroller 12, either by sending the question to the second microcontroller 20 or by providing for a query of the second microcontroller 20.
  • a first contribution of the response in FIG first microcontroller 12 is formed.
  • the second microcontroller 20 receives the question with the least possible time offset, for example by receiving the data of the first microcontroller 12 or by a query by the second microcontroller 20.
  • step 208 the timeliness of the question is checked by the second microcontroller 20, for example by Comparison with a stored earlier question, which must differ, or by evaluating a status bit, which the first microcontroller 12 sends along with the question. If the second microcontroller 20 determines that the question communicated to it is not up-to-date, an error counter is incremented in method step 210 or, if a specific position is exceeded, an error reaction is initiated. Otherwise, the second microcontroller 20 begins in method step 212 to form the second contribution of the response which is to be transmitted to the watchdog 10.
  • step 214 the second microcontroller 20 calculates the second contribution of the response to be sent to the watchdog 10 and notifies the first microcontroller 12, either by sending the data to the first one
  • Microcontroller 12 or by providing for a query by the first
  • the first microcontroller 12 takes over the second contribution of the answer and determines in method step 218 the relevance of the contribution of the answer, for example by comparison with a stored preceding reply item which must be differentiated or by
  • step 204 the first microcontroller 12 calculates the first contribution of the response to be sent to the watchdog. in the
  • the first microcontroller combines the first and second
  • the first microcontroller 12 can receive a multiplicity of response contributions and combine them into a total response to the watchdog 10. In this case, the composition of the different answers does not have to
  • the second contribution of the response which is formed by the second microcontroller 20, consists only of a digital word. This is particularly advantageous if the security requirements for the second microcontroller 20 are relatively low and a less complex check of a specific number of software modules of the second
  • Microcontroller 20 is sufficient.
  • the number of bits of the digital word must be greater than or equal to the number of software modules of the second microcontroller 20 to be checked.
  • the bits of the digital word are set to logic 0 at the beginning of a time interval defined by a question-answer cycle, for example, when a new question is notified by the watchdog. It will then the
  • a large number of software modules to be checked are called in a certain order and the corresponding bit of the digital word is set to logical 1 if the associated software module has been executed successfully.
  • An additional bit of the digital word may represent the presence of a new question, without which setting of the remaining individual bits is not allowed.
  • the second contribution of the response which is formed by the second microcontroller 20, comprises, in addition to the described digital word, only one query-specific component which, in particular, is stored by reading one in the second microcontroller 20

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Quality & Reliability (AREA)
  • General Engineering & Computer Science (AREA)
  • Automation & Control Theory (AREA)
  • Debugging And Monitoring (AREA)
EP11760737.4A 2010-09-20 2011-09-08 Verfahren zum überwachen von mindestens zwei mikrocontrollern Ceased EP2619667A1 (de)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
DE201010041003 DE102010041003A1 (de) 2010-09-20 2010-09-20 Verfahren zum Überwachen von mindestens zwei Mikrocontrollern
PCT/EP2011/065515 WO2012038260A1 (de) 2010-09-20 2011-09-08 Verfahren zum überwachen von mindestens zwei mikrocontrollern

Publications (1)

Publication Number Publication Date
EP2619667A1 true EP2619667A1 (de) 2013-07-31

Family

ID=44675559

Family Applications (1)

Application Number Title Priority Date Filing Date
EP11760737.4A Ceased EP2619667A1 (de) 2010-09-20 2011-09-08 Verfahren zum überwachen von mindestens zwei mikrocontrollern

Country Status (7)

Country Link
US (1) US9104570B2 (ja)
EP (1) EP2619667A1 (ja)
JP (1) JP5715257B2 (ja)
KR (1) KR101581403B1 (ja)
CN (1) CN103168292B (ja)
DE (1) DE102010041003A1 (ja)
WO (1) WO2012038260A1 (ja)

Families Citing this family (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE102013213402A1 (de) * 2013-07-09 2015-01-15 Robert Bosch Gmbh Mikrocontroller mit mindestens zwei Kernen
DE102013217461B4 (de) 2013-09-02 2023-10-05 Robert Bosch Gmbh Verfahren und Anordnung zur Überwachung einer Komponente in einem Kraftfahrzeug
KR101534974B1 (ko) * 2013-12-19 2015-07-08 현대자동차주식회사 다중 마이크로 코어 감시 장치 및 방법
FR3018961B1 (fr) * 2014-03-24 2016-04-01 Schneider Electric Ind Sas Dispositif de gestion des causes de declenchement dans un declencheur electronique
JP6498043B2 (ja) 2015-05-29 2019-04-10 キヤノン株式会社 電子機器
KR101945425B1 (ko) 2015-11-27 2019-02-07 주식회사 엘지화학 배터리 팩 상태 병렬 모니터링 장치
KR101988558B1 (ko) * 2017-06-07 2019-06-12 현대오트론 주식회사 멀티 코어를 갖는 마이크로콘트롤러 유닛을 감시하는 감시장치 및 그것의 동작 방법
KR102344211B1 (ko) 2017-12-20 2021-12-27 주식회사 엘지에너지솔루션 메인 제어부 이상 진단 시스템 및 방법
DE102018209704A1 (de) * 2018-06-15 2019-12-19 Bayerische Motoren Werke Aktiengesellschaft Fortbewegungsmittel und Vorrichtung zur Ausgabe einer Aufforderung zur Übernahme einer Fahrzeugführung
US11036573B2 (en) * 2019-05-16 2021-06-15 Ford Global Technologies, Llc Control processor unit (CPU) error detection by another CPU via communication bus
US10936397B2 (en) * 2019-05-23 2021-03-02 Ford Global Technologies, Llc Hybrid control module status communication system and method
KR20210031317A (ko) 2019-09-11 2021-03-19 주식회사 엘지화학 워치독 시스템, 워치독 방법, 및 워치독 시스템을 포함하는 배터리 관리 시스템
KR102213254B1 (ko) * 2019-10-02 2021-02-19 주식회사 현대케피코 단일 와치독 장치를 이용한 복수 개의 마이컴 에러 검출 방법 및 단일 와치독 장치
KR102219432B1 (ko) * 2019-12-12 2021-02-26 현대모비스 주식회사 와치독 장치 및 그 제어 방법

Family Cites Families (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2001350735A (ja) * 2000-06-09 2001-12-21 Bosch Automotive Systems Corp 複数データ処理装置間相互監視方法
DE10056408C1 (de) * 2000-11-14 2002-03-07 Bosch Gmbh Robert Vorrichtung zur Überwachung eines Prozessors
US6580974B2 (en) * 2001-06-08 2003-06-17 Robert Bosch Gmbh Method and apparatus for monitoring the control of operational sequences in a vehicle
DE10205809A1 (de) * 2001-06-08 2002-12-12 Bosch Gmbh Robert Verfahren und Vorrichtung zur Überwachung der Steuerung von Betriebsabläufen bei einem Fahrzeug
DE10211280A1 (de) * 2002-03-14 2003-09-25 Bosch Gmbh Robert Verfahren zur Ansteuerung einer Komponente eines verteilten sicherheitsrelevanten Systems
DE10225472A1 (de) * 2002-06-10 2003-12-18 Philips Intellectual Property Verfahren und Chipeinheit zum Überwachen des Betriebs einer Mikrocontrollereinheit
JP2004259137A (ja) * 2003-02-27 2004-09-16 Denso Corp 電子制御装置
DE102004022624A1 (de) 2004-05-07 2005-12-08 Robert Bosch Gmbh Verfahren zur Überwachung eines Systems
DE102006029514B3 (de) * 2006-06-27 2007-05-31 Atmel Germany Gmbh Schaltungsanordnung und Verfahren zum Steuern mindestens eines Aktors in einem Kraftfahrzeug
UA82448C2 (uk) 2007-02-26 2008-04-10 Институт электросварки им. Е.О. Патона национальной академии наук Украины Спосіб одержання інкапсульованих нанопорошків і установка для його здійснення
DE102007033365A1 (de) * 2007-07-16 2009-01-22 Huf Hülsbeck & Fürst Gmbh & Co. Kg Eine ein temperaturabhängiges Signal liefernde Watchdog-Schaltung für einen Mikrocontroller einer ELV
JP4633134B2 (ja) * 2008-03-27 2011-02-16 ルネサスエレクトロニクス株式会社 マイクロコントローラ、制御システム及びマイクロコントローラの設計方法
JP4454672B2 (ja) * 2008-06-13 2010-04-21 三菱電機株式会社 監視制御回路を有する車載電子制御装置
CN101770404B (zh) * 2008-12-31 2012-08-15 环旭电子股份有限公司 可保存状态的看门狗电路及其保存重启状态方法
JP5339961B2 (ja) * 2009-02-26 2013-11-13 三洋電機株式会社 電気自動車用バッテリ制御装置及びバッテリシステム

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
None *
See also references of WO2012038260A1 *

Also Published As

Publication number Publication date
KR101581403B1 (ko) 2015-12-30
US20140149809A1 (en) 2014-05-29
JP5715257B2 (ja) 2015-05-07
DE102010041003A1 (de) 2012-03-22
CN103168292A (zh) 2013-06-19
CN103168292B (zh) 2017-02-08
KR20130056347A (ko) 2013-05-29
JP2013541089A (ja) 2013-11-07
WO2012038260A1 (de) 2012-03-29
US9104570B2 (en) 2015-08-11

Similar Documents

Publication Publication Date Title
WO2012038260A1 (de) Verfahren zum überwachen von mindestens zwei mikrocontrollern
DE102006028695A1 (de) Elektronisches Steuersystem mit Fehlfunktionsüberwachung
WO2010145985A1 (de) Verfahren zum betreiben eines bussystems, insbesondere eines can-busses
DE102013002647B3 (de) Kraftwagen mit einem Fahrzeugkommunikationsbus und Verfahren zum Erzeugen von Busnachrichten
DE102006023274B4 (de) Verfahren und Vorrichtung zum Steuern von Netzwerksegmenten eines Netzwerks in einem Kraftfahrzeug
DE102011081477A1 (de) Stellwerksrechner
EP2733910B1 (de) BUS-System, Verfahren zum Betrieb eines BUS-Systems und fluidisches System mit einem BUS-System
DE102004022624A1 (de) Verfahren zur Überwachung eines Systems
DE102007029116A1 (de) Verfahren zum Betreiben eines Mikrocontrollers und einer Ausführungseinheit sowie ein Mikrocontroller und eine Ausführungseinheit
WO2005055056A1 (de) Laden von software-modulen
DE102013206432A1 (de) Verfahren und Anordnung zur Treiberdiagnose von Schützen, Batterie und Kraftfahrzeug mit einer solchen Batterie
EP1979793B1 (de) Verfahren und vorrichtung zur adressvergabe in einem system mit mehreren parallel angeordneten generatoreinheiten
DE2228320B2 (de) Rundsteuerempfänger
DE10331872A1 (de) Verfahren zur Überwachung eines technischen Systems
DE102004051130A1 (de) Verfahren und Automatisierungssystem zum Bedienen und/oder Beobachten mindestens eines Feldgerätes
EP3499324A1 (de) Verfahren zur modularen verifikation einer konfiguration eines geräts
DE3108871A1 (de) Einrichtung zur funktionspruefung eines mehrrechnersystems
WO2006120174A1 (de) Verfahren zur steuergeräte-überwachung
DE2708244B2 (de) Anordnung und Verfahren zur Steuerung eines Vermittlungssystems mit einer Gruppe von Kleinrechnern
DE10238547A1 (de) Steuersystem und Verfahren zur Fehlerbehebung in elektronischen Einheiten oder Teilnetzen
DE102005029515A1 (de) Verfahren zur Berechnung von CRC-Prüfwerten und Logikschaltung
DE102010039782A1 (de) Verfahren zur Durchführung einer Kommunikation
DE10315344A1 (de) Verfahren und Vorrichtung zur Erkennung fehlerhafter Komponenten in Fahrzeugen
EP1868100A2 (de) Verfahren zur Fehlerdiagnose
EP1157468B1 (de) Anordnung und verfahren zum ermitteln, ob der zählstand eines zählers einen vorbestimmten zählstand erreicht hat oder nicht

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

17P Request for examination filed

Effective date: 20130422

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

DAX Request for extension of the european patent (deleted)
17Q First examination report despatched

Effective date: 20140318

REG Reference to a national code

Ref country code: DE

Ref legal event code: R003

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE APPLICATION HAS BEEN REFUSED

18R Application refused

Effective date: 20181204