JP7172155B2 - Electronic control device and software generation method - Google Patents

Description

The present invention relates to an electronic control device and software generation method.

Application programs (hereinafter referred to as applications) that implement control functions such as information input/output control are increasingly installed in vehicle electronic control units (hereinafter referred to as ECUs). Especially in recent years, there are many cases where multiple applications such as navigation control applications, information display control applications, and automatic driving control applications are installed in one ECU as information input/output control applications. ing.

Conventionally, important applications related to vehicle control, such as meter display and entertainment information display, and non-important applications not related to vehicle control are combined and mounted in one ECU. In this case, since the functional safety level of each application is clear, i.e. the functional safety level of critical applications is ASIL-C, and the functional safety level of non-critical applications is ASIL-less, the development process is a so-called straight line. During the development process, there were no particular problems. In addition, in the above-mentioned straight line development process, the functional safety level of each application is determined and the software is built. After creating a load module and debugging each application of the load module, the combined debugging of the load modules was performed.

JP-A-2000-132410

However, in recent years, there are two important applications, for example, an automatic driving application and an automatic driving mode/user interface application (that is, an important application for the evolution of meter display, which controls display output and user input). There is a demand for a configuration in which these important applications are combined and mounted on a single ECU.

In the case of this configuration, in the process of first determining the functional safety level, five types of functional safety level ASIL-x for one important application are considered: no ASIL, ASIL-A to ASIL-D, and the other important application There are five types of functional safety level ASIL-y for the application: no ASIL, ASIL-A to ASIL-D. And in many cases, the functional safety levels ASIL-x and ASIL-y of each application are not decided until the end of the development process.

Therefore, when creating a load module, it is necessary to preliminarily create load modules with 5×5=25 combinations of functional safety levels. Furthermore, it is necessary to debug each application of each load module for each of the 25 created load modules, and then to debug each load module in combination, resulting in a situation requiring a huge amount of development man-hours. Furthermore, when installing three or more important applications, there is a possibility that the number of development man-hours will increase further.

SUMMARY OF THE INVENTION It is an object of the present invention to provide an electronic control device and software generation method capable of reducing development man-hours when installing a plurality of important applications in an ECU.

The invention of claim 1 is an electronic control device equipped with a plurality of applications having a vehicle control function, wherein the function is generated using as input information the plurality of applications and functional safety level designation information for each of the plurality of applications. It is equipped with a load module 2 generated by linking with basic software having a safety control function. The multiple apps include a first app and a second app with a functional safety level higher than that of the first app. When the base software detects access from the first application, it interrupts the second application, and in the interrupt routine of the second application, based on the access information that allows access from the first application, access from the first application is prohibited. When the second application is executed, the access having the same function as the operation of the first application is executed on behalf of the second application.

According to a fifth aspect of the present invention, there is provided a method for generating software for an electronic control device having a plurality of applications having a vehicle control function, wherein the functional safety control function is generated using functional safety level designation information for each of the plurality of applications as input information. and linking the plurality of applications with the base software to generate a load module. The plurality of applications includes a first application and a second application having a functional safety level higher than that of the first application. At this time, when the base software detects an access from the first application, it interrupts the second application, and in the interrupt routine of the second application, based on the access information that the first application can access, the first application When it is determined that the access is prohibited, the access having the same function as the operation of the first application is performed by the second application.

The figure which shows 1st Embodiment and explains a personal computer and a development process. Diagram explaining the application and basic software Diagram showing table of functional safety level combinations and functional safety measures This diagram shows an example of a combination of functional safety levels and explains an application and basic software. This is another example of a combination of functional safety levels, and a diagram explaining an application and basic software Diagram showing an example of an address check table file Diagram explaining the operation of the check routine

(First embodiment)
A first embodiment will be described below with reference to FIGS. 1 to 7. FIG. FIG. 1 shows a device such as a personal computer 1 for manufacturing the software of the ECU of the present embodiment, that is, the load module, and for debugging the load module. It should be noted that another computer may be used instead of the personal computer 1 .

In this embodiment, for example, a configuration in which two applications, that is, application X and application Y are installed in the ECU will be described. In this configuration, as shown in FIG. 2, the load module 2 is created (ie, built) by linking (ie, coupling) the application X, the application Y, and the base software of the electronic control unit.

Here, there are five levels of functional safety for the two applications: no ASIL, ASIL-A, ASIL-B, ASIL-C, and ASIL-D. Without ASIL, the functional safety is weak, and ASIL-A Functional safety increases in order from ASIL-D to ASIL-D. FIG. 3 shows a table of functional safety measures determined by the combination of functional safety levels of two applications.

In this table, that is, the functional table of functional safety measures, there are five functional safety levels: no ASIL, ASIL-A, B, C (hereinafter referred to as ASIL-C and below), and ASIL-D. Functional safety measures are set according to three levels. If it is necessary to set and implement more precise functional safety measures, subdivide the functional safety measures below ASIL-C, that is, divide them into ASIL-A, ASIL-B, and ASIL-C. It should be configured as follows.

In this embodiment, the combination of the functional safety levels of the two applications X and Y installed in the electronic control device, that is, the specification information of the functional safety levels of the applications X and Y, for example, the ASIL level configuration file (Fig. 1) and the table in FIG. Then, as shown in step S10 of FIG. 1, base software incorporating the functional safety measures obtained above is generated. Furthermore, as shown in step S20 in FIG. 1, the load module 2 is created by linking the base software incorporating this functional safety measure and the two applications X and Y described above. After that, as shown in step S30 of FIG. 1, the load module 2 is configured to be debugged by connection. The completion of combined debugging completes the development of software for ECUs equipped with multiple functions.
Next, specific examples of functional safety measures will be described with reference to FIGS. 4 to 7. FIG.

First, the case where the functional safety level of application X is, for example, ASIL-D and the functional safety level of application Y is, for example, no ASIL, that is, the case of combination No. 3 in the table of FIG. 3 will be described. In this case, application X is developed in ASIL-D, so its functional safety level is high, so no functional safety measures are necessary, as indicated by the arrow pointing to the right in FIG.

On the other hand, application Y is developed without ASIL, and has a low functional safety level, ie, a low application verification level, so there is a possibility of unexpected access. Therefore, a functional safety control function, ie, a functional safety control function, is incorporated into the base software to block access to application Y, that is, to prohibit access, and to allow application X to operate the access on behalf of application Y.

Specifically, the platform software detects access from application Y and interrupts application X. FIG. In the interrupt routine, application X grasps the operation of application Y based on the table of "access information of application Y" held by the platform software, and requests access having the same function as the operation of application Y. Execute on behalf of For example, the read operation of application Y is replaced with the write operation of application X and executed. For this reason, an additional routine, an action replacement table file, etc., for causing the application X to operate on behalf of the application X are generated, and these routines, files, etc. are incorporated into the base software.

Next, if the functional safety level of application X is, for example, ASIL-D, and the functional safety level of application Y is, for example, ASIL-C (that is, ASIL-C or lower), that is, number 2 in the table of FIG. Functional safety measures for the combination of In this case, as shown in FIG. 5, application X is developed in ASIL-D, so no functional safety measures are required. On the other hand, application Y was developed with ASIL-C or lower, and the functional safety level is relatively low. be. Therefore, when the application Y is accessed, a countermeasure is taken such that the basic software has a function to operate a predetermined check function.

Specifically, when the application Y accesses, the information to be checked by the infrastructure software, such as the address range, access authority, and access details, is stored in advance as a check data table, and when the application Y accesses, First, the base software is configured to operate a check routine for checking the check data table. In this embodiment, the check table file and the check routine are created and incorporated into the base software in advance. A log file for storing the check result is created by the above check routine. Log files are described later.
FIG. 6 shows an example of an address check table file among the check table files.

For example, as shown in FIG. 7, assume that memory access occurs in step S100 while application Y is being executed. In this case, (1) first, the platform software detects the memory access, checks whether the access is normal based on the check table file of FIG. Invoke the store routine. As a result, the base software stores the check result in the log file 3. FIG.

Next, (2) the diagnostic routine associated with the control is configured to periodically monitor the NG results stored in the log file 3 . In this case, when the NG result is detected, it is preferable to perform processing such as notifying the NG result to the administrator of the ECU, for example, the driver in the case of the ECU installed in the vehicle. It should be noted that the NG result monitoring frequency is configured to be appropriately set according to the risk and influence.

In this embodiment having such a configuration, functional safety control functions, i.e., base software having functional safety measures are generated using the designation information of the functional safety level for each of the two applications X and Y as input information. The load module 2 is generated using the applications X and Y and the generated base software. According to this configuration, even if the functional safety level of each of the two applications X and Y is changed, the load module can be easily created and debugged. It is possible to execute combined debugging at once. Therefore, when a plurality of important applications are installed in the ECU, the number of development man-hours can be greatly reduced compared to the conventional configuration.

Further, in the present embodiment, the functional safety control function is configured to have a function of restricting information access within the application, so that the safety of information access within the application can be enhanced.

Further, in this embodiment, the functional safety control function is configured to have a function of managing an interrupt signal given from the outside, so that the safety of the interrupt operation of the application can be improved.

Further, in the present embodiment, the functional safety control function is a function group assumed in advance as a functional safety control function to be incorporated in the base software, for example, from the function table of functional safety measures shown in FIG. function selected based on the specified information of the functional safety level. According to this configuration, it is possible to easily generate base software incorporating necessary functional safety measures.

Further, in the present embodiment, the configuration in which two applications X and Y are installed in the ECU has been described, but the configuration is not limited to this, and three or more applications may be installed in the ECU. good. For example, in the case of a configuration in which three applications A, B, and C are installed in the ECU, functional safety measures are required between applications. Functional safety measures are required between B and application C, respectively. If the number of applications is N, there are _N C ₂ types of applications that require functional safety measures. Can be configured. Then, it is preferable to incorporate the information of the function group of the functional safety measures configured in this way into the basic software, link the incorporated basic software and N applications, and generate the load module.

Although the present disclosure has been described with reference to examples, it is understood that the present disclosure is not limited to such examples or structures. The present disclosure also includes various modifications and modifications within the equivalent range. In addition, various combinations and configurations, as well as other combinations and configurations including single, more, or less elements thereof, are within the scope and spirit of this disclosure.

In the drawing, 1 is a personal computer, 2 is a load module, and 3 is a log file.

Claims (8)

An electronic control device equipped with a plurality of applications having a vehicle control function,
multiple apps and
a load module (2) generated by linking base software having a functional safety control function generated using the designation information of the functional safety level for each of the plurality of applications as input information ,
The plurality of applications include a first application (Y) and a second application (X) having a functional safety level higher than that of the first application,
Upon detecting an access from the first application, the platform software causes the second application to interrupt, and in an interrupt routine of the second application, the first application based on access information that the first application can access. An electronic control device that causes the second application to perform access having the same function as the operation of the first application when it is determined that access is prohibited from the application . The electronic control device according to claim 1, wherein the functional safety control function includes a function of restricting information access within the application. 3. The functional safety control function comprises a function selected based on the functional safety level designation information for each application from among a group of functions assumed in advance as functional safety control functions to be incorporated into the platform software. 3. The electronic control device according to 1 or 2 . 4. The electronic control device according to any one of claims 1 to 3 , wherein the load module is generated by combining the plurality of applications and the base software. A software generation method for an electronic control device equipped with a plurality of applications having a vehicle control function,
generating basic software having a functional safety control function using the functional safety level designation information for each of the plurality of applications as input information;
configured to generate a load module by linking the plurality of applications and the base software ;
The plurality of applications include a first application (Y) and a second application (X) having a functional safety level higher than that of the first application,
Upon detecting an access from the first application, the platform software causes the second application to interrupt, and in an interrupt routine of the second application, the first application based on access information that the first application can access. A method of generating software for an electronic control device that causes an access having the same function as the operation of the first application to be executed on behalf of the second application when it is determined that access is prohibited from the application . 6. The method of generating software for an electronic control unit according to claim 5 , wherein said functional safety control function includes a function of restricting information access within said application. 3. The functional safety control function comprises a function selected based on the functional safety level designation information for each application from among a group of functions assumed in advance as functional safety control functions to be incorporated into the platform software. 7. The method of generating software for an electronic control device according to 5 or 6 . 8. The method of generating software for an electronic control unit according to claim 5 , wherein said load module is generated by combining said plurality of applications and said base software.

Images