JP2019087118A - On-vehicle control device - Google Patents

Abstract

To provide an on-vehicle control device capable of identifying a cause of a bug in a control program even without using a debugger and capable of eliminating the bug of a control program even if a hook function is not prepared.SOLUTION: An on-vehicle control device 1 includes a ROM 7, a RAM 6, and a CPU 5. The ROM includes a control program that includes periodical control processing, and interruption processing executed each time when a plurality of predetermined specific processes are executed individually in a series of processes for composing the periodical control processing. The RAM includes, as expansion programs, a first expansion program capable of finding a bug in the periodical control processing and identifying a cause of the bug, and a second expansion program that can add a processed part after correction of a bug to a control program before correction of the bug in the processed part, can be executed instead of the processed part before correction, and can verify elimination of the bug in the control program. The CPU can execute the control program and the expansion program.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an on-vehicle control device devised to be able to acquire information on the execution result of a control program from a RAM.

  An on-board control unit (Electronic Control Unit; hereinafter referred to as "ECU") for controlling a motor drive inverter, a lighting drive converter, etc. is incorporated in a housing to be controlled such as a motor or a lighting device, and is provided as a functional component It is commercialized.

  The ECU is configured as follows in order to perform various control processes, exchange information with other ECUs, coordinate operations, and the like. That is, the ECU has a function of performing communication (hereinafter referred to as “external communication”) with other ECUs connected to communication lines such as CAN, FlexRay, Ethernet (registered trademark), various tools, etc. (hereinafter referred to as “external communication”) Hereinafter, it is configured to include “microcomputer”.

Universal Measurement and Calibration Protocol, [August 25, 2017 search], Internet <URL: https: // wiki. asam. net / display / STANDARDS / ASAM + MCD-1 + XCP> Bypassing-Externally or Directly on the ECU, [August 25, 2017 search], Internet <URL: https: // www. dspace. com / en / pub / home / products / systems / functp / bypassing. cfm>

  Here, in the development of the control program executed by the microcomputer, processing is added, changed, or deleted so as to satisfy the requirements imposed on the product, and whether or not the result is appropriate is confirmed. Tests will be conducted. In addition, in this development, processing that does not satisfy requirements, unintended behavior, errors and the like (hereinafter referred to as “problems”) are repeatedly corrected.

  In the initial stage of development of the control program, at a stage where the practicability of the control program can not be sufficiently confirmed, development is performed by the ECU alone without combining the ECU with the control target. When development is performed by an ECU alone, the development can be carried out with the debugger always connected to the microcomputer of the ECU. If a defect is found in the control program, investigation of the cause of the defect proceeds as follows. That is, the investigation is advanced while checking whether each line of the source code of the control program is the intended execution result or not by utilizing the source level debugging function provided by the debugger.

  The control program is combined with the control target and integrated testing is performed when its practicality is sufficiently confirmed. At this stage, the ECU is often incorporated into the housing to be controlled, and it is often difficult to connect the debugger to the microcomputer of the ECU. Therefore, the function of transmitting execution data such as processing data of the control program and variables indicating the state is added to the external communication function normally provided by the ECU. By receiving and observing the runtime data sent by the sending function, it is checked whether the control program is operating normally.

  The runtime data of the control program described above is based on, for example, CAN Calibration Protocol standardized by Association for Standardization of Automation and Measuring Systems (ASAM) or Universal Measurement and Calibration Protocol (hereinafter referred to as “XCP”). It applies and transmits a protocol (for example, refer nonpatent literature 1).

  According to Non-Patent Document 1, an ECU that applies XCP can read out values held by each address accessible by a CPU (central processing unit) that executes a control program, and further, the address is RAM (random) In the case of (access memory) or peripheral function register, the designated value can be written to the address. In this case, the number and amount of execution time data of the control program that can be acquired per unit time are limited by the communication speed of the external communication function of the ECU, the data processing speed, and the like.

  As a main application of XCP, for example, when the control target value calculated by the control program is not optimal for the control target, it is used in the step of repeatedly adjusting various control parameters used for the calculation (hereinafter referred to as "calibration") Be done.

  Further, the ECU to which XCP is applied can correspond not only to the above-described RAM, but also to a PROGRAM command that rewrites a flash memory storing control programs, data and the like. By using this command, part or all of the control program or data stored in the flash memory can be rewritten via the external communication function of the ECU. Furthermore, it is possible for the user to additionally define and use commands not defined in XCP.

  If a defect is found in the control program in the integrated test described above, the developer of the control program may have to obtain and analyze the above-mentioned runtime data to identify the cause of the defect in the control program. . In this case, the control program developer can obtain only a part of the control program execution time data, and can not use the source level debugging function of the control program provided when the debugger is connected to the microcomputer . Therefore, there is a problem that it is difficult to investigate the cause of the control program failure.

  Therefore, the control program developer estimates the cause of the control program failure based on part of the control program execution data, writes the corrected control program to the ECU using XCP or other means, and performs the integrated test again Will do.

  However, if the cause of the control program's failure is not correctly estimated, the failure may not be completely eliminated. In that case, the development cycle from the step of acquiring the execution time data of the control program to the step of performing the integrated test is repeated until the true cause of the failure of the control program is identified. As a result, there is a problem that it takes time to develop a control program.

  By using the above-mentioned XCP PROGRAM command, it is possible to rewrite the flash memory of the ECU and update the control program after correcting the defect. However, as described above, when the cause of the failure of the control program is not correctly estimated, it is necessary to return to the step of acquiring the runtime data of the control program in which the failure occurs in order to correctly estimate the cause of the failure. Therefore, it is often necessary to restore the corrected control program to the state before the correction. From such a thing, it is desirable to be able to identify the cause of the failure and confirm the effect of the correction without returning the control program after the correction to the state before the correction.

  For example, Bypassing has been known as a means for reducing the time required to repeat the above-described development cycle, particularly the process of correcting the algorithm of the control program (see, for example, Non-Patent Documents 1 and 2).

  According to Non-Patent Document 2, just before executing the original program processing, a branch processing function called a hook function is provided, and in this hook function, the original processing or a processing in which a control parameter created later is changed is selected. And run. As a result, it is possible to switch only the process requiring the change to the process after the change and execute the program without rewriting the entire control program stored in the ROM (read only memory) of the ECU.

  In addition, the following two methods are known as a mounting method of the above-mentioned Bypassing (for example, refer nonpatent literature 2). That is, as a first method, a hook function transmits a parameter used for processing, that is, an argument of the function, to an external device such as a personal computer via XCP and external communication, and the result of external processing is sent to the ECU. There is External Bypassing to reply. As a second method, there is On-target Bypassing, which is executed by branching from inside the hook function to the changed program part stored in advance in the RAM of the ECU. In particular, in the ECU, the cycle of control processing may be as short as tens of microseconds, and in External Bypassing, external communication becomes a temporal bottleneck, and it is difficult to receive processing results from the external communication within that cycle. is there. Therefore, the ECU may need on-target bypassing that can execute processing in the ECU.

  When calibration of the control parameter is performed, since the location of the process requiring adjustment of the control parameter is known, it is possible to add a hook function only to the required process location in advance.

  However, when a defect occurs in the algorithm of the control program, it is difficult to predict the occurrence point in advance and prepare a hook function. Therefore, it is necessary to prepare hook functions for all functions, for example, in order to be able to cope with problems in the control program that occur at arbitrary places in advance. In this case, there is a problem that it is inefficient to create a hook function over the entire control program in order to cope with a failure that occurs in part of the control program.

  The present invention has been made to solve the problems as described above, and can identify the cause of a control program failure without using a debugger, and control without preparing a hook function. It is an object of the present invention to obtain an on-vehicle control device capable of confirming the solution of the problem of the program.

  The on-vehicle control device according to the present invention performs periodic control processing for periodically controlling the control target, and a plurality of predetermined specific processing among the series of processing constituting the periodic control processing are individually executed. CPU includes: a ROM storing a control program including an interrupt process to be executed; a RAM storing a first expansion program and a second expansion program as an expansion program; and a CPU executing the control program and the expansion program The access detection function detects an access to the execution address to be accessed when executing the specific processing, and generates an interrupt. By executing the interrupt processing in response to the interrupt generated by the access detection function, The processing after the execution of the specific processing in the periodic control processing is interrupted, and the first extended program or the second After executing the tension program, the periodic control processing resumes the processing after the execution of the specific processing and the first extension program is executed, thereby storing the processing result of the specific processing in the RAM and performing periodic control By setting the access detection function so that the access detection function detects that the CPU has accessed the execution address of the next specific process to be executed next to the specific process in the process, the second extended program is executed, A post-correction post-process is performed after correcting the process that is the cause of the occurrence of a failure in the cycle control process.

  According to the present invention, it is possible to identify the cause of a defect in the control program without using a debugger, and to confirm the elimination of the defect in the control program without preparing a hook function. You can get

FIG. 2 is a block diagram showing a configuration of an ECU according to Embodiment 1 of the present invention. It is a block diagram which shows the function comprised to CPU in Embodiment 1 of this invention. It is a block diagram which shows the control program expansion part provided in RAM in Embodiment 1 of this invention. It is a table | surface which shows an example of the definition of the command of the extended program which CPU runs in Embodiment 1 of this invention. It is a block diagram which shows the control program memorize | stored in ROM in Embodiment 1 of this invention. It is a flowchart which shows the period control process of the control program which CPU in Embodiment 1 of this invention performs. It is a flowchart which shows the interrupt processing of the control program which CPU in Embodiment 1 of this invention performs. It is a flowchart which shows the subroutine called by the interrupt processing of the control program which CPU in Embodiment 1 of this invention performs. It is a table | surface which shows an example of the definition of the command of the subroutine called by interrupt processing of the control program which CPU performs in Embodiment 1 of this invention. It is a table | surface which shows an example of the definition of the command of the subroutine called by interrupt processing of the control program which CPU performs in Embodiment 1 of this invention. It is a flowchart which shows the subroutine called by the interrupt processing of the control program which CPU in Embodiment 1 of this invention performs.

  Hereinafter, an on-vehicle controller according to the present invention will be described according to a preferred embodiment with reference to the drawings. In the description of the drawings, the same or corresponding portions are denoted by the same reference numerals, to omit redundant description.

Embodiment 1
FIG. 1 is a block diagram showing a configuration of the ECU 1 in the first embodiment of the present invention. FIG. 1 exemplifies a case where the ECU 1 executes control of the motor 11 which is an example of an object to be controlled and communicates with the outside through the external communication line 12.

  Here, with the configuration of the ECU 1 described later, the ECU 1 can find a defect in the cycle control process in the control program, and identify the cause of the defect. The cycle control process is performed with a short cycle of, for example, 50 microseconds. Further, depending on the configuration of the ECU 1, a processing portion after correcting the defect is added to the control program before correcting the defect in the processing portion, and the added processing portion is executed instead of the processing portion before correcting Be done. As a result, it is possible to confirm the elimination of the control program failure.

  In FIG. 1, the ECU 1 includes an input circuit 2, a microcomputer 3 and a drive circuit 10, and controls the motor 11 and is connected to an external communication line 12. The microcomputer 3 includes an input / output function (hereinafter referred to as an I / O) 4, a CPU 5, a RAM 6, a ROM 7, a timer 8, and an external communication function 9.

  Here, in the configuration of the ECU 1 of the first embodiment, for example, a protocol based on XCP is added to the external communication function 9 of the microcomputer 3. As a result, setting for detecting access of a specified memory address from external communication is performed, and a specified command and its arguments shown in FIGS. 9 and 10 described later are stored in the RAM 6.

  The input circuit 2 reads a signal from the outside and signals from various sensors provided on the motor 11 to be controlled as voltages. The I / O 4 inputs and outputs digital signals, takes in the voltage read by the input circuit 2 into the microcomputer 3, and outputs a control signal to the drive circuit 10.

  The CPU 5 is a microprocessor using a known architecture, and is configured to be able to execute a control program 70 described later stored in the ROM 7. Further, when an interrupt occurs during execution of the control program 70, the CPU 5 executes processing corresponding to the interrupt. Although an interrupt may be called an exception depending on a microprocessor applied as the CPU 5, in the first embodiment, the two are not particularly distinguished and are simply called an interrupt.

  Subsequently, functions provided in the CPU 5 will be described with reference to FIG. FIG. 2 is a block diagram showing functions provided to CPU 5 in the first embodiment of the present invention.

  As shown in FIG. 2, the CPU 5 includes a breakpoint function (hereinafter referred to as "BP") 51 and two memory protection functions (hereinafter referred to as "MPU"), that is, a first MPU 52 and a second MPU 53. And a memory protection function set.

  The number of BPs 51 provided in the CPU 5 is required to be one or more, and the number of sets of memory protection functions provided in the CPU 5 is required to be one or more.

  The BP 51 is arranged in a register of the CPU 5 or in a memory space accessible by the CPU 5. The CPU 5 can set the BP 51 to a specific memory address by executing a program stored in the ROM 7. The BP 51 monitors a memory address accessed by the CPU 5 and, when the CPU 5 accesses the set address, an interrupt for notifying the CPU 5 that the CPU 5 has accessed the set address (hereinafter referred to as “BP interrupt”) Generate That is, the BP 51 can detect that the CPU 5 has accessed a specific address.

  When the CPU 5 can not operate the BP 51, that is, when the BP 51 can not be used, the first MPU 52 and the second MPU 53 are used instead of the BP 51. The CPU 5 may be a single core or a plurality of cores as long as the CPU 5 can access the I / O 4, the RAM 6, the ROM 7, the timer 8 and the external communication function 9.

  The first MPU 52 and the second MPU 53 monitor whether the memory address accessed by the CPU 5 is within the address range in which the first MPU 52 and the second MPU 53 are set. The CPU 5 can set the first MPU 52 and the second MPU 53 to the lower limit value and the upper limit value of the address range, respectively. If the memory address accessed by the CPU 5 is outside the set address range, the first MPU 52 and the second MPU 53 notify the CPU 5 that the CPU 5 has accessed an address outside the set address range (hereinafter referred to as “MPU "Interrupt" is generated.

  In the first embodiment, when the BP 51 can not be used, the above-described functions of the first MPU 52 and the second MPU 53 are used to detect that the CPU 5 has accessed a specific memory address. For example, when detecting that the CPU 5 has accessed an address A, the CPU 5 sets the first MPU 52 in the range from the top of the memory space accessible by the CPU 5 to the address A-1, and the CPU 5 accesses from the address A + 1. The second MPU 53 is set in the range up to the end of the possible memory space. Thereafter, the CPU 5 enables the functions of the first MPU 52 and the second MPU 53.

  As described above, the CPU 5 sets the first MPU 52 and the second MPU 53 in the above-described address range, and enables the functions of the first MPU 52 and the second MPU 53. Thereafter, when the CPU 5 accesses the address A, an MPU interrupt occurs because the address A is an address outside the address range in which the first MPU 52 and the second MPU 53 are set. That is, the first MPU 52 and the second MPU 53 can detect that the CPU 5 has accessed the address A, that is, a specific address.

  Returning to the description of FIG. 1, the drive circuit 10 drives the motor 11 in accordance with the control amount input from the microcomputer 3. The external communication function 9 is connected to the external communication line 12. The external communication line 12 is a general communication line used by ECUs, such as CAN, CAN FD, FlexRay, Ethernet (registered trademark). In the first embodiment, although the case where the present invention is applied to the ECU 1 controlling the motor 11 is exemplified, the present invention is not limited to this, and an ECU controlling another control target other than the motor 11 The present invention is also applicable to this case. For example, when a converter is used as the drive circuit 10 and the control target is changed from the motor 11 to the LED, the control process is performed in a short cycle as in the drive control of the motor 11 also for illuminance control of the LED. The configuration of the external communication function 9 is not particularly limited, and, for example, a configuration used by combining the above-described communication methods or a configuration using a plurality of the same communication methods can be considered. Furthermore, when wiring can be added to the ECU 1, for example, various serial communications such as UART and SPI, general purpose digital input / output (GPIO), etc. provided in the microcomputer 3 should be applied as the external communication function 9. Can.

  Subsequently, the control program expansion unit 60 provided in the RAM 6 will be described with reference to FIG. FIG. 3 is a block diagram showing a control program expansion unit 60 provided in the RAM 6 in the first embodiment of the present invention.

  The CPU 5 can access the RAM 6. As shown in FIG. 3, the control program extension unit 60 provided in the RAM 6 includes an extension program start address storage unit 61 having a subroutine start address storage variable 611, an identification number storage array 621, a first argument storage array 622, a second A command storage unit 62 having an argument storage array 623 and a command execution result storage area 624, and an extended program storage unit 63 having a program storage area 631 are provided.

  In the extended program start address storage unit 61, a subroutine start address storage variable 611 stores a start address of a subroutine to be described later. Here, the subroutine is a processing unit of a program that extends the control program 70 and ends the processing with a return instruction that returns the processing to the calling side, and means, for example, a processing unit called a function in C language It is.

  The valid addresses stored in the subroutine start address storage variable 611 are, for example, the start address of the subroutine stored in the program storage area 631, the start address of the subroutine stored in the ROM 7, and the like.

  In the command storage unit 62, the identification number storage array 621 stores an identification number for identifying a command. The first argument storage array 622 stores, as a first argument, first argument information necessary to execute a command corresponding to the identification number. The second argument storage array 623 stores second argument information necessary for executing a command corresponding to the identification number as a second argument. The command execution result storage area 624 stores the result of execution of the command corresponding to the identification number.

  Here, an example of the above-mentioned command will be described with reference to FIG. FIG. 4 is a table showing an example of definition of a command of the extension program executed by the CPU 5 according to the first embodiment of the present invention.

  In FIG. 4, the identification numbers stored in the identification number storage array 621 are shown, and further, the behavior of the subroutine is shown as the definition of the command corresponding to the identification numbers. Also, the use of the first argument stored in the first argument storage array 622 and the use of the second argument stored in the second argument storage array 623 can be understood from the definition of the command shown in FIG.

  A plurality of sets of storage arrays are stored in the command storage unit 62 as the identification number storage array 621, the first argument storage array 622, and the second argument storage array 623 as one set of storage arrays, whereby a plurality of commands are stored in the command storage unit. 62 can be stored. Although FIG. 3 exemplifies the set of storage arrays using individual arrays, the form of program implementation may be, for example, a structure definable in C language, a class definable in C ++ language Each element of the identification number storage array 621, the first argument storage array 622, and the second argument storage array 623 may be defined as etc., and an array such as its structure or class may be used.

  Subsequently, the control program 70 stored in the ROM 7 will be described with reference to FIG. FIG. 5 is a block diagram showing control program 70 stored in ROM 7 in the first embodiment of the present invention.

  The control program 70 is stored in the ROM 7, and the CPU 5 reads out and executes the control program 70 stored in the ROM 7. As shown in FIG. 5, the control program 70 stored in the ROM 7 includes an initialization process 71, a cycle control process 72 for periodically controlling the motor 11 which is an example of the control object, and an external communication function 9. It has an XCP process 73 for performing external communication using XCP, a BP interrupt process 74, and an MPU interrupt process 75.

  Next, the cycle control process 72 of the control program 70 will be described with reference to FIG. FIG. 6 is a flowchart showing a cycle control process 72 of the control program 70 executed by the CPU 5 in the first embodiment of the present invention.

  In step S101, the CPU 5 reads and acquires the sensor voltage value input from the I / O 4, and the process proceeds to step S102. As means for the CPU 5 to read the sensor voltage value, for example, means for using an A / D conversion function provided in the microcomputer 3 or a protocol of SENT or PSI 5 for communicating with the sensor can be considered.

  In step S102, the CPU 5 corrects the sensor voltage value acquired in step S101, and the process proceeds to step S105.

  In step S105, the CPU 5 reads correspondence necessity information indicating necessity of correspondence to the specification of the cycle control processing 72, and determines the correspondence necessity information. The cycle control process 72 has two or more types of specifications, and it is necessary to execute the process of step S106 described later as a response to a specific one of the two or more types of specifications.

  Further, in the determination processing in step S105, when the correspondence necessity information is "0", it is determined that the correspondence is not necessary, and the correspondence necessity information is not "0", that is, "1". Is configured to be determined that a response is necessary.

  In step S105, the CPU 5 determines whether the correspondence necessity information is “0” indicating that the correspondence is unnecessary. When the CPU 5 determines that the correspondence necessity information is “0”, the process proceeds to step S103. On the other hand, when the CPU 5 determines that the response necessity information is not “0”, the process proceeds to step S106.

  For example, the following means can be considered as a means for the CPU 5 to determine whether the correspondence necessity information is "0". That is, the CPU 5 reads out and acquires the digital input value input from the I / O 4 at the start of the cycle control process 72, and the correspondence necessity information is “depending on whether the value is High level or Low level. It is determined whether it is 0 ".

  In step S106, the CPU 5 further corrects the sensor voltage value corrected in step S102, that is, additionally corrects the sensor voltage value, and the process proceeds to step S103.

  In step S103, the CPU 5 calculates a control amount from the sensor voltage value after the correction in step S102 or the sensor voltage value after the additional correction in step S106, and the process proceeds to step S104.

  In step S104, the CPU 5 outputs the control amount calculated in step S104 to the I / O 4, and the process ends. The CPU 5 outputs, for example, a control amount corresponding to PWM (Pulse Width Modulation) control to the I / O 4. The drive circuit 10 drives the motor 11 in accordance with the control amount input from the I / O 4.

  Next, a procedure for specifying the cause of the failure when the failure of the cycle control process 72 of the control program 70 shown in FIG. 6 occurs will be described. Here, as an example of the problem of the cycle control process 72 shown in FIG. 6, the CPU 5 determines in step S105 that it is necessary to cope with the specification of the cycle control process 72, and the step S106 should be executed. Suppose that the reverse determination is made and step S106 is not performed. In this case, since the control amount is calculated in step S103 without the sensor voltage value being additionally corrected in step S106, as a result, when the integrated test is performed for the control program 70, the result that the required performance is not satisfied Become.

  Here, for the purpose of explanation, the cause of the failure is indicated in advance as described above, but at the start of the investigation of the cause of the actual failure, the cause of the failure is unknown except that the required performance is not satisfied. is there.

  In the first embodiment, the following three items (1) to (4) are applied to the sensor voltage value input from the I / O 4 in the cycle control process 72 shown in FIG. 3) Confirm.

Item (1): The control amount output to I / O 4 in step S104 is within the design range. Item (2): The control amount calculated in step S103 is within the design range. Item (3) ): The sensor voltage value corrected in step S102 is within the design range

  In order to efficiently check the items (1) to (3) described above, the program storage area 631 of the extension program storage unit 63 of the RAM 6 stores the extension program shown in FIG. It is memorized. Also, the start address of the extended program is stored by using the external communication function 9 and XCP.

  In each of the identification number storage array 621 of the command storage unit 62, the first argument storage array 622, and the second argument storage array 623, an identification number shown in FIG. 9 described later, a first argument, and a second argument Are associated and stored.

  N shown in FIGS. 8 and 9 is set to 0 when storing the control program expansion unit 60 in the RAM 6. When storing the control program expansion unit 60 in the RAM 6, the command execution result storage area 624 stores an initial value such as 0 or 255 indicating that the execution result of the command shown in FIG. 9 is not stored yet. Be done.

  Although FIG. 9 shows a command to be executed when a BP interrupt occurs, a command similar to that of FIG. 9 is obtained even when an MPU interrupt is generated instead of the BP interrupt. To be executed. In the following, the case where a BP interrupt is generated will be described to simplify the description.

  In order to generate a BP interrupt after the CPU 5 executes step S101 shown in FIG. 6, the CPU 5 sets BP51 in the execution address to be accessed when executing step S101, that is, the execution address of step S101. When the BP 51 is disposed at an address accessible by the CPU 5, this setting is performed using the external communication function 9 and the XCP. If BP 51 is not located at an address accessible by CPU 5 and it is necessary to implement this setting using a dedicated instruction of CPU 5 etc., this setting is implemented by adding a user-defined command to XCP. can do.

  As described above, the BP 51 as the access detection function is an execution address to be accessed when the CPU 5 executes a plurality of predetermined specific processes in steps S101 to S106, which is a series of processes constituting the cycle control process 72. Detects that the CPU 5 has accessed and generates an interrupt.

  In the first embodiment, as described above, the case where the access detection function is configured by the BP 51 is illustrated. In this case, the CPU 5 sets the BP 51 to the execution address of the specific process. By thus setting the BP 51 as the access detection function, the BP 51 detects that the CPU accesses the execution address, and generates an interrupt.

  When the access detection function is configured by the first MPU 52 and the second MPU 53, the CPU 5 sets the first MPU 52 and the second MPU 53 in an address range based on the execution address of the specific process. The specific method of setting the address range is the same as the method for generating the above-described MPU interrupt. By setting the first MPU 52 and the second MPU 53 as the access detection function in this manner, the first MPU 52 and the second MPU 53 recognize that the CPU accesses the execution address when the execution address accessed by the CPU 5 is out of the address range. Detect and generate an interrupt.

  The execution address of each of steps S101 to S104 where BP 51 is set can be acquired, for example, by reading the control program 70 with a debugger on the PC and displaying the correspondence between the process and the address.

  Next, the operation of the CPU 5 in the case where a BP interrupt is generated each time each of steps S101 to S104 of the cycle control process 72 shown in FIG. 6 will be described.

  As described above, after the control program expansion unit 60 is stored in the RAM 6 and the function of the BP 51 is validated, if the CPU 5 executes step S101, a first BP interrupt is generated.

  When the first BP interrupt occurs, the CPU 5 executes an interrupt process shown in FIG. Here, interrupt processing executed when a BP interrupt occurs will be described with reference to FIG. FIG. 7 is a flowchart showing the BP interrupt processing 74 of the control program 70 executed by the CPU 5 in the first embodiment of the present invention. The interrupt process is executed each time a plurality of predetermined identification processes are individually executed in steps S101 to S106, which are a series of processes constituting the cycle control process 72, as described later.

  In the interrupt processing shown in FIG. 7, in response to the generated interrupt, the periodic control processing 72 interrupts the processing after execution of the specific processing, executes the first expansion program or the second expansion program, and after the execution, In the cycle control process 72, the CPU 5 is operated so as to resume the process after the execution of the specific process.

  The interrupt process shown in FIG. 7 is a process applicable to the BP interrupt process 74 and the MPU interrupt process 75 of the control program 70. That is, the interrupt process shown in FIG. 7 is applicable to both the BP interrupt process 74 and the MPU interrupt process 75. The interrupt process shown in FIG. 7 may be applied to either the BP interrupt process 74 or the MPU interrupt process 75, or may be applied to both.

  As shown in FIG. 7, when the first BP interrupt is generated and the execution of the interrupt processing is started, the CPU 5 reads out the start address of the subroutine stored in the subroutine start address storage variable 611 in step S201, The process proceeds to step S202.

  In step S202, the CPU 5 determines whether the start address of the subroutine read in step S201 is valid. If it is determined that the start address is valid, the process proceeds to step S203, and if it is determined that the start address is not valid, that is, it is invalid, the process ends.

  As means for determining whether the start address of the subroutine stored in the subroutine start address storage variable 611 is valid or invalid, the CPU 5 may consider, for example, the following means. That is, the CPU 5 determines that the start address is invalid if it is zero, and determines that it is valid if the start address is other than zero.

  In step S203, the CPU 5 executes a subroutine corresponding to the start address read in step S201, and the process ends.

  The subroutine start address storage variable 611 is initialized by the initialization processing 71 at the start of execution of the control program 70, and stores an invalid address.

  Returning to FIG. 6, the CPU 5 executes the interrupt process shown in FIG. 7 when the first BP interrupt occurs after executing step S101. When the first BP interrupt occurs, a valid start address is set in the subroutine start address storage variable 611 as described above.

  Therefore, after executing step S201 in the interrupt processing, the CPU 5 determines in step S202 that the start address read in step S201 is valid, and the process proceeds to step S203.

  In step S203, the CPU 5 calls a subroutine corresponding to the start address read in step S201, and starts execution of the subroutine.

  Here, the subroutine called in the interrupt processing will be described with reference to FIG. FIG. 8 is a flowchart showing a subroutine called in the interrupt process of the control program 70 executed by the CPU 5 in the first embodiment of the present invention.

  The extended program shown in FIG. 8, that is, the first extended program stores the processing result of the specific process in the RAM 6, and the CPU 5 accesses the execution address of the next specific process to be executed next to the specific process in the cycle control process 72. The CPU 5 is operated to set the access detection function so that the access detection function detects that it has been done.

  When the subroutine is called in the interrupt processing, the extension program stored in the program storage area 631 of the extension program storage unit 63, that is, the subroutine shown in FIG. 8 is executed. In step S301, the CPU 5 reads the element N stored in the identification number storage array 621 of the command storage unit 62, and the process proceeds to step S302.

  In step S302, the CPU 5 adds 1 to the element N read in step S301, stores the element N after the addition in the identification number storage array 621, and the process proceeds to step S303.

  In step S303, the CPU 5 determines whether the command corresponding to the element N read out in step S301 is an end command. If it is determined that the command is an end command, the process ends, and if it is determined that the command is not an end command, the process proceeds to step S304.

  In step S304, the command corresponding to the element N read out in step S301 is executed, the process returns to step S301, and the processes in step S301 and subsequent steps are executed again.

  Here, commands executed in the subroutine shown in FIG. 8 will be described with reference to FIG. FIG. 9 is a table showing an example of a command definition of a subroutine called in the interrupt processing of the control program 70 executed by the CPU 5 according to the first embodiment of the present invention.

  As shown in FIG. 9, the element N and the identification number, the first argument, and the second argument are associated with each other, and the identification number storage array 621, the first argument storage array 622, and the second argument storage array 623 And are stored respectively. Further, FIG. 9 also shows the meaning of the command corresponding to the element N.

  Referring back to FIG. 7, when the subroutine is called in the interrupt processing, initially N = 0, so in the subroutine shown in FIG. 8, N = 1 in step S302, and N = 0 in step S304. The command is executed. In this case, as can be seen from FIG. 9, the CPU 5 reads out the sensor voltage value obtained in step S101 and stores it as first data in the command execution result storage area 624.

  Since the command corresponding to N = 0 is not an end command instructing the end of the process, in the subroutine, the processes after step S301 are continuously executed. In the subroutine, N = 2 in step S302, and a command corresponding to N = 1 is executed in step S304. In this case, in order to generate a BP interrupt after the CPU 5 executes step S102 shown in FIG. 6, the CPU 5 sets BP51 in the execution address to be accessed when executing step S102, that is, the execution address of step S102.

  Since the command corresponding to N = 1 is not an end command, in the subroutine, the processes after step S301 are subsequently executed. In the subroutine, in step S302, N = 3, and in step S303, it is determined that the command corresponding to N = 2 is the end command, and the process ends.

  In this case, the subroutine ends, the process returns to the interrupt process shown in FIG. 7, and the interrupt process ends, and the process returns to the completion point of the execution of step S101 of the cycle control process 72 shown in FIG. At the end of the subroutine, the value itself of the element N stored in the identification number storage array 621 is N = 3 as described above.

  Thus, in response to the interrupt generated by the BP 51 as the access detection function, the CPU 5 interrupts the processing after the execution of step S101 in the cycle control processing 72. In addition, the CPU 5 stores the processing result of step S101 in the command execution result storage area 624 according to the extension program by executing the interrupt processing.

  Subsequently, the CPU 5 sets the BP 51 such that the BP 51 detects that the CPU 5 has accessed the execution address of the step S 102 which is the next specific process to be executed next to the step S 101 in the cycle control process 72. Further, the CPU 5 ends the interrupt processing, and restarts the processing after the execution of step S101 in the cycle control processing 72.

  Returning to FIG. 6, after the execution of step S102, when the second BP interrupt is generated, the CPU 5 executes the interrupt processing shown in FIG. 7 again. In this case, a subroutine is called in step S203, and the subroutine is executed again.

  When the subroutine is called in the interrupt processing, N = 3 at the end of the previous subroutine, so in this subroutine, N = 4 in step S302, and N = 3 in step S304. The command is executed. In this case, the CPU 5 reads the sensor voltage value corrected in step S102 and stores it as second data in the command execution result storage area 624.

  Since the command corresponding to N = 3 is not an end command, in the subroutine, the processes after step S301 are subsequently executed. In the subroutine, N = 5 in step S302, and a command corresponding to N = 4 is executed in step S304. In this case, in order to generate a BP interrupt after the CPU 5 executes step S103 shown in FIG. 6, the CPU 5 sets BP51 in the execution address to be accessed when executing step S103, that is, the execution address of step S103.

  Since the command corresponding to N = 4 is not an end command, in the subroutine, the processes after step S301 are subsequently executed. In the subroutine, in step S302, N = 6, and in step S303, it is determined that the command corresponding to N = 5 is an end command, and the process ends.

  In this case, the subroutine ends, the process returns to the interrupt process shown in FIG. 7, and the interrupt process ends, and the process returns to the completion point of the execution of step S102 of the cycle control process 72 shown in FIG. At the end of the subroutine, the value itself of the element N stored in the identification number storage array 621 is N = 6 as described above.

  As described above, in response to the interrupt generated by the BP 51 as the access detection function, the CPU 5 interrupts the process after the execution of step S102 in the cycle control process 72. Further, the CPU 5 stores the processing result of step S 102 in the command execution result storage area 624 according to the extended program by executing the interrupt processing.

  Subsequently, the CPU 5 sets the BP 51 such that the BP 51 detects that the CPU 5 has accessed the execution address of the step S103, which is the next specific process to be executed after the step S102 in the cycle control process 72. Further, the CPU 5 ends the interrupt processing, and resumes the processing after execution of step S102 in the cycle control processing 72.

  Returning to FIG. 6, when the third BP interrupt occurs after the execution of step S103, the CPU 5 executes the interrupt processing shown in FIG. 7 again. In this case, a subroutine is called in step S203, and the subroutine is executed again.

  When the subroutine is called in the interrupt processing, N = 6 at the end of the previous subroutine. Therefore, in the present subroutine, N = 7 in step S302, and corresponds to N = 6 in step S304. The command is executed. In this case, the CPU 5 reads out the control amount calculated in step S103 and stores it as third data in the command execution result storage area 624.

  Since the command corresponding to N = 6 is not an end command, in the subroutine, the processes after step S301 are subsequently executed. In the subroutine, N = 8 in step S302, and the command corresponding to N = 7 is executed in step S304. In this case, in order to generate a BP interrupt after the CPU 5 executes step S104 shown in FIG. 6, the CPU 5 sets BP51 in the execution address to be accessed when executing step S104, that is, the execution address of step S104.

  Since the command corresponding to N = 7 is not an end command, in the subroutine, the processes after step S301 are subsequently executed. In the subroutine, in step S302, N = 9, and in step S303, it is determined that the command corresponding to N = 8 is an end command, and the process ends.

  In this case, the subroutine ends, the process returns to the interrupt process shown in FIG. 7, and the interrupt process ends, and the process returns to the completion point of the execution of step S103 of the cycle control process 72 shown in FIG. At the end of the subroutine, the value itself of the element N stored in the identification number storage array 621 is N = 9 as described above.

  Thus, in response to the interrupt generated by the BP 51 as the access detection function, the CPU 5 interrupts the processing after the execution of step S103 in the cycle control processing 72. Further, the CPU 5 stores the processing result of step S103 in the command execution result storage area 624 according to the extended program by executing the interrupt processing.

  Subsequently, the CPU 5 sets the BP 51 such that the BP 51 detects that the CPU 5 has accessed the execution address of the step S104, which is the next specific process to be executed after the step S103 in the cycle control process 72. Further, the CPU 5 ends the interrupt processing, and restarts the processing after the execution of step S103 in the cycle control processing 72.

  Returning to FIG. 6, when the fourth BP interrupt is generated after the execution of step S104, the CPU 5 executes the interrupt processing shown in FIG. 7 again. In this case, a subroutine is called in step S203, and the subroutine is executed again.

  When the subroutine is called in the interrupt processing, N = 9 at the end of the previous subroutine, so in the present subroutine, N = 10 in step S302, and corresponds to N = 9 in step S304. The command is executed. In this case, the CPU 5 reads out the control amount output in step S104 and stores it as fourth data in the command execution result storage area 624.

  Since the command corresponding to N = 9 is not an end command, in the subroutine, the processes after step S301 are subsequently executed. In the subroutine, N = 11 in step S302, and a command corresponding to N = 10 is executed in step S304. In this case, the CPU 5 substantially disables the BP interrupt by setting BP 51 to zero.

  Since the command corresponding to N = 10 is not an end command, in the subroutine, the processes after step S301 are subsequently executed. In the subroutine, N = 12 in step S302, and it is determined in step S303 that the command corresponding to N = 11 is the end command, and the process is ended.

  In this case, the subroutine ends, the process returns to the interrupt process shown in FIG. 7, and the interrupt process ends, and the process returns to the completion point of the execution of step S104 of the cycle control process 72 shown in FIG. It will end.

  Thus, in response to the interrupt generated by the BP 51 as the access detection function, the CPU 5 interrupts the process after the execution of step S104 in the cycle control process 72. Further, the CPU 5 stores the processing result of step S104 in the command execution result storage area 624 according to the extended program by executing the interrupt processing.

  The CPU 5 executes all the steps S101 to S104 which are specific processes in the series of processes constituting the cycle control process 72, and further executes the step S104 which is the last process of the cycle control process 72. The control process 72 ends.

  As described above, since no new BP interrupt occurs after the occurrence of the fourth BP interrupt, the cycle control process 72 shown in FIG. 6 ends without executing the interrupt process. Therefore, the first data, the second data, the third data, and the fourth data are stored in the command execution result storage area 624 as data after execution of a series of commands corresponding to N = 0 to 11 described above. By reading data stored in the command execution result storage area 624 using the external communication function 9 and XCP, the results of execution of each of steps S101, S102, S103 and S104 are subjected to period control processing of the control program 70. 72 can be obtained without changing.

  On the other hand, when only the XCP is used without applying the configuration of the ECU 1 in the first embodiment, only the data stored in the static variable whose address is known can be acquired by the XCP. , And the data temporarily held in the CPU register can not be acquired. However, according to the configuration of the ECU 1 in the first embodiment, an automatic command temporarily used in the period control process 72 of the control program 70 is defined by defining the command to be executed by the CPU 5 and the command for acquiring the stack frame. It is possible to obtain variables and data temporarily held in the CPU register.

  The above items (1) to (3) can be confirmed by acquiring data after execution of a series of commands corresponding to the above N = 0 to 11 from the command execution result storage area 624. As a result, it is understood that the control amount output to the I / O 4 in step S104, the control amount calculated in step S103, and the sensor voltage value corrected in step S102 are not within the design range. That is, it can be estimated that the sensor voltage value acquired in step S101 is not corrected as designed.

  In the first embodiment, in order to confirm the estimation that the sensor voltage value is not corrected as designed, the following three items (4) to (6) are further added in period control processing 72 shown in FIG. Check.

-Item (4): Correctly read the correspondence necessity information-Item (5): Additional correction is executed in step S106-Item (6): The sensor voltage value additionally corrected in step S106 is Be within the design range

  In order to efficiently check the items (4) to (6) described above, the program storage area 631 of the program storage unit 63 of the RAM 6 stores the extension program shown in FIG. Also, the start address of the extended program is stored by using the external communication function 9 and XCP.

  In each of the identification number storage array 621 of the command storage unit 62, the first argument storage array 622, and the second argument storage array 623, an identification number shown in FIG. 10 described later, a first argument, and a second argument Are associated and stored. Further, in order to generate a BP interrupt after the CPU 5 executes step S102 shown in FIG. 6, the CPU 5 sets BP51 at the execution address of step S102.

  As described above, after the control program expansion unit 60 is stored in the RAM 6 and the function of the BP 51 is validated, if the CPU 5 executes step S102, a first BP interrupt is generated.

  When the first BP interrupt occurs, the CPU 5 executes the interrupt process shown in FIG. 7 as in the case of confirming the items (1) to (3) described above. In the interrupt processing, the CPU 5 calls a subroutine corresponding to the start address stored in the subroutine start address storage variable 611, and starts the execution of the subroutine.

  The subroutine shown in FIG. 8 is executed by calling the subroutine at step S203. In this subroutine, the commands shown in FIG. 10 are executed. FIG. 10 is a table showing an example of a command definition of a subroutine called in the interrupt processing of the control program 70 executed by the CPU 5 according to the first embodiment of the present invention.

  As shown in FIG. 10, the element N and the identification number, the first argument, and the second argument are associated with each other, and the identification number storage array 621, the first argument storage array 622, and the second argument storage array 623 And are stored respectively. Further, in FIG. 10, the meaning of the command corresponding to the element N is also shown.

  In the subroutine, after the command corresponding to N = 0 to 2 shown in FIG. 10 is executed, the processing is returned to the calling side's interrupt processing. At this time, the CPU 5 places the read-out correspondence information read out above in the command execution result storage area 624 as the first data immediately before the completion point of the execution of step S102, ie, the start of the execution of step S105. Remember.

  As described above, when the subroutine shown in FIG. 8 is completed, the process is returned to the interrupt process shown in FIG. 7, and the interrupt process is completed, and the CPU 5 returns to the execution completion point of step S102. Thereafter, the CPU 5 executes step S105.

  In the first embodiment, as described above, as an example of the problem, in step S105, the CPU 5 determines that it is necessary to cope with the specification of the cycle control process 72, and the place where the step S106 is to be performed is The reverse determination is performed, and the case where step S106 is not performed is considered. Therefore, in step S105, the CPU 5 determines that the correspondence necessity information is “0” indicating that the correspondence is unnecessary, and executes step S103 without executing step S106.

  Therefore, although the CPU 5 sets the BP 51 to the execution address of step S106 by executing the command corresponding to N = 1 shown in FIG. 10, since step S106 is not executed, the second BP interrupt is not generated. As a result, the sensor voltage value after the additional correction stored in the command execution result storage area 624 as the second data remains at the initial value, and the value of the element N remains at 3.

  The above items (4) to (6) can be confirmed by acquiring data after execution of a series of commands corresponding to the above N = 0 to 5 from the command execution result storage area 624. As a result, it is understood that the correspondence necessity information is correctly read, the additional correction is not performed, and the sensor voltage value after the additional correction is an initial value because step S106 is not performed.

  From the confirmation results of the above items (1) to (6), it can be understood that the cause of the failure may be that the additional correction of the sensor voltage value is not performed.

  On the other hand, when only the XCP is used without applying the configuration of the ECU 1 in the first embodiment, the items (4) and (5) can not be confirmed directly. Therefore, even if it is confirmed that the sensor voltage value after correction before execution of step S103 is out of the design range, direct evidence that the reason is due to non-execution of step S106 can not be obtained.

  However, according to the configuration of the ECU 1 in the first embodiment, the items (4) and (5) can be confirmed. Therefore, although the reason why the sensor voltage value after correction before execution of step S103 is out of the design range is that the correspondence necessity information is correctly read, the determination in step S105 is incorrect, and step S106 is not executed. It can be estimated that it was because it was.

  In general BP functions, in addition to detecting execution of a specific address, it is often possible to detect data reading or data writing of a specific address. Therefore, a BP interrupt may be generated when the CPU 5 reads the above-mentioned correspondence necessity information by using the detection function of data reading of a specific address in the BP 51. In this case, the CPU 5 can store the correspondence necessity information in the command execution result storage area 624 in the interrupt process in response to the occurrence of the BP interrupt.

  If the estimation accuracy of the cause of the above-mentioned failure is high, it is easy to confirm the contents of the determination of step S105 and to find out that the determination logic is reverse. In other words, if the above items (1) to (6) are confirmed according to the configuration of the ECU 1 in the first embodiment, it is possible to use the XCP memory access function with higher accuracy without using the debugger. The cause of the failure can be identified.

  As described above, the CPU 5 executes the interrupt process in response to the interrupt generated by the BP 51, thereby interrupting the process after the execution of the specific process in the cycle control process 72 and executing the extended program shown in FIG. . The CPU 5 causes the command execution result storage area 624 of the RAM 6 to store the processing result of the specific processing, that is, the processing for which it is desired to acquire data by executing the expansion program shown in FIG.

  Further, by causing the CPU 5 to execute the extension program shown in FIG. 8, the BP 51 detects that the CPU 5 has accessed the execution address of the next specific process to be executed next to the specific process in the cycle control process 72. , BP 51 is set. After that, the CPU 5 resumes the processing after the execution of the specific processing in the cycle control processing 72 after the execution of the extension program.

  In the first embodiment, after the cause of the failure of the cycle control process 72 of the control program 70 is estimated, the failure is corrected, and the result of the cycle control process 72 after the correction is confirmed.

  In order to efficiently check the correction described above, the program storage area 631 of the expansion program storage unit 63 of the RAM 6 stores an expansion program shown in FIG. 11 described later, that is, a second expansion program. Also, the start address of the extended program is stored by using the external communication function 9 and XCP.

  In order to generate a BP interrupt after the CPU 5 executes step S102 shown in FIG. 6, the CPU 5 sets BP51 to the execution address of step S102.

  As described above, after the control program expansion unit 60 is stored in the RAM 6 and the function of the BP 51 is validated, if the CPU 5 executes step S102, a BP interrupt occurs immediately before the CPU 5 executes step S105.

  When a BP interrupt occurs, the CPU 5 executes an interrupt process shown in FIG. In the interrupt processing, the CPU 5 calls a subroutine shown in FIG. 11 corresponding to the start address stored in the subroutine start address storage variable 611, and starts the execution of the subroutine.

  Here, the subroutine called in the interrupt processing will be described with reference to FIG. FIG. 11 is a flowchart showing a subroutine called in the interrupt processing of the control program 70 executed by the CPU 5 in the first embodiment of the present invention.

  The expansion program shown in FIG. 11, that is, the second expansion program causes the CPU 5 to execute post-correction processing after correcting the processing that is the cause of the failure occurring in the cycle control processing 72. The post-correction process corresponds to steps S105N and S106 shown in FIG.

  When the subroutine is called in the interrupt processing, the CPU 5 executes the extension program shown in FIG. 11 stored in the program storage area 631 of the extension program storage unit 63. In this case, in step S105N, the CPU 5 determines whether the correspondence necessity information is “1” indicating that the correspondence is unnecessary.

  Here, in the determination processing of step S105N, when the correspondence necessity information is “1”, it is determined that the correspondence is not necessary, and the correspondence necessity information is not “1”, that is, “0”. In this case, it is configured to be determined that a response is necessary. That is, step S105N corrects step S105 shown in FIG. 6 which is the cause of the problem occurring in the cycle control process 72. Specifically, the determination logic in step S105N is corrected to be the reverse of the determination logic in step S105.

  In step S105N, when the CPU 5 determines that the correspondence necessity information is “1”, the process ends. On the other hand, when the CPU 5 determines that the correspondence necessity information is not “1”, the process proceeds to step S106.

  After executing step S106 shown in FIG. 11, the subroutine ends. By the end of the subroutine shown in FIG. 11, the process returns to the interrupt process shown in FIG. 7, and the interrupt process ends, and the process returns to the completion point of the execution of step S102 shown in FIG. Thereafter, although the CPU 5 executes the determination of step S105, this determination is not correctly performed due to the above-described failure. Therefore, the CPU 5 executes step S103 without executing step S106. Thereafter, the CPU 5 executes step S104, and the cycle control process 72 ends.

  As described above, the CPU 5 executes the expansion program shown in FIG. 11 to execute the post-correction process after correcting the process that is the cause of the occurrence of the failure in the cycle control process 72. After that, the CPU 5 resumes the processing after the execution of the specific processing in the cycle control processing 72 after the execution of the extension program. That is, according to the subroutine shown in FIG. 11, the CPU 5 executes the steps S105N and S106 to perform the additional correction of the sensor voltage value. Thereafter, the CPU 5 sequentially executes steps S105 and S103 by the cycle control process 72 shown in FIG. 6, and finally executes step S104. Therefore, storing the extended program shown in FIG. 11 in the RAM 6 and carrying out an integration test on the control program 70 eliminates the problem that the required performance is not satisfied without changing the cycle control process 72 of the control program 70. You can confirm that. That is, when confirming the result of the defect correction of the control program 70, it is not necessary to use the hook function necessary for the on-target bypassing.

  As described above, according to the on-vehicle control device of the first embodiment, the cycle control process and the plurality of predetermined specific processes in the series of processes constituting the cycle control process are executed individually. It comprises: a ROM for storing a control program including interrupt processing; a RAM for storing a first expansion program and a second expansion program as an expansion program; and a CPU for executing the control program and the expansion program.

  Further, in the above configuration, the CPU is configured as follows. That is, the CPU is configured to have an access detection function of detecting an access to an execution address to be accessed when executing a specific process, and generating an interrupt.

  The CPU executes the interrupt processing in response to the interrupt generated by the access detection function, thereby interrupting the processing after the execution of the specific processing in the periodic control processing and executing the first extension program or the second extension program. After the execution, the periodic control process is configured to resume the process after the execution of the specific process. The CPU stores the processing result of the specific process in the RAM by executing the first extension program, and the CPU accesses the execution address of the next specific process to be executed next to the specific process in the periodic control process. The access detection function is configured to set the access detection function so that the access detection function detects. The CPU is configured to execute the post-correction process after correcting the process that is the cause of the occurrence of the failure in the cycle control process by executing the second extension program.

  By configuring the above-mentioned in-vehicle control device, it is possible to identify the cause of the control program failure without using the debugger, and confirm the solution of the control program failure without preparing the hook function. Can.

  Reference Signs List 1 in-vehicle control unit (ECU), 2 input circuits, 3 microcomputers, 4 I / O, 5 CPU, 6 RAM, 7 ROM, 8 timers, 9 external communication function, 10 drive circuits, 11 motors, 12 external communication lines, 51 Breakpoint function, 52 first memory protection function, 53 second memory protection function, 60 control program extension unit, 61 extended program start address storage unit, 611 subroutine start address storage variable, 62 command storage unit, 621 identification number storage array, 622 first argument storage array 623 second argument storage array 624 command execution result storage area 63 extended program storage unit 631 program storage area 70 control program 71 initialization process 72 cycle control process 73 XCP process 74 BP interrupt processing, 75 MPU interrupt processing .

The on-vehicle control device according to the present invention performs periodic control processing for periodically controlling the control target, and a plurality of predetermined specific processing among the series of processing constituting the periodic control processing are individually executed. CPU includes: a ROM storing a control program including an interrupt process to be executed; a RAM storing a first expansion program and a second expansion program as an expansion program; and a CPU executing the control program and the expansion program The access detection function detects an access to the execution address to be accessed when executing the specific processing, and generates an interrupt. By executing the interrupt processing in response to the interrupt generated by the access detection function, The processing after the execution of the specific processing in the periodic control processing is interrupted, and the first extended program or the second After executing the tension program, the periodic control processing resumes the processing after the execution of the specific processing and the first extension program is executed, thereby storing the processing result of the specific processing in the RAM and performing periodic control By setting the access detection function so that the access detection function detects that the CPU has accessed the execution address of the next specific process to be executed next to the specific process in the process, the second extended program is executed, it is intended to correct the result of the cause of the defect in processing at a cycle control process.

Claims (3)

A cycle control process for periodically controlling a control target, and an interrupt process which is executed each time a plurality of predetermined specific processes among the series of processes constituting the cycle control process are individually executed A ROM storing a control program including the
A RAM storing a first expansion program and a second expansion program as an expansion program;
A CPU that executes the control program and the extension program;
Equipped with
The CPU is
An access detection function is provided which detects an access to an execution address to be accessed when executing the specific processing, and generates an interrupt.
By executing the interrupt processing in response to the interrupt generated by the access detection function, processing after the execution of the specific processing is interrupted in the periodic control processing, and the first extension program or the second extension program is executed. The program is executed, and after the execution, processing after the execution of the specific processing is resumed in the periodic control processing,
By executing the first extension program, the processing result of the specific process is stored in the RAM, and the CPU executes the next specific process execution address next to the specific process in the periodic control process. Setting the access detection function so that the access detection function detects that the access has been made;
An in-vehicle control device that executes a post-correction process after correcting a process that is a cause of a failure in the periodic control process by executing the second extension program. The access detection function is configured by a breakpoint function,
The CPU sets the breakpoint function to the execution address.
The in-vehicle control device according to claim 1, wherein the breakpoint function detects that the CPU accesses the execution address and generates the interrupt. The access detection function includes a first memory protection function and a second memory protection function.
The CPU sets the first memory protection function and the second memory protection function in an address range based on the execution address.
The first memory protection function and the second memory protection function detect that the CPU has accessed the execution address based on the fact that the execution address accessed by the CPU is out of the address range, and the interrupt is generated. The on-vehicle control device according to claim 1.

Images