WO2013073009A1

WO2013073009A1 - Microcomputer system and monitoring microcomputer

Info

Publication number: WO2013073009A1
Application number: PCT/JP2011/076310
Authority: WO
Inventors: 本谷　謙治
Original assignee: トヨタ自動車株式会社
Priority date: 2011-11-15
Filing date: 2011-11-15
Publication date: 2013-05-23

Abstract

The present invention is a vehicle-equipped microcomputer system (200) which has a monitored microcomputer (50) which has a debug port, and a monitoring microcomputer (100) connected via the debug port. The monitoring microcomputer has a breakpoint registration table (59) in which a plurality of breakpoints has been registered beforehand, and first transmission means (53) for transmitting the breakpoints in the breakpoint registration table to the monitored microcomputer. The monitored microcomputer has: a register (25) which stores the breakpoints received from the monitoring microcomputer; and second transmission means (23) for, if a program counter (34) of the monitored microcomputer and a breakpoint stored in the register match, transmitting the value of the program counter to the monitoring microcomputer.

Description

Microcomputer system, monitoring microcomputer

The present invention relates to a microcomputer system having a monitored microcomputer having a debug port and a monitoring microcomputer connected via the debug port.

In order to improve fuel efficiency, reduce driver burden, improve safety, etc., many electronic control devices using microcomputers are installed in vehicles. Since these controls are impaired when a microcomputer breaks down, a technique for monitoring the operation state of the microcomputer and guaranteeing the operation of the microcomputer has been taken. For example, a technique in which the watchdog timer confirms that the CPU is operating normally by periodically resetting the timer (see, for example, Patent Document 1), a lockstep method in which two or more CPUs are mounted, and the calculation results are compared. It has been known.

However, with the watchdog timer, it can be confirmed that the periodic task is being executed, but the code coverage of the software is low. In addition, the lockstep method requires two or more CPUs having the same performance, which increases costs.

Also, a technique for monitoring the CPU at a lower cost than the lockstep has been proposed (see, for example, Patent Document 2). Patent Document 2 discloses a monitoring method in which a monitoring unit gives an example to a monitored CPU and monitors the arithmetic function of the CPU based on an answer to the example.

Also, a technique is known in which a monitored microcomputer and a monitoring microcomputer are arranged so that the monitored microcomputer monitors the monitored microcomputer (see Patent Document 3). Patent Document 3 discloses an abnormality monitoring method in which the CPU of the monitoring microcomputer monitors whether there is no contradiction in the control of the main microcomputer and determines whether there is an abnormality.

However, the monitoring method disclosed in Patent Document 2 or 3 is insufficient as a monitoring method for a microcomputer that executes a program. For example, in the monitoring method of Patent Document 2, it is only possible to compare calculation results, and it can only be understood that the code used for the calculation can be executed normally.

Also, the abnormality monitoring function of Patent Document 3 does not describe how to determine whether or not there is a contradiction in the control. If the version difference between the monitored microcomputer and the monitored microcomputer is the meaning of control contradiction, it is not sufficient as a monitoring method for the monitoring microcomputer.

Therefore, it is required to lower the cost than the lock step and improve the code coverage more than the watchdog timer. Here, in the development stage of the CPU or program, there is a case where an operation of tracing instructions executed by the CPU (listing a history of executed instructions) is performed. As a result, it becomes clear whether or not the process has branched due to the establishment of the condition, the address of the instruction executed after the branch, and the like, so that the developer can grasp whether or not the CPU and the program are performing the assumed process.

However, until now, the only monitoring method that can verify the execution result in units of instructions when the microcomputer is mounted on a vehicle or the like is the lockstep method, and a method for improving code coverage at low cost has not been established.
Japanese Patent Laid-Open No. 2004-280783 JP 2010-128627 A JP 2007-092621 A

In view of the above problems, an object of the present invention is to provide a microcomputer system that monitors a microcomputer by improving code coverage at a low cost.

The present invention is an in-vehicle microcomputer system having a monitored microcomputer having a debug port and a monitoring microcomputer connected via the debug port, and the monitoring microcomputer has a plurality of breakpoints registered in advance. A breakpoint registration table; and a first transmission means for transmitting the breakpoint of the breakpoint registration table to a monitored microcomputer, wherein the monitored microcomputer stores a breakpoint received from the monitoring microcomputer And a second transmission means for transmitting the value of the program counter to the monitoring microcomputer when the breakpoint stored in the register coincides with the program counter of the monitored microcomputer.

According to the present invention, it is possible to provide a microcomputer system for monitoring a microcomputer with improved code coverage at a low cost.

It is an example of the figure explaining the schematic characteristic of a microcomputer system. It is an example of the schematic block diagram of a microcomputer system. It is an example of the schematic block diagram of a microcomputer system. It is an example of the figure which illustrates control data and monitoring data typically. It is an example of a functional block diagram of a monitoring microcomputer. It is an example of the sequence diagram explaining the operation | movement procedure of a microcomputer system.

20 Debug Port 22 Control Unit 23 Port 24 Timer 25 Break Point Register 26 Interruption Signal Line 34 Program Counter 50 Monitored Microcomputer 100 Monitor Microcomputer 200 Microcomputer System

Hereinafter, embodiments for carrying out the present invention will be described with reference to the drawings.
FIG. 1 is an example of a diagram illustrating schematic features of the microcomputer system of the present embodiment. The microcomputer system 200 includes a monitored microcomputer 50 and a monitoring microcomputer 100, and the monitoring microcomputer 100 is connected to the debug port 20 of the monitored microcomputer 50. Since the monitoring microcomputer 100 communicates with the debug port 20 of the monitored microcomputer 50, it is possible to avoid occupying the general-purpose port of the monitored microcomputer 50 for monitoring. Moreover, the debug port 20 that has been conventionally discarded can be used. Note that the monitoring microcomputer 100 is one of the features that the price is lower than that of the monitored microcomputer 50.

The monitoring microcomputer 100 monitors the monitored microcomputer 50 mainly by two methods.
(1) Monitoring by breakpoints
(1-1) The monitoring microcomputer 100 sets several breakpoints in the debug port 20 (FIG. 1A). This break point is an address of an instruction executed by the monitored microcomputer 50. As the break point, for example, a command immediately before the control of the actuator is set in advance. In addition, a break point is set at the entrance / exit of the function of the main flow for the flow determination for determining whether or not it is in a steady state.
(1-2) The debug port 20 monitors the address of the instruction executed by the monitored microcomputer 50 with a PC (Program Counter) 34, and transmits the value of the PC 34 to the monitoring microcomputer 100 when the breakpoint is matched (FIG. 1 ( b)). The monitored microcomputer 50 stops its operation when it reaches the breakpoint.
(1-3) The monitoring microcomputer 100 requests the values of one or more variables used by the monitoring microcomputer for the calculation target based on the value of the PC 34. When the value of the variable is acquired, it is checked whether or not the value of the variable is an abnormal value (FIG. 1 (c)). That is, it is determined whether or not the values of one or more variables are within an assumed range at the stage of calculation target, calculation progress, and calculation result.
(1-4) Upon confirming that there is no abnormality, the monitoring microcomputer 100 permits the debug port 20 to resume operation (FIG. 1 (d)). The monitored microcomputer 50 restarts the operation from the interrupted instruction.
(2) Periodic monitoring The monitoring microcomputer 100 mainly monitors whether the transition of the PC 34 of the monitored microcomputer 50 is appropriate. There are two methods for regular monitoring, either of which may be adopted.
(i) The monitoring microcomputer 100 sets a cycle time in the debug port 20.

In this case, the debug port 20 reads the PC 34 of the monitored microcomputer 50 every cycle time and transmits it to the monitoring microcomputer 100.
(ii) The monitoring microcomputer 100 periodically requests the PC 34 from the debug port 20.

In this case, the debug port 20 reads the PC 34 of the monitored microcomputer 50 and transmits it to the monitoring microcomputer 100 in response to a request from the monitoring microcomputer 100.

In any aspect, since the monitoring microcomputer 100 can periodically acquire the PC 34, it is possible to monitor whether or not the change in the PC 34 is within the assumed range.

As described above, since the microcomputer system 200 of the present embodiment monitors the monitored microcomputer 50 using the debug port 20, the debug port 20 is not wasted. Since the performance of the monitoring microcomputer 100 may be lower than that of the monitored microcomputer 50, the cost can be greatly reduced as compared with the lockstep method. In addition, by setting an appropriate breakpoint, it is possible to monitor a microcomputer that is already mounted on the vehicle in the same way as debugging, and it is possible to monitor instruction execution history and detect abnormalities in important variables. .

[Configuration example]
FIG. 2 shows an example of a schematic configuration diagram of the microcomputer system 200. In FIG. 2, the same components as those in FIG. This figure explains the schematic functions of the monitored microcomputer 50 and the monitoring microcomputer 100.

The monitored microcomputer 50 mainly executes a function for monitoring whether or not a breakpoint has been reached (whether an event has occurred), a function for interpreting a command transmitted from the monitoring microcomputer 100, and a function executed when the breakpoint is reached. And a function of reading a variable from the RAM.

The monitoring microcomputer 100 mainly has a function of determining whether or not the value transition of the PC 34 of the monitored microcomputer 50 is appropriate, a function of determining whether or not the variable is an abnormal value, and the like.

Further, the value of the PC 34 and the value of the variable are mainly transmitted from the monitored microcomputer 50 to the monitoring microcomputer 100 as monitoring data. Control data including a command is mainly transmitted from the monitoring microcomputer 100 to the monitored microcomputer 50, and a breakpoint is set as an example.

FIG. 3 shows an example of a schematic block diagram of the microcomputer system 200. The monitoring microcomputer 100 includes a CPU 44, a ROM 45, a RAM 46, an INTC 41, and a DMAC 43 connected to the bus 47, and an I / O port 42 is connected to the DMAC 43. The I / O port 42 is connected to the debug port 20 of the monitored microcomputer 50 by serial communication. As a communication method, for example, UART and I2C are known, but communication may be performed by any standard. In the case of one-line communication, the control data or the monitoring data can be transmitted when the transmission request is first made to the partner of the port 23 and the I / O port 42. Alternatively, the port 23 and the I / O port 42 may give the transmission right to the other party every predetermined time.

The monitoring microcomputer 100 is a microcomputer having performance at least equal to or lower than that of the monitored microcomputer 50, and can be purchased at a lower price than the monitored microcomputer 50. This is because the monitoring microcomputer 100 only needs to have a function for monitoring the monitored microcomputer 50, and it is not necessary to control on-vehicle devices such as the engine, the electric steering, and the brake hydraulic pressure with high accuracy.

Some performance factors that determine the price are as follows. If the monitoring microcomputer 100 has a 32-bit CPU core 31, the CPU 44 of the monitored microcomputer 50 may be 16-bit, and if the monitoring microcomputer 100 has a multi-core, the monitored microcomputer 100 is monitored. The microcomputer 50 may be a single core. If the clock frequency of the monitoring microcomputer 100 is 1 GHz, the clock frequency of the monitored microcomputer 50 may be, for example, 0.5 GHz. If the memory capacity of the monitoring microcomputer 100 is 2 Gbytes, the monitored microcomputer The memory capacity of 50 may be 1 Gbyte, and if the process generation of the monitored microcomputer 50 is 40 nm, the process generation of the monitoring microcomputer 100 may be 100 nm. Since the price of a microcomputer also depends on the sales method and the number of lots, the performance difference is not absolute in determining the price.

The CPU 44 performs processing necessary for monitoring the monitored microcomputer 50 by executing a program stored in the ROM 45. As will be described later, the monitoring microcomputer 100 is activated before the monitored microcomputer 50 and makes various settings in the debug port 20. The RAM 46 is a working memory when the CPU 44 executes a program.

When the CPU 44 transmits control data to the debug port 20, it records the control data in the RAM 46 and requests the DAMC 43 to transmit the control data address on the RAM and the debug port 20. As a result, the DMAC 43 reads the control data from the RAM 46 and sets the control data in the I / O port 42. The I / O port 42 establishes communication with the port 23 and transmits control data.

When the I / O port 42 receives monitoring data from the debug port 20, the I / O port 42 requests the DMAC 43 to store the monitoring data in the RAM 46. The I / O port 42 notifies the INTC 41 of reception of monitoring data. As a result, the INTC 41 interrupts the CPU 44 in consideration of the priority of the interrupt and notifies the reception of the monitoring data. The CPU 44 detects the interruption, interrupts the processing so far, reads the monitoring data from the RAM 46, and performs necessary processing.

On the other hand, the debug port 20 of the monitored microcomputer 50 includes a port 23, a control unit 22, a buffer 21, a timer 24, and a breakpoint register 25. In addition to the debug port 20, the monitored microcomputer 50 includes a CPU core 31 and a RAM, but other microcomputer configurations (ROM, INTC, bridge circuit, DMA controller, AD converter, etc.) are omitted. is doing.

The CPU core 31 has a PC 34, an ALU 35, and a register 36. In general, the CPU core 31 outputs the address of an instruction stored in the PC 34 to an address bus and reads a program from the ROM 32. The CPU core 31 reads and writes data of variables and parameters from the RAM (or cache) 33 by designating an address. The bus 38 connecting the CPU core 31 and the ROM 32 or RAM 33 is monitored by the control unit 22 so that the control unit 22 can obtain at least the value of the PC 34. In addition, an address can be output to the bus 38 and data (variable) at a desired address can be read from the RAM 33.

The buffer 21 is a memory that temporarily stores control data transmitted from the monitoring microcomputer 100 and that temporarily stores monitoring data transmitted from the debug port 20 to the monitoring microcomputer 100. The timer 24 notifies the control unit 22 that the cycle time has elapsed. The cycle time is set by the control unit 22 according to an instruction from the monitoring microcomputer 100. Note that when the monitoring microcomputer 100 periodically requests control data from the debug port 20, the timer 24 is unnecessary.

The breakpoint register 25 is a set of a plurality of registers for setting several breakpoints. The breakpoint register 25 has, for example, about ten to several hundred registers. Each register stores an address (break point) of an instruction executed by the monitored microcomputer 50.

[Function of control unit for control data, monitoring data]
FIG. 4A is an example of a diagram for schematically explaining the control data. The control data is, for example, 32 bits long and has a command part and a parameter part. A command is set in the command part and an address and a timer value are set in the parameter part, but nothing may be set. The commands include, for example, a command for setting a breakpoint register, a command for setting a timer, a command for requesting a PC value, a command for requesting a RAM value, a command for requesting interruption, and a command for requesting restart.

The control unit 22 reads out the control data transmitted from the monitoring microcomputer 100 from the buffer 21, and extracts, for example, several bits from the head of the control data as a command unit. Various processes are performed according to the analysis result of the command part. When the command is a command for storing a breakpoint in the breakpoint register 25, the control unit 22 sets the parameter part in the breakpoint register 25. When the command is a command for setting the cycle time in the timer 24, the control unit 22 sets the parameter unit in the timer 24.

If the command is a command requesting the value of the PC 34, the control unit 22 acquires the value of the PC 34 and stores it in the buffer 21, and transmits it to the monitoring microcomputer 100 when the transmission right is obtained. Further, when the command is a command requesting the value of the RAM 33, the control unit 22 reads the data (value of the variable) from the address of the RAM 33 specified by the parameter unit, stores it in the buffer 21, and obtains the transmission right. It transmits to the monitoring microcomputer 100.

Further, when the timer 24 notifies the elapse of the cycle time, the control unit 22 acquires the value of the PC 34 and stores it in the buffer 21, and transmits it to the monitoring microcomputer 100 when the transmission right is obtained. Further, the control unit 22 compares the value of any one of the breakpoint registers 25 with the PC 34, obtains the value of the PC 34 when the two coincide with each other, stores the value in the buffer 21, and obtains the transmission right. To 100.

As a result, the monitoring microcomputer 100 knows the address of the instruction currently being executed by the monitored microcomputer 50, and thus can perform processing such as requesting the value of the RAM 33.
In addition, the control part 22 will interrupt the process of CPU core 31, if the value of PC34 corresponds with a breakpoint. Specifically, the execution of the CPU core 31 is interrupted by stopping the supply of the clock signal by switching the interruption signal line 26 from Low to High. Moreover, the interruption is canceled by switching from High to Low, and execution is resumed. In addition, the processing may be interrupted by software processing that causes the CPU core 31 to execute an instruction such as NOP (Non Operation).

FIG. 4B is an example of a diagram schematically illustrating the monitoring data. The monitoring data is divided into, for example, a data ID part and a data part. In the data part, the value of the PC 34 and the value of the variable are stored. The data ID is identification information for identifying whether the value of the PC 34 or the value of the variable is stored in the data part. In addition to the identification of the data stored in the data part, it may be identified by the data ID whether the value of the PC 34 is due to the interruption (periodic transmission) of the timer 24 or the arrival of the breakpoint.

[Detailed functions of monitoring microcomputer 100]
FIG. 5 is an example of a functional block diagram of the monitoring microcomputer 100. The monitoring microcomputer 100 includes a start control unit 51, a procedure control unit 52, a command generation unit 53, a PC determination unit 54, a PC recording unit 60, an address conversion unit 55, and a variable check unit 56 as functional blocks. Further, the PC determination unit 54 can access the PC history table 57, and the address conversion unit 55 can access the BP corresponding address table 59.

The procedure control unit 52 controls the overall operation of the monitoring microcomputer 100. When the activation of the monitoring microcomputer 100 is completed, the procedure control unit 52 causes the activation control unit 51 to activate the monitored microcomputer 50. Since the monitoring microcomputer 100 monitors the monitored microcomputer 50 in the microcomputer system 200, it is preferable that the monitoring microcomputer 100 is activated before the monitored microcomputer 50. For this reason, when the reset terminal of the monitoring microcomputer 100 becomes Low due to IG-ON or the like, the monitoring microcomputer 100 is activated first, and the monitored microcomputer 50 is activated with the permission of the monitoring microcomputer 100. For example, the activation control unit 51 activates the monitored microcomputer 50 by setting a reset terminal of the monitored microcomputer 50 to Low. Alternatively, a delay circuit that counts the time to the extent that the monitoring microcomputer 100 is activated is arranged, and the monitored microcomputer 50 does not start activation until the delay circuit counts this time after the reset terminal becomes Low. You may do it. The example in the figure is for the case where the monitoring microcomputer 100 permits the start of the monitored microcomputer 50, and the activation control unit 51 may be unnecessary.

Next, the procedure control unit 52 performs a process of setting a breakpoint in the breakpoint register 25 of the monitored microcomputer 50. Therefore, the command generation unit 53 is requested to transmit the value of the PC 34 to the debug port 20. As shown in the figure, the monitoring microcomputer 100 has a BP correspondence address table 59 in advance. In the BP correspondence address table 59, the value of the PC 34 and the variable address are stored in association with each other. The value of PC34 is a breakpoint. The break point is a value of the PC 34 corresponding to immediately after activation of the monitoring microcomputer 100, a value of the PC 34 immediately before the monitoring microcomputer 100 executes an important process, or the like. For example, the value of the PC 34 “0x0000000” is the value of the PC 34 immediately after startup. This is because the microcomputer normally executes the program from the beginning (zero) of the address.

The variable address associated with the value of the PC 34 is the RAM address or the register number of the CPU core 31 in which the variable to be monitored is stored when the monitored microcomputer 50 executes the instruction of the PC 34. . For example, when the value of the PC 34 is “0x0000000”, the variable address is “address A, B, C”. This means that when the monitored microcomputer 50 executes the instruction PC = “0x0000000”, the monitoring microcomputer 100 monitors the variables stored in “addresses A, B, and C”. By confirming the variable immediately after the activation, it is possible to confirm whether or not the variable of the RAM immediately after the activation is appropriate (whether it has been rewritten during sleep).

The command generation unit 53 sets a command for requesting setting to the breakpoint register 25 to the command unit, sets the value of the PC 34 read from the BP corresponding address table 59 to the parameter unit, and transmits to the debug port 20. This is repeated for all values of the PC 34 in the BP correspondence address table 59. The control unit 22 of the debug port 20 can set the values of all the PCs 34 in the BP correspondence address table 59 in the breakpoint register 25.

<Regular monitoring>
It has been described that the periodic monitoring may be requested by the monitoring microcomputer 100 and the timer 24 may be used for periodic monitoring. When the timer 24 is used, following the setting of the value of the PC 34, the procedure control unit 52 requests the command generation unit 53 to transmit the setting value (cycle time) of the timer 24 to the debug port 20.

The monitored microcomputer 50 executes a control program for the in-vehicle device after starting. When the timer 24 counts the passage of the cycle time, the control unit 22 transmits the value of the PC 34 at that time to the monitoring microcomputer 100. The procedure control unit 52 outputs the value of the PC 34 to the PC recording unit 60 and the PC determination unit 54. The PC recording unit 60 stores past PC 34 values in the PC history table 57 in time series. When the storage area is exhausted, the oldest one is overwritten. In addition, the PC determination unit 54 refers to the PC determination table 58 to determine whether or not the value transition of the PC 34 is normal.

On the other hand, when the monitoring microcomputer 100 requests the value of the PC 34 from the debug port 20 for each cycle period without using the timer 24, the procedure control unit 52 counts the elapse of the cycle period and debugs to the command generation unit 53. The port 20 is requested for the value of the PC 34. Since the control unit 22 transmits the value of the PC 34 at that time, the procedure control unit 52 outputs the value of the PC 34 to the PC recording unit 60 and the PC determination unit 54. The PC recording unit 60 stores past PC 34 values in the PC history table 57 in time series. Further, the PC determination unit 54 refers to the PC determination table 58 to determine whether or not the transition of the PC 34 is normal. Therefore, the normal determination of the transition of the PC 34 is possible by any method.

The PC determination unit 54 has a reference (determination logic) for determining in advance whether or not the transition of the value of the PC 34 is normal. A program executed by the monitoring microcomputer 100 is fixed in the ROM 32 (a new program is rarely installed like a general personal computer). For this reason, the value of PC34 changes within a cycle period, and the next possible value is limited to a certain range. The PC determination unit 54 has a range in which the value of the PC 34 changes in normal operation as determination logic. Since it is difficult to record the normal transition destination for each value of the PC 34, the address of the instruction executed by the monitoring microcomputer 100 (value that the PC can take) is divided into several areas (A to E areas). Then, it is determined whether or not the transition between the regions is normal. The PC determination unit 54 describes the following determination logic.
-After the A area, transition to the B area or C area-After the A area, do not transition to the E area-After the C area, always transition to the D area Therefore, the PC determination unit 54 Each area is determined from the value of the PC 34 immediately before recorded in the above and the latest value of the PC 34, and it is determined whether or not the transition of the value of the PC 34 is normal based on whether or not the determination criteria are met.

Note that not only such a transition but also whether the value of the PC 34 itself is normal or not may be determined. That is, if the value of the PC 34 corresponds to outside the program storage range (for example, outside A to E) in the ROM 32 of the monitored microcomputer 50, it can be determined that the value of the PC 34 itself is not normal.

When the value transition of the PC 34 is abnormal, the monitoring microcomputer 100 stores the PC history table so that it is not overwritten. In this case, monitoring is further continued, and if an abnormality is detected again in the transition of the value of the PC 34 (or more than once), the monitored microcomputer 50 is reset. Alternatively, if an abnormality is detected in the transition of the value of the PC 34, the value of the variable may also become abnormal. Therefore, the monitored microcomputer 50 may be reset when the abnormality of the variable is detected.

<Monitoring with breakpoints>
The control unit 22 of the debug port 20 transmits the value of the PC 34 to the monitoring microcomputer 100 when the value of the PC 34 of the monitored microcomputer 50 matches the value stored in any of the registers of the breakpoint register 25. As a result, the procedure control unit 52 can acquire the value of the PC 34 that is a breakpoint from the debug port 20. The procedure control unit 52 determines whether the value of the PC 34 for periodic monitoring by the timer 24 or the value of the PC 34 for passing a breakpoint is from the data ID portion of the monitoring data.

It should be noted that it is not necessary to determine whether the value of PC 34 for periodic monitoring or the value of PC 34 due to the passage of breakpoints. In this case, the procedure control unit 52 always requests the address conversion unit 55 for address conversion when the value of the PC 34 is received. That is, as will be described below, the address conversion unit 55 can detect that the PC 34 is registered in the BP correspondence address table 59 and determine that it is not periodic monitoring.

The procedure control unit 52, when acquiring the value of the PC 34 by the passage of the break point from the debug port 20, outputs it to the address conversion unit 55. The address conversion unit 55 retrieves the received value of the PC 34 from the BP correspondence address table 59, and reads the variable address associated with the value of the PC 34 that has hit the search. For example, when the value of the breakpoint PC 34 is “0x00000000”, the variable address is “address A, B, C”.

The address conversion unit 55 sends the variable address to the procedure control unit 52. The procedure control unit 52 requests the command generation unit 53 to generate a command for requesting the value of the variable stored in the variable address of the RAM 33. Therefore, the command generation unit 53 transmits, to the debug port 20 as a set of control data, a command unit storing a command for requesting a value of a variable stored in the RAM 33 and a parameter unit storing a variable address. . If there are three variable addresses, all addresses A, B, and C are transmitted to the debug port 20.

As a result, the control unit 22 of the debug port 20 reads the values of the variables stored in the addresses A, B, and C of the RAM 33 from the RAM 33 and transmits them to the monitoring microcomputer 100. The procedure control unit 52 sends the received variable value and the PC 34 already acquired as a breakpoint to the variable check unit 56. The variable check unit 56 checks whether or not the value of the variable is valid. The check method can be changed according to the value of the PC 34 associated with the variable address. For example, the variable check unit 56 performs the following check on the variable in the PC 34 corresponding to the break point immediately before the actuator control.
(i) It is determined whether or not there is a sensor abnormality by determining whether or not two sensor values (for example, a steering angle and a G sensor for airbag deployment) of the same physical quantity included in the variable are substantially equal. This steering angle is a value detected by the sensor because of the X-By-Wire system in which the steering angle of the steering wheel of the driver is detected and the actuator drives the steering shaft. If the steering angle is not correctly detected, the actuator cannot be steered to an appropriate angle, so at least two sensors detect the steering angle. In addition, the G sensor for detecting the establishment of the airbag deployment condition is the same. The airbag deployment ECU determines whether or not the airbag should be deployed by combining the detection results of signals from a plurality of G sensors that detect deceleration in the same direction in order to suppress erroneous deployment.

The monitoring microcomputer 100 according to the present embodiment determines whether or not the sensor values of a plurality of sensors arranged to detect an important physical quantity substantially match, so that all the sensors can correctly detect the physical quantity. Can be confirmed.
(ii)
When the variable acquired from the monitoring microcomputer 50 includes a result of midway calculation using the sensor value, the variable check unit 56 determines whether the midway calculation result is correct. That is, the variable check unit 56 uses the same calculation process as that of the monitored microcomputer 50 to determine whether the calculation results up to the middle are equal.
(iii) When the variable acquired from the monitoring microcomputer 50 includes a final calculation result for controlling the actuator, the variable check unit 56 determines whether the calculation result is correct. That is, the variable check unit 56 uses the same calculation process as that of the monitored microcomputer 50 to determine whether or not the final calculation results are equal.

(ii) (iii) increases the calculation load of the variable check unit 56, so it is not necessary to perform exactly the same calculation as the monitored microcomputer 50. For example, it is effective to reduce the load by performing only integer arithmetic. It is. Thereby, calculation time can be shortened.

In addition, the variable check unit 56 checks whether the variable including the calculation result is not converted into an abnormal value that is not possible as the control value of the actuator without performing the verification of (ii) and (iii). Good. In this case, the load on the monitoring microcomputer 100 can be greatly reduced.

Also, if the verification of (ii) and (iii) is not performed, the history of the same variable may be checked. For example, when the monitored microcomputer 50 periodically acquires the steering angle from the sensor due to a timer interruption, there should be an upper limit on the amount of fluctuation of the steering angle within a predetermined time. Therefore, it can be determined that a control amount that has changed beyond this upper limit is an abnormal value. When making this determination, the variable check unit 56 holds the value of the last acquired variable.

¡Breakpoints are embedded before the actuator is activated, so malfunctions can be prevented. Further, it is possible to operate the actuator while monitoring from the outside whether there is a failure of the monitored microcomputer 50. In other words, in general debugging, the operation of the monitored microcomputer 50 is stopped and the actuator is moved while confirming the operation. However, the monitoring of this embodiment is the actuator operation and real-time (minimum allowable from actuator operation request to operation execution). Within a limited time). For this reason, more stable actuator control is realizable.

Further, when the procedure control unit 52 sets a breakpoint at the entry / exit of the function of the main flow (for example, the start address of the function and its front and back, the last address of the function, its front and back, before and after the Return instruction, etc.) 100 can detect that a function has been entered or exited by passing a breakpoint. For example, the monitoring microcomputer 100 can determine whether or not the monitored microcomputer 50 is in a steady state in which the function is executed almost regularly based on whether or not the passage of the breakpoint is detected almost regularly. . In addition, it is possible to detect functions that are frequently executed, the execution time of each function, and the like. For example, it is possible to detect that execution is delayed in a certain function.

<About the results of abnormality check>
Depending on the check result of the variable check unit 56, the procedure control unit 56 performs, for example, the following processing.
A. When the variable check unit 56 does not detect any abnormality in the variable, the variable check unit 56 notifies the procedure control unit 52 of the fact. The procedure control unit 52 requests the command generation unit 53 to generate a command for canceling the interruption. The command generation unit 53 sets a command for canceling the interruption in the command unit (sets nothing in the parameter unit) and transmits the command to the debug port 20. The control unit 22 does not refer to the parameter unit for this command and sets the interruption signal line 26 to Low. Therefore, the monitored microcomputer 50 can resume the processing that was interrupted by the passage of the breakpoint.
B. If the variable check unit 56 detects an abnormality in the variable, the variable check unit 56 notifies the procedure control unit 52 to that effect. The procedure control unit 52 requests the command generation unit 53 to generate a command that requests the same variable in the RAM 33 again. Therefore, since the monitoring microcomputer 100 can acquire the value of the variable again, the variable check unit 56 performs the same check. If the variable check unit 56 detects an abnormality even after n times (2 to 3 times), the monitoring microcomputer 100 determines that the monitored microcomputer 50 is abnormal and resets the monitored microcomputer 50. Do.

[Operation procedure]
FIG. 6 is an example of a sequence diagram for explaining the operation procedure of the microcomputer system 200. The procedure in FIG. 6 starts, for example, when the IG-ON or the main system is turned on (in the case of an electric vehicle or a hybrid vehicle).

First, the monitoring microcomputer 100 is activated (S10). As a result, the activation control unit 51 of the monitoring microcomputer 100 permits the activation of the monitored microcomputer 50, or the monitored microcomputer 50 is activated with a delay by the delay circuit of the monitored microcomputer 50 (S210).

The procedure control unit 52 of the monitoring microcomputer 100 establishes communication with the debug port 20 of the monitored microcomputer 50 (S20). At this time, the monitoring microcomputer 100 is more effective if it requests the debug port 20 to interrupt the operation. That is, since the control unit 22 sets the interruption signal line 26 to High, the operation of the CPU core 31 stops, and the monitoring microcomputer 100 can reliably set a break point during that time.

When the communication is confirmed, the procedure control unit 52 requests the command generation unit 53 to set a breakpoint. Thereby, the command generation unit 53 transmits all the values of the PC 34 in the BP correspondence address table 59 to the debug port 20 (S30).

The procedure control unit 52 requests the command generation unit 53 to transmit a command for canceling the interruption. The command generation unit 53 transmits a command for canceling the interruption (S40). As a result, the control unit 22 of the debug port 20 sets the interruption signal line 26 to Low, so that the CPU core 31 starts operation.

When the monitored microcomputer 50 starts executing the program, the control unit 22 periodically transmits the value of the PC 34 (S220). The PC recording unit 60 registers the value of the PC 34 received from the debug port 20 in the PC history table 57.

Further, the PC determination unit 54 refers to the PC determination table 58 and determines whether or not the transition of the PC 34 is normal based on the value of the PC 34 received from the debug port 20 (S50). The same applies to the periodic monitoring in steps S230 and S60.

Then, when the value of the PC 34 of the monitored microcomputer 50 approaches the break point, a pre-actuator interrupt is generated in the CPU core 31 (S240). This is, for example, a timer interrupt for the monitored microcomputer 50 to periodically acquire a sensor value (for example, a steering angle). The monitored microcomputer 50 acquires and calculates the sensor value by interruption, and stores the sensor value and the calculation result in the RAM 33 as variable values.

Thereafter, the value of the PC 34 of the monitored microcomputer 50 reaches the break point. As a result, the control unit 22 of the debug port 20 detects that the value of the PC 34 of the CPU core 31 matches the value of the breakpoint register 25, and transmits the value of the PC 34 to the monitoring microcomputer 100 (S250). In the figure, the transmission of the PC 34 and the transmission of the variable are performed at the same time. However, the transmission of the variable may be performed after a request is received from the monitoring microcomputer 100. Moreover, the processing time can be shortened by transmitting simultaneously.

Since the control unit 22 sets the interruption signal line 26 to High due to the passage of the break point, the CPU core 31 of the monitored microcomputer 50 stops operating (S260).

The variable check unit 56 of the monitoring microcomputer 100 checks the variable (S70). If there is no abnormality in the variable, the procedure control unit 52 cancels the interruption (S80). Accordingly, the control unit 22 can resume the operation because the interruption signal line 26 is set to Low.

The monitored microcomputer 50 controls the actuator by resuming the operation (S270). The monitoring microcomputer 100 and the monitored microcomputer 50 repeat the above processing.

As described above, the microcomputer system 200 according to the present embodiment monitors the monitored microcomputer 50 by using the debug port 20 that has been conventionally discarded, so that the debug port 20 is not wasted. Since the performance of the monitoring microcomputer 100 may be lower than that of the monitored microcomputer 50, the cost can be greatly reduced as compared with the lockstep method. The monitored microcomputer 50 can control the actuator after the monitoring microcomputer 50 confirms that there is no abnormality in the variables. Therefore, it is possible to reliably prevent the actuator from being controlled with an inappropriate calculation result caused by sensor abnormality or RAM abnormality.

Claims

An on-board microcomputer system having a monitored microcomputer having a debug port and a monitoring microcomputer connected via the debug port,
The monitoring microcomputer is
A breakpoint registration table in which a plurality of breakpoints are registered in advance;
First transmission means for transmitting a breakpoint of the breakpoint registration table to a monitored microcomputer;
The monitored microcomputer is
A register for storing a breakpoint received from the monitoring microcomputer;
A second transmission means for transmitting the value of the program counter to the monitoring microcomputer when the program counter of the monitored microcomputer matches the breakpoint stored in the register;
A microcomputer system having
When the first transmission means receives the value of the program counter from the monitored microcomputer, the first transmission means has one or more addresses associated with the breakpoint that matches the received value of the program counter in the breakpoint registration table To the monitored microcomputer,
The second transmission means reads data stored at the address of the memory and transmits the data to the monitoring microcomputer.
The microcomputer system according to claim 1.
The monitoring microcomputer is
Comparing one or more data received from the monitored microcomputer with a threshold value, the data abnormality determining means for determining whether or not normal,
The microcomputer system according to claim 2.
The data abnormality determining means is
Comparing the first data and the second data received from the monitored microcomputer with each other, and calculating one of the first data and the second data; By comparing the third data received from the monitoring microcomputer, it is determined whether one or more data received from the monitored microcomputer is normal.
The microcomputer system according to claim 3.
The monitored microcomputer is
When the program counter of the monitored microcomputer matches the breakpoint stored in the register, it has an execution interruption means for interrupting the execution of the next instruction,
If resumption permission is received from the monitoring microcomputer, execution of the instruction is resumed.
The microcomputer system according to claim 4.
The second transmission means includes
Sending the value of the program counter of the monitored microcomputer to the monitoring microcomputer by a periodic request from the monitoring microcomputer or every predetermined cycle time,
The monitoring microcomputer has a program counter determination means for determining whether or not an instruction execution history is normal based on a transition of a program counter.
The microcomputer system according to any one of claims 1 to 5, wherein:
The breakpoint is an instruction for operating an actuator or an address immediately before the instruction, an instruction at which a function starts to be executed or an address immediately before the instruction, an instruction at which execution of a function is terminated, or an address immediately after the instruction , Is,
The microcomputer system according to claim 1.
The microcomputer system according to claim 1, wherein the monitoring microcomputer completes activation before the monitored microcomputer.
The microcomputer system according to claim 1, wherein the monitoring microcomputer has lower calculation performance than the monitored microcomputer.
A debug port,
A register for storing a breakpoint received from the monitoring microcomputer;
A monitored microcomputer having second transmission means for transmitting the value of the program counter to the monitoring microcomputer when the breakpoint stored in the register matches the program counter of the monitored microcomputer;
A monitoring microcomputer connected via the debug port,
A breakpoint registration table in which a plurality of breakpoints are registered in advance;
First transmission means for transmitting the breakpoint of the breakpoint registration table to the monitored microcomputer;
A monitoring microcomputer characterized by comprising: