JP6463445B1 - In-vehicle control device - Google Patents

Abstract

An in-vehicle control device that can identify the cause of a malfunction of a control program without using a debugger and can confirm the elimination of the malfunction of the control program without preparing a hook function. An in-vehicle control device includes a ROM, a RAM, and a CPU. The ROM stores a control program including a cycle control process and an interrupt process that is executed each time a plurality of predetermined specific processes are individually executed in a series of processes constituting the cycle control process. RAM, as an extended program, has discovered a problem in the periodic control process, and has corrected the problem with respect to the first extended program that can identify the cause of the problem and the control program prior to correcting the problem in the processing part A later processing part is added and stored in the second extension program, which is executed in place of the processing part before correction, and which can confirm that the control program has been solved. The CPU executes a control program and an extension program. [Selection] Figure 1

Description

  The present invention relates to an in-vehicle control device devised so that information related to the execution result of a control program can be acquired from a RAM.

  An in-vehicle control unit (Electronic Control Unit; hereinafter referred to as “ECU”) that controls an inverter for driving a motor, a converter for driving an illumination, and the like is incorporated in a housing to be controlled such as a motor and an illumination device as a functional component. It is commercialized.

  The ECU is configured as follows in order to perform various control processes, exchange information with other ECUs, perform cooperative operations, and the like. That is, the ECU has a function of performing communication (hereinafter referred to as “external communication”) with other ECUs and various tools connected to communication lines such as CAN, FlexRay, and Ethernet (registered trademark) ( (Hereinafter referred to as “microcomputer”).

Universal Measurement and Calibration Protocol, [Search on August 25, 2017], Internet <URL: https: // wiki. asam. net / display / STANDARDS / ASAM + MCD-1 + XCP> Bypassing-Externally or Directly on the ECU, [August 25, 2017 search], Internet <URL: https: // www. dspace. com / en / pub / home / products / systems / funtp / bypassing. cfm>

  Here, in the development of the control program executed by the microcomputer, processing is added, changed, or deleted to meet the requirements imposed on the product, and whether the result is valid is confirmed. Tests are conducted for In this development, processing that does not satisfy the requirements, unintended behavior, errors, etc. (hereinafter referred to as “defects”) are repeatedly corrected.

  In the initial stage of development of the control program, at the stage where the practicality of the control program cannot be sufficiently confirmed, development is performed by the ECU alone without combining the ECU with the control target. When development is performed by the ECU alone, the development can proceed with the debugger always connected to the microcomputer of the ECU. When a defect is found in the control program, the investigation of the cause of the defect proceeds as follows. That is, the investigation proceeds while confirming whether or not the execution result is as intended in each line of the source code of the control program by using the source level debugging function provided by the debugger.

  When the practicality of the control program is sufficiently confirmed, an integrated test is performed in combination with the control target. At this stage, the ECU is often incorporated in the housing to be controlled, and it is often difficult to connect a debugger to the microcomputer of the ECU. Therefore, a function for transmitting processing data of the control program, execution time data such as a variable indicating the state is added to the external communication function normally provided in the ECU. By receiving and observing the runtime data transmitted by this transmission function, it is confirmed whether or not the control program is operating normally.

  The execution data of the above-described control program is, for example, CAN Calibration Protocol (hereinafter referred to as Universal Measurement and Calibration), which is standardized by Association for Standardization of Automation and Measurement Systems (ASAM), or Universal Measurement and Calibration. It is transmitted by applying a protocol (see, for example, Non-Patent Document 1).

  According to Non-Patent Document 1, an ECU to which XCP is applied can read a value held by each address accessible by a CPU (central processing unit) that executes a control program, and further, the address can be stored in a RAM (random). in the case of an access memory) or a peripheral function register, a specified value can be written to the address. In this case, the number and amount of execution data of the control program that can be acquired per unit time is limited by performance such as the communication speed and data processing speed of the external communication function of the ECU.

  As a main application of XCP, for example, when the control target value calculated by the control program is not optimal for the control target, it is used for the process of repeatedly adjusting various control parameters used for the calculation (hereinafter referred to as “calibration”). Is done.

  Further, the ECU to which XCP is applied can correspond to a PROGRAM command for rewriting a flash memory storing a control program, data, and the like as well as the above-described RAM. By using this command, part or all of the control program or data stored in the flash memory can be rewritten via the external communication function of the ECU. Further, it is possible for the user to additionally define and use a command not defined in XCP.

  When a defect is found in the control program in the integration test described above, the developer of the control program may need to acquire and analyze the above-mentioned runtime data to identify the cause of the defect in the control program. . In this case, the control program developer can obtain only a part of the control program runtime data, and cannot use the source level debugging function of the control program provided when the debugger is connected to the microcomputer. . Therefore, there is a problem that it is difficult to investigate the cause of the malfunction of the control program.

  Therefore, the control program developer estimates the cause of the malfunction of the control program based on a part of the execution data of the control program, writes the corrected control program to the ECU using means such as XCP, and performs the integration test again. Will do.

  However, when the cause of the malfunction of the control program is not correctly estimated, the malfunction may not be completely eliminated. In that case, the development cycle from the process of acquiring the above-mentioned control program execution data to the process of performing the integration test is repeated until the true cause of the malfunction of the control program is identified. As a result, there is a problem that it takes time to develop a control program.

  If the XCP PROGRAM command described above is used, the flash memory of the ECU can be rewritten to update the control program after correcting the problem. However, as described above, when the cause of the malfunction of the control program is not correctly estimated, it is necessary to return to the step of acquiring the execution data of the control program in which the malfunction occurs in order to correctly estimate the cause of the malfunction. Therefore, it is often necessary to return the control program after correction to the state before correction. For this reason, it is desirable to be able to identify the cause of the defect and confirm the effect of the correction without returning the corrected control program to the state before the correction.

  As a means for shortening the time required for repeating the above-described development cycle, particularly the process of correcting the algorithm of the control program, for example, Bypassing has been conventionally known (for example, refer to Non-Patent Documents 1 and 2).

  According to Non-Patent Document 2, a branch processing function called a hook function is provided immediately before executing the original program process, and the original process or a process in which a control parameter created later is changed in the hook function is selected. And run. Thereby, it is possible to switch only the process that needs to be changed to the post-change process and execute the program without rewriting the entire control program stored in the ROM (read only memory) of the ECU.

  Note that the following two methods are known as mounting methods of the above-mentioned bypassing (for example, see Non-Patent Document 2). That is, as a first method, a hook function transmits parameters used for processing, that is, an argument of the function to the outside of, for example, a personal computer or the like via XCP and external communication, and the result of executing processing outside is sent to the ECU. There is an example of External Bypassing. As a second method, there is On-target Bypassing that is executed by branching from the hook function to the changed program portion stored in advance in the RAM of the ECU. In particular, in ECUs, the cycle of control processing may be as short as several tens of microseconds. With External Bypassing, external communication becomes a time bottleneck, and it is difficult to receive processing results from external communication within that cycle. is there. Therefore, the ECU may require on-target bypassing that can execute processing in the ECU.

  When calibrating the control parameter, the processing function that requires adjustment of the control parameter is known, so that the hook function can be added only to the necessary processing part.

  However, when a problem occurs in the algorithm of the control program, it is difficult to predict the occurrence location in advance and prepare a hook function. Therefore, in order to be able to cope with a malfunction of a control program that occurs at an arbitrary location in advance, for example, it is necessary to prepare hook functions for all functions. In this case, there is a problem that it is inefficient to create a hook function over the entire control program in order to cope with a problem occurring in a part of the control program.

  The present invention has been made to solve the above-described problems, and can determine the cause of a malfunction of a control program without using a debugger, and can control without preparing a hook function. An object of the present invention is to obtain an in-vehicle control device capable of confirming the elimination of a program defect.

The vehicle-mounted control device according to the present invention each time a plurality of predetermined specific processes are individually executed in a cycle control process for periodically controlling a control target and a series of processes constituting the cycle control process. A ROM for storing a control program including interrupt processing to be executed, a RAM for storing a first extension program and a second extension program as an extension program, and a CPU for executing the control program and the extension program. , Equipped with an access detection function that detects an access to an execution address that is accessed when executing a specific process and generates an interrupt, and by executing an interrupt process in response to an interrupt generated by the access detection function, The process after the execution of the specific process is interrupted in the cycle control process, and the first extension program or second After executing the program, the process after the execution of the specific process is resumed in the cyclic control process, and the first extension program is executed, so that the processing result of the specific process is stored in the RAM and the cyclic control is performed. By setting the access detection function and executing the second extension program so that the access detection function detects that the CPU has accessed the execution address of the next specific process executed next to the specific process in the process, it is intended to correct the result of the cause of the defect in processing at a cycle control process.

  According to the present invention, an in-vehicle control apparatus that can identify the cause of a malfunction of a control program without using a debugger and can confirm the elimination of the malfunction of the control program without preparing a hook function. Can be obtained.

It is a block diagram which shows the structure of ECU in Embodiment 1 of this invention. It is a block diagram which shows the function with which CPU in Embodiment 1 of this invention is equipped. It is a block diagram which shows the control program expansion part provided in RAM in Embodiment 1 of this invention. It is a table | surface which shows an example of the definition of the command of the extended program which CPU in Embodiment 1 of this invention performs. It is a block diagram which shows the control program memorize | stored in ROM in Embodiment 1 of this invention. It is a flowchart which shows the period control process of the control program which CPU in Embodiment 1 of this invention performs. It is a flowchart which shows the interruption process of the control program which CPU runs in Embodiment 1 of this invention. It is a flowchart which shows the subroutine called by the interruption process of the control program which CPU runs in Embodiment 1 of this invention. It is a table | surface which shows an example of the definition of the command of the subroutine called by the interruption process of the control program which CPU in Embodiment 1 of this invention performs. It is a table | surface which shows an example of the definition of the command of the subroutine called by the interruption process of the control program which CPU in Embodiment 1 of this invention performs. It is a flowchart which shows the subroutine called by the interruption process of the control program which CPU runs in Embodiment 1 of this invention.

  Hereinafter, a vehicle-mounted control device according to the present invention will be described with reference to the drawings according to a preferred embodiment. In the description of the drawings, the same portions or corresponding portions are denoted by the same reference numerals, and redundant description is omitted.

Embodiment 1 FIG.
FIG. 1 is a block diagram showing a configuration of ECU 1 according to Embodiment 1 of the present invention. In FIG. 1, the ECU 1 exemplifies a case in which the control of the motor 11 that is an example of the control target is performed and the external communication line 12 is configured to communicate with the outside.

  Here, with the configuration of the ECU 1, which will be described later, the ECU 1 can find a problem in the periodic control process in the control program and specify the cause of the problem. The cycle control process is executed at a short cycle of, for example, 50 μsec. Moreover, the processing part after correcting the defect is added to the control program before correcting the defect of the processing part by the configuration of the ECU 1, and the added processing part is executed instead of the processing part before the correction. Is done. As a result, it is possible to confirm that the control program has been solved.

  In FIG. 1, an ECU 1 includes an input circuit 2, a microcomputer 3, and a drive circuit 10, and controls a motor 11 and is connected to an external communication line 12. The microcomputer 3 includes an input / output function (hereinafter referred to as I / O) 4, a CPU 5, a RAM 6, a ROM 7, a timer 8, and an external communication function 9.

  Here, in the configuration of the ECU 1 of the first embodiment, a protocol based on, for example, XCP is added to the external communication function 9 of the microcomputer 3. As a result, the setting for detecting the access of the designated memory address from the external communication is performed, and the designated command and its argument shown in FIGS. 9 and 10 to be described later are stored in the RAM 6.

  The input circuit 2 reads signals from the outside and signals from various sensors provided in the motor 11 to be controlled as voltages. The I / O 4 inputs and outputs digital signals, takes in the voltage read by the input circuit 2 into the microcomputer 3, and outputs a control signal to the drive circuit 10.

  The CPU 5 is a microprocessor using a well-known architecture, and is configured to be able to execute a later-described control program 70 stored in the ROM 7. Further, when an interrupt occurs during the execution of the control program 70, the CPU 5 executes a process corresponding to the interrupt. Depending on the microprocessor applied as the CPU 5, the interrupt may be referred to as an exception, but in the first embodiment, the two are not particularly distinguished and are simply referred to as an interrupt.

  Next, functions provided in the CPU 5 will be described with reference to FIG. FIG. 2 is a block diagram illustrating functions provided in the CPU 5 according to Embodiment 1 of the present invention.

  As shown in FIG. 2, the CPU 5 includes a breakpoint function (hereinafter referred to as “BP”) 51 and two memory protection functions (hereinafter referred to as “MPU”), that is, a first MPU 52 and a second MPU 53. A memory protection function group.

  Note that the number of BPs 51 included in the CPU 5 is one or more, and the number of memory protection function groups included in the CPU 5 is one or more.

  The BP 51 is arranged in a register of the CPU 5 or a memory space accessible by the CPU 5. The CPU 5 can set the BP 51 to a specific memory address by executing a program stored in the ROM 7. The BP 51 monitors a memory address accessed by the CPU 5, and if the CPU 5 accesses the set address, an interrupt that notifies the CPU 5 that the CPU 5 has accessed the set address (hereinafter referred to as "BP interrupt"). Is generated. That is, the BP 51 can detect that the CPU 5 has accessed a specific address.

  When the CPU 5 cannot operate the BP 51, that is, when the BP 51 cannot be used, the first MPU 52 and the second MPU 53 are used instead of the BP 51. The CPU 5 may be a single core or a plurality of cores as long as it can access the I / O 4, the RAM 6, the ROM 7, the timer 8, and the external communication function 9.

  The first MPU 52 and the second MPU 53 monitor whether or not the memory address accessed by the CPU 5 is within an address range in which the first MPU 52 and the second MPU 53 are set. The CPU 5 can set the first MPU 52 and the second MPU 53 to the lower limit value and the upper limit value of the address range, respectively. If the memory address accessed by the CPU 5 is outside the set address range, the first MPU 52 and the second MPU 53 notify the CPU 5 that the CPU 5 has accessed an address outside the set address range (hereinafter referred to as “MPU”). Interrupt ”).

  In the first embodiment, when the BP 51 cannot be used, the CPU 5 detects that the CPU 5 has accessed a specific memory address by using the above-described functions of the first MPU 52 and the second MPU 53. For example, when it is detected that the CPU 5 accesses a certain address A, the CPU 5 sets the first MPU 52 in the range from the beginning of the memory space accessible by the CPU 5 to the address A-1, and the CPU 5 accesses from the address A + 1. The second MPU 53 is set in a range up to the end of the possible memory space. Thereafter, the CPU 5 validates the functions of the first MPU 52 and the second MPU 53.

  As described above, the CPU 5 sets the first MPU 52 and the second MPU 53 in the above-described address range, and validates the functions of the first MPU 52 and the second MPU 53. Thereafter, when the CPU 5 accesses the address A, an MPU interrupt occurs because the address A is an address outside the address range in which the first MPU 52 and the second MPU 53 are set. That is, the first MPU 52 and the second MPU 53 can detect that the CPU 5 has accessed the address A, that is, a specific address.

  Returning to the description of FIG. 1, the drive circuit 10 drives the motor 11 according to the control amount input from the microcomputer 3. The external communication function 9 is connected to the external communication line 12. The external communication line 12 is a general communication line used in an ECU such as CAN, CAN FD, FlexRay, Ethernet (registered trademark), or the like. In addition, in this Embodiment 1, although the case where this invention is applied with respect to ECU1 which controls the motor 11 is illustrated, it is not limited to this, ECU which controls another control object other than the motor 11 is shown. The present invention can also be applied to this. For example, when the converter is used as the drive circuit 10 and the object to be controlled is changed from the motor 11 to the LED, the illuminance control of the LED is also performed in a short cycle similarly to the drive control of the motor 11. The configuration of the external communication function 9 is not particularly limited. For example, a configuration in which the above-described communication methods are used in combination or a configuration in which a plurality of the same communication methods are used is conceivable. Further, when wiring can be added to the ECU 1, various serial communications such as UART and SPI, general-purpose digital input / output (GPIO), etc. provided in the microcomputer 3 are applied as the external communication function 9. Can do.

  Next, the control program extension unit 60 provided in the RAM 6 will be described with reference to FIG. FIG. 3 is a block diagram showing the control program extension unit 60 provided in the RAM 6 according to Embodiment 1 of the present invention.

  The CPU 5 can access the RAM 6. As shown in FIG. 3, the control program expansion unit 60 provided in the RAM 6 includes an expansion program start address storage unit 61 having a subroutine start address storage variable 611, an identification number storage array 621, a first argument storage array 622, a second A command storage unit 62 having an argument storage array 623 and a command execution result storage region 624 and an extended program storage unit 63 having a program storage region 631 are provided.

  In the extended program start address storage unit 61, a subroutine start address storage variable 611 stores a subroutine start address to be described later. Here, the subroutine is a processing unit of a program that extends the control program 70, and ends processing with a return instruction that returns processing to the caller. For example, in the C language, it means a processing unit called a function. It is.

  Valid addresses stored in the subroutine start address storage variable 611 are, for example, a subroutine start address stored in the program storage area 631, a subroutine start address stored in the ROM 7, and the like.

  In the command storage unit 62, the identification number storage array 621 stores an identification number for identifying a command. The first argument storage array 622 stores the first argument information necessary for executing the command corresponding to the identification number as the first argument. The second argument storage array 623 stores second argument information necessary for executing the command corresponding to the identification number as the second argument. The command execution result storage area 624 stores the result of executing the command corresponding to the identification number.

  Here, an example of the above-described command will be described with reference to FIG. FIG. 4 is a table showing an example of the definition of the extended program command executed by the CPU 5 according to the first embodiment of the present invention.

  In FIG. 4, the identification numbers stored in the identification number storage array 621 are shown, and further, the behavior of the subroutine is shown as the definition of the command corresponding to the identification number. Further, the use of the first argument stored in the first argument storage array 622 and the use of the second argument stored in the second argument storage array 623 can be understood from the command definition shown in FIG.

  By storing the identification number storage array 621, the first argument storage array 622, and the second argument storage array 623 as one set of storage arrays and storing a plurality of sets of storage arrays in the command storage unit 62, a plurality of commands can be stored in the command storage unit. 62 can be stored. In FIG. 3, the set of storage arrays is illustrated by using individual arrays. However, as a program implementation form, for example, a structure that can be defined in C language, a class that can be defined in C ++ language, or the like. Each element of the identification number storage array 621, the first argument storage array 622, and the second argument storage array 623 may be defined and the structure, the class, and the like may be used.

  Next, the control program 70 stored in the ROM 7 will be described with reference to FIG. FIG. 5 is a block diagram showing a control program 70 stored in the ROM 7 in the first embodiment of the present invention.

  The ROM 7 stores a control program 70, and the CPU 5 reads and executes the control program 70 stored in the ROM 7. As shown in FIG. 5, the control program 70 stored in the ROM 7 includes an initialization process 71, a period control process 72 for periodically controlling the motor 11, which is an example of a control target, an external communication function 9, and the like. It has an XCP process 73 for performing external communication using XCP, a BP interrupt process 74, and an MPU interrupt process 75.

  Next, the cycle control process 72 of the control program 70 will be described with reference to FIG. FIG. 6 is a flowchart showing the cycle control process 72 of the control program 70 executed by the CPU 5 in the first embodiment of the present invention.

  In step S101, the CPU 5 reads and acquires the sensor voltage value input from the I / O 4, and the process proceeds to step S102. As a means for the CPU 5 to read the sensor voltage value, for example, an A / D conversion function provided in the microcomputer 3 or a means using a SENT or PSI 5 protocol for communicating with the sensor can be considered.

  In step S102, the CPU 5 corrects the sensor voltage value acquired in step S101, and the process proceeds to step S105.

  In step S <b> 105, the CPU 5 reads out correspondence necessity information indicating necessity of correspondence to the specification of the cycle control process 72, and determines the necessity information. Note that the cycle control process 72 has two or more types of specifications, and it is necessary to execute the process of step S106 described later as a response to a specific specification of the two or more types of specifications.

  Further, in the determination process of step S105, if the correspondence necessity information is “0”, it is determined that no correspondence is necessary, and the correspondence necessity information is not “0”, that is, “1”. Is configured so that it is determined that a response is necessary.

  In step S105, the CPU 5 determines whether or not the correspondence necessity information is “0” indicating that no correspondence is necessary. If the CPU 5 determines that the necessity information is “0”, the process proceeds to step S103. On the other hand, if the CPU 5 determines that the correspondence necessity information is not “0”, the process proceeds to step S106.

  For example, the following means can be considered as means for the CPU 5 to determine whether the correspondence necessity information is “0”. That is, the CPU 5 reads out and acquires the digital input value input from the I / O 4 at the start of the cycle control processing 72, and the correspondence necessity information is “high level or low level” depending on whether the value is the high level or the low level. Whether or not “0” is determined.

  In step S106, the CPU 5 further corrects the sensor voltage value corrected in step S102, that is, additionally corrects the sensor voltage value, and the process proceeds to step S103.

  In step S103, the CPU 5 calculates a control amount from the sensor voltage value after correction in step S102 or the sensor voltage value after additional correction in step S106, and the process proceeds to step S104.

  In step S104, the CPU 5 outputs the control amount calculated in step S104 to the I / O 4, and the process ends. For example, the CPU 5 outputs a control amount corresponding to PWM (Pulse Width Modulation) control to the I / O 4. The drive circuit 10 drives the motor 11 according to the control amount input from the I / O 4.

  Next, a procedure for specifying the cause of the malfunction when the malfunction of the periodic control process 72 of the control program 70 shown in FIG. 6 occurs will be described. Here, as an example of the malfunction of the cycle control process 72 shown in FIG. 6, in step S105, the CPU 5 determines that it is necessary to cope with the specification of the cycle control process 72, and step S106 should be executed. Consider the case where the reverse determination is made and step S106 is not executed. In this case, since the control amount is calculated in step S103 without additional correction of the sensor voltage value in step S106, as a result, when the integrated test is performed on the control program 70, the result that the required performance is not satisfied. Become.

  For the sake of explanation, the cause of the failure is shown in advance as described above. However, at the start of the investigation of the cause of the actual failure, the cause of the failure is unknown unless it satisfies the required performance. is there.

  In the first embodiment, in order to identify the cause of the malfunction, the following three items (1) to (1) are applied to the sensor voltage value input from the I / O 4 in the cycle control process 72 shown in FIG. Check 3).

Item (1): The control amount output to the I / O 4 in step S104 is within the design range. Item (2): The control amount calculated in step S103 is within the design range. Item (3) ): The sensor voltage value corrected in step S102 is within the design range.

  In order to efficiently check the above items (1) to (3), the program storage area 631 of the extension program storage unit 63 of the RAM 6 contains an extension program shown in FIG. Remembered. The start address of the extension program is stored by using the external communication function 9 and XCP.

  Each of the identification number storage array 621, the first argument storage array 622, and the second argument storage array 623 of the command storage unit 62 includes an identification number, a first argument, and a second argument shown in FIG. Are stored in association with each other.

  N shown in FIGS. 8 and 9 is set to 0 when the control program expansion unit 60 is stored in the RAM 6. When the control program expansion unit 60 is stored in the RAM 6, the command execution result storage area 624 stores an initial value such as 0 or 255 indicating that the execution result of the command shown in FIG. Is done.

  Note that FIG. 9 shows a command that is executed when a BP interrupt occurs, but even if an MPU interrupt is generated instead of a BP interrupt, a command similar to FIG. Executed. Hereinafter, a case where a BP interrupt occurs will be described for the sake of simplicity.

  In order to generate a BP interrupt after the CPU 5 executes Step S101 shown in FIG. 6, the CPU 5 sets the BP 51 as an execution address to be accessed when executing Step S101, that is, the execution address of Step S101. When the BP 51 is arranged at an address accessible by the CPU 5, this setting is performed using the external communication function 9 and XCP. If the BP51 is not located at an address accessible by the CPU5 and this setting needs to be performed using a dedicated instruction of the CPU5, this setting is performed by adding a user-defined command to the XCP. can do.

  As described above, the BP 51 as the access detection function is an execution address that is accessed when the CPU 5 executes a plurality of predetermined specific processes in steps S101 to S106 which are a series of processes constituting the cycle control process 72. Then, it detects that the CPU 5 has accessed and generates an interrupt.

  In the first embodiment, as described above, the case where the access detection function is configured by the BP 51 is illustrated. In this case, the CPU 5 sets the BP 51 as the execution address for the specific process. By setting the BP 51 as the access detection function in this way, the BP 51 detects that the CPU has accessed this execution address and generates an interrupt.

  When the access detection function is configured by the first MPU 52 and the second MPU 53, the CPU 5 sets the first MPU 52 and the second MPU 53 in an address range based on the execution address of the specific process. A specific address range setting method is the same as the method for generating the MPU interrupt described above. By setting the first MPU 52 and the second MPU 53 as the access detection function in this way, the first MPU 52 and the second MPU 53 indicate that the CPU has accessed the execution address when the execution address accessed by the CPU 5 is outside the address range. Detect and generate an interrupt.

  In addition, each execution address of step S101-step S104 in which BP51 is set can be acquired by, for example, reading the control program 70 with a debugger on the PC and displaying the correspondence between the process and the address.

  Next, the operation of the CPU 5 when a BP interrupt is generated each time steps S101 to S104 of the cycle control process 72 shown in FIG. 6 are executed will be described.

  As described above, after the control program extension unit 60 is stored in the RAM 6 and the function of the BP 51 is validated, the CPU 5 executes step S101, so that the first BP interrupt is generated.

  When the first BP interrupt occurs, the CPU 5 executes the interrupt process shown in FIG. Here, an interrupt process executed when a BP interrupt occurs will be described with reference to FIG. FIG. 7 is a flowchart showing the BP interrupt process 74 of the control program 70 executed by the CPU 5 in the first embodiment of the present invention. As will be described later, the interrupt process is executed each time a plurality of predetermined specific processes are individually executed in steps S101 to S106 which are a series of processes constituting the cycle control process 72.

  In response to the generated interrupt, the interrupt process shown in FIG. 7 interrupts the process after the execution of the specific process in the cycle control process 72, executes the first extension program or the second extension program, and after the execution, In the cycle control process 72, the CPU 5 is operated so as to resume the process after the execution of the specific process.

  The interrupt process shown in FIG. 7 is a process applicable to the BP interrupt process 74 and the MPU interrupt process 75 of the control program 70. That is, the interrupt process shown in FIG. 7 can be applied to both the BP interrupt process 74 and the MPU interrupt process 75. The interrupt process shown in FIG. 7 may be applied to either the BP interrupt process 74 or the MPU interrupt process 75, or may be applied to both.

  As shown in FIG. 7, when the first BP interrupt occurs and the execution of the interrupt process is started, in step S201, the CPU 5 reads the subroutine start address stored in the subroutine start address storage variable 611, and the process is executed. Proceed to step S202.

  In step S202, the CPU 5 determines whether or not the start address of the subroutine read in step S201 is valid. If it is determined that the start address is valid, the process proceeds to step S203. If it is determined that the start address is not valid, that is, invalid, the process ends.

  For example, the following means can be considered as means for the CPU 5 to determine whether the subroutine start address stored in the subroutine start address storage variable 611 is valid or invalid. That is, the CPU 5 determines that it is invalid if the start address is zero, and determines that it is valid if the start address is other than zero.

  In step S203, the CPU 5 executes a subroutine corresponding to the start address read in step S201, and the process ends.

  Note that the subroutine start address storage variable 611 is initialized by the initialization processing 71 at the start of execution of the control program 70, and stores an invalid address.

  Returning to FIG. 6, the CPU 5 executes the interrupt process shown in FIG. 7 when the first BP interrupt occurs after executing Step S <b> 101. When the first BP interrupt occurs, a valid start address is set in the subroutine start address storage variable 611 as described above.

  Therefore, after executing step S201 in the interrupt process, the CPU 5 determines in step S202 that the start address read in step S201 is valid, and the process proceeds to step S203.

  In step S203, the CPU 5 calls a subroutine corresponding to the start address read in step S201, and starts executing the subroutine.

  Here, a subroutine called in the interrupt process will be described with reference to FIG. FIG. 8 is a flowchart showing a subroutine called in the interrupt process of the control program 70 executed by the CPU 5 in the first embodiment of the present invention.

  The extension program shown in FIG. 8, that is, the first extension program, stores the processing result of the specific process in the RAM 6, and the CPU 5 accesses the execution address of the next specific process executed after the specific process in the cycle control process 72. The CPU 5 is caused to operate so as to set the access detection function so that the access detection function detects this.

  When the subroutine is called in the interrupt process, the extension program stored in the program storage area 631 of the extension program storage unit 63, that is, the subroutine shown in FIG. 8 is executed. In step S301, the CPU 5 reads the element N stored in the identification number storage array 621 of the command storage unit 62, and the process proceeds to step S302.

  In step S302, the CPU 5 adds 1 to the element N read in step S301, stores the element N after the addition in the identification number storage array 621, and the process proceeds to step S303.

  In step S303, the CPU 5 determines whether or not the command corresponding to the element N read in step S301 is an end command. If it is determined that the command is an end command, the process ends. If it is determined that the command is not an end command, the process proceeds to step S304.

  In step S304, the command corresponding to the element N read in step S301 is executed, the process returns to step S301, and the processes after step S301 are executed again.

  Here, the commands executed in the subroutine shown in FIG. 8 will be described with reference to FIG. FIG. 9 is a table showing an example of the definition of a subroutine command called in the interrupt process of the control program 70 executed by the CPU 5 according to the first embodiment of the present invention.

  As shown in FIG. 9, the element N, the identification number, the first argument, and the second argument are associated with each other, and the identification number storage array 621, the first argument storage array 622, and the second argument storage array 623 are associated with each other. And are stored respectively. FIG. 9 also shows the meaning of the command corresponding to the element N.

  Returning to FIG. 7, when the subroutine is called in the interrupt process, N = 0 at first. Therefore, in the subroutine shown in FIG. 8, N = 1 in step S <b> 302, and N = 0 in step S <b> 304. The command is executed. In this case, as can be seen from FIG. 9, the CPU 5 reads the sensor voltage value acquired in step S101 and stores it in the command execution result storage area 624 as first data.

  Since the command corresponding to N = 0 is not an end command for instructing the end of the process, the processes in and after step S301 are continuously executed in the subroutine. In the subroutine, N = 2 in step S302, and a command corresponding to N = 1 is executed in step S304. In this case, in order for the CPU 5 to generate a BP interrupt after executing step S102 shown in FIG. 6, the CPU 5 sets the BP 51 as the execution address to be accessed when executing step S102, that is, the execution address of step S102.

  Since the command corresponding to N = 1 is not an end command, the processing subsequent to step S301 is subsequently executed in the subroutine. In the subroutine, in step S302, N = 3, and in step S303, it is determined that the command corresponding to N = 2 is an end command, and the process ends.

  In this case, the subroutine is finished, the process is returned to the interrupt process shown in FIG. 7, the interrupt process is further finished, and the process returns to the completion point of execution of step S101 of the cycle control process 72 shown in FIG. At the end of the subroutine, the value of the element N stored in the identification number storage array 621 is N = 3 as described above.

  As described above, the CPU 5 interrupts the processing after the execution of step S101 in the cycle control processing 72 in response to the interrupt generated by the BP 51 as the access detection function. Further, the CPU 5 stores the processing result of step S101 in the command execution result storage area 624 according to the extended program by executing the interrupt processing.

  Subsequently, the CPU 5 sets the BP 51 so that the BP 51 detects that the CPU 5 has accessed the execution address of step S102, which is the next specific process executed next to step S101 in the cycle control process 72. Further, the CPU 5 ends the interrupt process, and restarts the processes after the execution of step S101 in the cycle control process 72.

  Returning to FIG. 6, after executing step S <b> 102, when the second BP interrupt occurs, the CPU 5 executes the interrupt process shown in FIG. 7 again. In this case, a subroutine is called in step S203, and the subroutine is executed again.

  When a subroutine is called by interrupt processing, N = 3 at the end of the previous subroutine, so in this subroutine, N = 4 in step S302 and N = 3 in step S304. The command is executed. In this case, the CPU 5 reads the sensor voltage value corrected in step S102 and stores it in the command execution result storage area 624 as second data.

  Since the command corresponding to N = 3 is not an end command, processing in step S301 and subsequent steps is continued in the subroutine. In the subroutine, N = 5 in step S302, and a command corresponding to N = 4 is executed in step S304. In this case, in order for the CPU 5 to generate a BP interrupt after executing step S103 shown in FIG. 6, the CPU 5 sets the BP 51 as the execution address to be accessed when executing step S103, that is, the execution address of step S103.

  Since the command corresponding to N = 4 is not an end command, processing in step S301 and subsequent steps is continued in the subroutine. In the subroutine, in step S302, N = 6, and in step S303, it is determined that the command corresponding to N = 5 is an end command, and the process ends.

  In this case, the subroutine is finished, the process is returned to the interrupt process shown in FIG. 7, the interrupt process is finished, and the process returns to the completion point of execution of step S102 of the cycle control process 72 shown in FIG. At the end of the subroutine, the value of the element N stored in the identification number storage array 621 is N = 6 as described above.

  As described above, the CPU 5 interrupts the processing after the execution of step S102 in the cycle control processing 72 in response to the interrupt generated by the BP 51 as the access detection function. Further, the CPU 5 stores the processing result of step S102 in the command execution result storage area 624 according to the extension program by executing the interrupt processing.

  Subsequently, the CPU 5 sets the BP 51 so that the BP 51 detects that the CPU 5 has accessed the execution address of step S103, which is the next specific process executed next to step S102 in the cycle control process 72. Further, the CPU 5 ends the interrupt process, and restarts the processes after the execution of step S102 in the cycle control process 72.

  Returning to FIG. 6, after executing step S <b> 103, when the third BP interrupt occurs, the CPU 5 executes the interrupt process shown in FIG. 7 again. In this case, a subroutine is called in step S203, and the subroutine is executed again.

  When a subroutine is called in the interrupt process, N = 6 at the end of the previous subroutine, so in this subroutine, N = 7 in step S302 and N = 6 in step S304. The command is executed. In this case, the CPU 5 reads the control amount calculated in step S103 and stores it in the command execution result storage area 624 as third data.

  Since the command corresponding to N = 6 is not an end command, the processing subsequent to step S301 is subsequently executed in the subroutine. In the subroutine, N = 8 in step S302, and a command corresponding to N = 7 is executed in step S304. In this case, in order for the CPU 5 to generate a BP interrupt after executing step S104 shown in FIG. 6, the CPU 5 sets BP51 as an execution address to be accessed when executing step S104, that is, the execution address of step S104.

  Since the command corresponding to N = 7 is not an end command, the processing subsequent to step S301 is subsequently executed in the subroutine. In the subroutine, in step S302, N = 9, and in step S303, it is determined that the command corresponding to N = 8 is an end command, and the process ends.

  In this case, the subroutine is ended, the process is returned to the interrupt process shown in FIG. 7, the interrupt process is further ended, and the process returns to the completion point of execution of step S103 of the cycle control process 72 shown in FIG. At the end of the subroutine, the value of the element N stored in the identification number storage array 621 is N = 9 as described above.

  As described above, the CPU 5 interrupts the processing after the execution of step S103 in the cycle control processing 72 in response to the interrupt generated by the BP 51 as the access detection function. Further, the CPU 5 stores the processing result of step S103 in the command execution result storage area 624 according to the extended program by executing the interrupt processing.

  Subsequently, the CPU 5 sets the BP 51 so that the BP 51 detects that the CPU 5 has accessed the execution address of step S104, which is the next specific process executed next to step S103 in the cycle control process 72. Further, the CPU 5 ends the interrupt process, and resumes the processes after the execution of step S103 in the cycle control process 72.

  Returning to FIG. 6, when the fourth BP interrupt occurs after executing step S104, the CPU 5 again executes the interrupt process shown in FIG. In this case, a subroutine is called in step S203, and the subroutine is executed again.

  When a subroutine is called in the interrupt process, N = 9 at the end of the previous subroutine, so in this subroutine, N = 10 in step S302 and N = 9 in step S304. The command is executed. In this case, the CPU 5 reads the control amount output in step S104 and stores it in the command execution result storage area 624 as fourth data.

  Since the command corresponding to N = 9 is not an end command, processing in step S301 and subsequent steps is continuously executed in the subroutine. In the subroutine, N = 11 in step S302, and a command corresponding to N = 10 is executed in step S304. In this case, the CPU 5 substantially disables the BP interrupt by setting the BP 51 to 0.

  Since the command corresponding to N = 10 is not an end command, the processing subsequent to step S301 is subsequently executed in the subroutine. In the subroutine, in step S302, N = 12, and in step S303, it is determined that the command corresponding to N = 11 is an end command, and the process ends.

  In this case, the subroutine ends, the process returns to the interrupt process shown in FIG. 7, the interrupt process ends, the process returns to the completion point of execution of step S104 of the cycle control process 72 shown in FIG. End.

  As described above, the CPU 5 interrupts the processing after the execution of step S104 in the cycle control processing 72 in response to the interrupt generated by the BP 51 as the access detection function. Further, the CPU 5 stores the processing result of step S104 in the command execution result storage area 624 according to the extension program by executing the interrupt processing.

  Since the CPU 5 executes all the steps S101 to S104 which are specific processes in the series of processes constituting the cycle control process 72, and further executes step S104 which is the last process of the cycle control process 72, the cycle The control process 72 ends.

  As described above, after the fourth BP interrupt occurs, no new BP interrupt occurs, so the interrupt process is not executed, and the cycle control process 72 shown in FIG. 6 ends. Therefore, the command execution result storage area 624 stores the first data, the second data, the third data, and the fourth data as the data after the series of commands corresponding to the above-described N = 0 to 11. By reading the data stored in the command execution result storage area 624 using the external communication function 9 and XCP, the results of executing each of steps S101, S102, S103, and S104 are converted into the periodic control processing of the control program 70. 72 can be obtained without changing.

  On the other hand, when only the XCP is used without applying the configuration of the ECU 1 in the first embodiment, since the XCP can acquire only the data stored in the static variable whose address is known, the automatic variable And data temporarily held in the CPU register cannot be acquired. However, according to the configuration of the ECU 1 in the first embodiment, by defining a command to be executed by the CPU 5 and a command to obtain a stack frame, an automatic that is temporarily used in the cycle control process 72 of the control program 70. It is possible to obtain variables and data held temporarily in the CPU register.

  By acquiring data after executing a series of commands corresponding to the above-described N = 0 to 11 from the command execution result storage area 624, the above-described items (1) to (3) can be confirmed. As a result, it can be seen that the control amount output to the I / O 4 in step S104, the control amount calculated in step S103, and the sensor voltage value corrected in step S102 are not within the design range. That is, it can be estimated that the sensor voltage value acquired in step S101 is not corrected as designed.

  In the first embodiment, in order to confirm the estimation that the sensor voltage value is not corrected as designed, the following three items (4) to (6) are further added in the cycle control process 72 shown in FIG. Check.

Item (4): The information on necessity of correspondence is correctly read. Item (5): Additional correction is performed in step S106. Item (6): The sensor voltage value additionally corrected in step S106 is obtained. Within the design range

  In order to check the above items (4) to (6) efficiently, the extension program shown in FIG. 8 is stored in the program storage area 631 of the extension program storage unit 63 of the RAM 6. The start address of the extension program is stored by using the external communication function 9 and XCP.

  Each of the identification number storage array 621, the first argument storage array 622, and the second argument storage array 623 of the command storage unit 62 includes an identification number, a first argument, and a second argument shown in FIG. Are stored in association with each other. Further, in order for the CPU 5 to generate a BP interrupt after executing step S102 shown in FIG. 6, the CPU 5 sets BP51 as the execution address of step S102.

  As described above, after the control program expansion unit 60 is stored in the RAM 6 and the function of the BP 51 is validated, if the CPU 5 executes step S102, the first BP interrupt is generated.

  When the first BP interrupt occurs, the CPU 5 executes the interrupt process shown in FIG. 7 as in the case of confirming the items (1) to (3) described above. In the interrupt processing, the CPU 5 calls a subroutine corresponding to the start address stored in the subroutine start address storage variable 611 and starts executing the subroutine.

  The subroutine shown in FIG. 8 is executed by calling the subroutine in step S203. In this subroutine, the command shown in FIG. 10 is executed. FIG. 10 is a table showing an example of the definition of a subroutine command called in the interrupt process of the control program 70 executed by the CPU 5 according to the first embodiment of the present invention.

  As shown in FIG. 10, the element N, the identification number, the first argument, and the second argument are associated with each other, and the identification number storage array 621, the first argument storage array 622, and the second argument storage array 623 are associated with each other. And are stored respectively. FIG. 10 also shows the meaning of the command corresponding to the element N.

  In the subroutine, after the command corresponding to N = 0 to 2 shown in FIG. 10 is executed, the process is returned to the caller interrupt process. At this time, the CPU 5 stores the above-described read necessity information as first data in the command execution result storage area 624 immediately before the execution of step S102, that is, immediately before the start of execution of step S105. Remember.

  As described above, upon completion of the subroutine shown in FIG. 8, the process is returned to the interrupt process shown in FIG. 7, and the interrupt process is finished, and the CPU 5 returns to the completion point of execution of step S102. Thereafter, the CPU 5 executes Step S105.

  In the first embodiment, as described above, as an example of the problem, in step S105, the CPU 5 determines that it is necessary to cope with the specification of the cycle control process 72, and the step S106 is to be executed. Consider the case where the reverse determination is made and step S106 is not executed. Therefore, in step S105, the CPU 5 determines that the correspondence necessity information is “0” indicating that no correspondence is necessary, and executes step S103 without executing step S106.

  Therefore, the CPU 5 sets the BP 51 as the execution address of step S106 by executing the command corresponding to N = 1 shown in FIG. 10, but the second BP interrupt does not occur because step S106 is not executed. As a result, the sensor voltage value after the additional correction stored as the second data in the command execution result storage area 624 remains the initial value, and further, the value of the element N remains at 3.

  By acquiring data after executing a series of commands corresponding to N = 0 to 5 described above from the command execution result storage area 624, the above items (4) to (6) can be confirmed. As a result, it can be seen that the correspondence necessity information is read correctly, the additional correction is not executed, and the sensor voltage value after the additional correction is the initial value because step S106 is not executed.

  From the confirmation results of the items (1) to (6) described above, it can be understood that the cause of the problem may be due to the fact that additional correction of the sensor voltage value has not been performed.

  On the other hand, when only the XCP is used without applying the configuration of the ECU 1 in the first embodiment, the items (4) and (5) cannot be confirmed directly. Therefore, even if it can be confirmed that the corrected sensor voltage value before the execution of step S103 is outside the design range, direct evidence that the reason is due to the non-execution of step S106 cannot be obtained.

  However, according to the configuration of ECU 1 in the first embodiment, items (4) and (5) can be confirmed. Therefore, the reason why the corrected sensor voltage value before the execution of step S103 is outside the design range is that the correspondence necessity information is correctly read, but the determination in step S105 is incorrect, and step S106 is not executed. It can be presumed that this is because.

  Note that in general BP functions, it is often possible not only to detect the execution of a specific address, but also to detect data reading or data writing at a specific address. Therefore, a detection function of data reading at a specific address in the BP 51 may be used to generate a BP interrupt when the CPU 5 reads out the above-described correspondence necessity information. In this case, in response to the occurrence of the BP interrupt, the CPU 5 can store the correspondence necessity information in the command execution result storage area 624 in the interrupt processing.

  If the estimation accuracy of the cause of the above-described defect is high, it is easy to confirm the content of the determination in step S105 and find that the determination logic is reversed. In other words, if the above items (1) to (6) are confirmed by the configuration of the ECU 1 according to the first embodiment, the accuracy is higher than when only the XCP memory access function is used without using a debugger. The cause of the failure can be identified.

  As described above, the CPU 5 interrupts the processing after executing the specific processing in the cycle control processing 72 by executing the interrupt processing in response to the interrupt generated by the BP 51, and executes the extension program shown in FIG. . The CPU 5 causes the command execution result storage area 624 of the RAM 6 to store the processing result of the specific process, that is, the process for which data is desired to be acquired, by executing the extension program shown in FIG.

  Further, the CPU 5 causes the BP 51 to detect that the CPU 5 has accessed the execution address of the next specific process executed next to the specific process in the cycle control process 72 by executing the extension program shown in FIG. , BP51 is set. Thereafter, the CPU 5 restarts the processing after the execution of the specific processing in the cycle control processing 72 after the execution of the extension program.

  In this Embodiment 1, after estimating the cause of the malfunction of the periodic control process 72 of the control program 70, the malfunction is corrected, and the result of the periodic control process 72 after the correction is confirmed.

  In order to efficiently perform the above-described correction check, an extension program shown in FIG. 11, which will be described later, that is, a second extension program, is stored in the program storage area 631 of the extension program storage unit 63 of the RAM 6. The start address of the extension program is stored by using the external communication function 9 and XCP.

  In order to generate a BP interrupt after the CPU 5 executes step S102 shown in FIG. 6, the CPU 5 sets BP51 as the execution address of step S102.

  As described above, after the control program expansion unit 60 is stored in the RAM 6 and the function of the BP 51 is activated, if the CPU 5 executes step S102, a BP interrupt is generated immediately before the CPU 5 executes step S105.

  When the BP interrupt occurs, the CPU 5 executes the interrupt process shown in FIG. In the interrupt process, the CPU 5 calls a subroutine shown in FIG. 11 corresponding to the start address stored in the subroutine start address storage variable 611 and starts executing the subroutine.

  Here, a subroutine called in the interrupt process will be described with reference to FIG. FIG. 11 is a flowchart showing a subroutine called in the interrupt process of the control program 70 executed by the CPU 5 in the first embodiment of the present invention.

  The extension program shown in FIG. 11, that is, the second extension program, causes the CPU 5 to operate so as to execute the post-correction process after correcting the process that is the cause of the malfunction occurring in the cycle control process 72. The post-correction processing corresponds to steps S105N and S106 shown in FIG.

  When the subroutine is called in the interrupt process, the CPU 5 executes the extension program shown in FIG. In this case, in step S105N, the CPU 5 determines whether or not the correspondence necessity information is “1” indicating that no correspondence is necessary.

  Here, in the determination process in step S105N, if the correspondence necessity information is “1”, it is determined that no correspondence is necessary, and the correspondence necessity information is not “1”, that is, “0”. In such a case, it is determined that a response is necessary. That is, step S105N corrects step S105 shown in FIG. 6 which is the cause of the problem that occurs in the cycle control process 72. Specifically, the determination logic in step S105N is modified to be the reverse of the determination logic in step S105.

  In step S105N, when the CPU 5 determines that the correspondence necessity information is “1”, the process ends. On the other hand, if the CPU 5 determines that the correspondence necessity information is not “1”, the process proceeds to step S106.

  After executing step S106 shown in FIG. 11, the subroutine ends. By the end of the subroutine shown in FIG. 11, the process is returned to the interrupt process shown in FIG. 7, and the interrupt process is further ended, and the process returns to the completion point of the execution of step S102 shown in FIG. Thereafter, the CPU 5 executes the determination in step S105, but this determination is not correctly performed due to the above-described problem. Therefore, the CPU 5 executes Step S103 without executing Step S106. Thereafter, the CPU 5 executes step S104, and the cycle control process 72 ends.

  As described above, the CPU 5 executes the extension program shown in FIG. 11 to execute the post-correction process after correcting the process that causes the malfunction in the cycle control process 72. After that, the CPU 5 resumes the process after the execution of the specific process in the cycle control process 72 after the execution of the extension program. That is, according to the subroutine shown in FIG. 11, the CPU 5 performs additional correction of the sensor voltage value by executing Step S105N and Step S106. Thereafter, the CPU 5 sequentially executes steps S105 and S103 by the cycle control process 72 shown in FIG. 6, and finally executes step S104. Therefore, if the integration program is executed for the control program 70 after the expansion program shown in FIG. 11 is stored in the RAM 6, the problem that does not satisfy the required performance is solved without changing the periodic control processing 72 of the control program 70. I can confirm that. That is, it is not necessary to use a hook function necessary for on-target bypassing when confirming the result of defect correction of the control program 70.

  As mentioned above, according to the vehicle-mounted control apparatus of this Embodiment 1, it is performed whenever a plurality of predetermined specific processes are individually executed in the cycle control process and a series of processes constituting the cycle control process. It comprises a ROM that stores a control program including interrupt processing, a RAM that stores a first extension program and a second extension program as extension programs, and a CPU that executes the control program and the extension program.

  In the above configuration, the CPU is configured as follows. That is, the CPU is configured to include an access detection function that detects an access to an execution address that is accessed when executing a specific process and generates an interrupt.

  The CPU executes the interrupt process in response to the interrupt generated by the access detection function, thereby interrupting the process after the execution of the specific process in the cycle control process and executing the first extension program or the second extension program. After the execution, the process after the execution of the specific process is resumed in the periodic control process. The CPU stores the processing result of the specific process in the RAM by executing the first extension program, and the CPU has accessed the execution address of the next specific process executed after the specific process in the cycle control process Is configured to set the access detection function so that the access detection function detects. The CPU is configured to execute a post-correction process after correcting a process that causes a problem in the periodic control process by executing the second extension program.

  By configuring the above-mentioned in-vehicle control device, it is possible to identify the cause of the malfunction of the control program without using a debugger, and confirm the elimination of the malfunction of the control program without preparing a hook function. Can do.

  DESCRIPTION OF SYMBOLS 1 In-vehicle control apparatus (ECU), 2 input circuits, 3 Microcomputer, 4 I / O, 5 CPU, 6 RAM, 7 ROM, 8 Timer, 9 External communication function, 10 Drive circuit, 11 Motor, 12 External communication line, 51 Break point function, 52 first memory protection function, 53 second memory protection function, 60 control program extension section, 61 extension program start address storage section, 611 subroutine start address storage variable, 62 command storage section, 621 identification number storage array, 622 First argument storage array, 623 Second argument storage array, 624 Command execution result storage area, 63 Extended program storage section, 631 Program storage area, 70 Control program, 71 Initialization process, 72 Period control process, 73 XCP process, 74 BP interrupt processing, 75 MPU interrupt processing .

Claims (3)

A cycle control process for periodically controlling the control target, and an interrupt process executed each time a plurality of predetermined specific processes are individually executed in a series of processes constituting the cycle control process. A ROM for storing a control program including:
A RAM for storing a first extension program and a second extension program as an extension program;
A CPU for executing the control program and the extension program;
With
The CPU
An access detection function for detecting an access to an execution address to be accessed when executing the specific process, and generating an interrupt;
By executing the interrupt process in response to the interrupt generated by the access detection function, the process after the execution of the specific process is interrupted in the cycle control process, and the first extension program or the second extension Execute the program, and after the execution, resume the process after the execution of the specific process in the periodic control process,
By executing the first extension program, the processing result of the specific process is stored in the RAM, and the CPU is assigned to the execution address of the next specific process executed next to the specific process in the cycle control process. Set the access detection function so that the access detection function detects access,
An in- vehicle control device that corrects a result of a process that causes a failure in the periodic control process by executing the second extension program. The access detection function is configured by a breakpoint function,
The CPU sets the breakpoint function to the execution address,
The in-vehicle control device according to claim 1, wherein the breakpoint function detects that the CPU has accessed the execution address and generates the interrupt. The access detection function
A first memory protection function in which a lower limit value and an upper limit value of an applied address range are set, and a lower limit value and an upper limit value of an applied address range are set, and the applied address range is different from the first memory protection function. A second memory protection function,
Wherein the CPU, the address range to apply the first protected memory and the second memory protection function, and set based on the execution address,
The first memory protection function and the second memory protection function detect that the CPU has accessed the execution address when the execution address accessed by the CPU is out of the address range, and the interrupt The in-vehicle control device according to claim 1.

Images