Verification device

Abstract

The present invention relates to a verification device (3) for an in-vehicle control device (2), the in-vehicle control device (2) including a first program processing unit (12), which executes a current program based on the output of a sensor unit (11) and outputs the processing result to an actuator unit (13). The verification device (3) includes: a second program processing unit (16) that shares the output of the sensor unit (11), executes the current program and outputs the processing result; a third program processing unit (17) that executes a new program and outputs the processing result; and a comparison determination unit (18) that compares these outputs. Therefore, effective regression testing of a new program can be performed at low cost without affecting the operation of the in-vehicle control device (2).

Description

Technical Field

[0001] This application relates to a verification device. Background Technology

[0002] When the software of an onboard control unit is modified due to improvements, fault corrections, or feature additions, regression testing is required to investigate whether components other than the modified parts function in the same way as the current software. In this case, regression testing can be planned using inputs from multiple sensors or sensors with large amounts of information. However, this results in a large combination of sensor data, making regression testing time-consuming and complex.

[0003] Patent Document 1 describes an obstacle detection device installed on a vehicle that processes input from sensors and outputs the results to an external device, as well as a verification device that verifies new software after a portion of the software has been modified. The verification device is arranged in parallel with the obstacle detection device, and it processes signals from the sensors of the obstacle detection device using the new software. The verification device compares the output of the new software with the output of the obstacle detection device to perform regression testing on the software.

[0004] Patent document 2 describes a control device that switches to a shorter processing time when the processing time of software that performs calculations in cycles of tens of μs becomes too long to keep up with the timing required for processing.

[0005] Existing technical documents

[0006] Patent documents

[0007] Patent Document 1: Japanese Patent Application Publication No. 2019-32656

[0008] Patent Document 2: Japanese Patent Application Publication No. 2018-137895 Summary of the Invention

[0009] The technical problem that the invention aims to solve

[0010] The regression test of the software described in Patent Document 1 can be performed using a single processing unit within an onboard unit that includes both an onboard control unit and a verification unit. This allows for the sharing of input signals from sensors, comparison of the output of the current software and the output of the new software, and integrated management of the onboard control unit and verification unit, thereby improving efficiency. Furthermore, integrating the onboard control unit and verification unit contributes to the miniaturization, weight reduction, and cost reduction of the entire device.

[0011] In vehicle control devices, there are mechanisms that process data in cycles of tens of μs, as in Patent Document 2. When processing is performed in such short cycles, if regression testing of the software described in Patent Document 1 is executed using a single processing unit within the vehicle unit, the software execution load on the processing unit can sometimes become a problem. Sometimes it is necessary to execute the current software and a new software resulting from partial modifications of the current software in parallel, and compare their processing results in short cycles, which may exceed the processing capacity of the processing unit. If the processing capacity of the processing unit is exceeded, a problem arises where the processing of the vehicle control device based on the current software cannot be performed within the prescribed cycle.

[0012] To prevent the processing unit from becoming overloaded with software execution, a high-capacity processing unit can be used. However, in this case, to execute both the current and new software within a shorter cycle, the software execution load will double, requiring an even more powerful processing unit, thus increasing costs.

[0013] Furthermore, different processing units can be used separately for the vehicle control unit and the verification unit to handle the fault detection of the software described in Patent Document 1. In this case, there are cases where the vehicle control unit and the verification unit are integrated, and cases where they are separated. In either case, a high-capacity processing unit may be required to execute the processing in a short time. In this case, not only the processing unit used for the vehicle control unit, but also the processing unit used for the verification unit needs to be replaced with a high-performance processing unit. Using only a high-performance processing unit in the vehicle control unit makes it difficult to effectively implement regression testing verification. This is because the current program executed by the vehicle control unit and the new program executed by the verification unit need to be executed synchronously and their outputs compared. Therefore, as the processing speed of the vehicle control unit increases, it becomes necessary to make both processing units highly functional, leading to increased costs.

[0014] Therefore, the purpose of this application is to provide a verification device that does not affect the operation of an on-board control device with the current software installed, and can perform effective regression testing at low cost using new software obtained by modifying a portion of the current software.

[0015] Technical means for solving technical problems

[0016] The verification device involved in this application is a verification device for an on-board control device, which includes:

[0017] Sensors section;

[0018] The program record section records the current program used for controlling the onboard equipment; and

[0019] The system receives signals output from the sensor unit, executes the current program read from the program recording unit based on the signals, and outputs the processing results to the first program processing unit of the vehicle-mounted equipment.

[0020] The verification device includes: a second program processing unit that takes in a signal output by a sensor unit, executes a program identical to the current program based on the signal, and outputs the processing result;

[0021] A third program processing unit receives signals output from the sensor unit, executes a new program based on the signals (after specification modifications to the current program), and outputs the processing results.

[0022] The comparison determination unit compares the first output portion of the third program processing unit (excluding the output affected by specification changes) with the second output portion of the second program processing unit corresponding to the first output portion and determines their similarity.

[0023] Invention Effects

[0024] According to the verification device involved in this application, the operation of the vehicle control device equipped with the current software is not affected, and the current software and a new software obtained after a part of the current software has been modified are executed in parallel and the outputs are compared. Therefore, effective regression testing can be carried out at low cost. Attached Figure Description

[0025] Figure 1 This is a block diagram showing the structure of the verification device according to Embodiment 1.

[0026] Figure 2 This is a diagram illustrating the hardware structure of the vehicle-mounted unit according to Embodiment 1.

[0027] Figure 3 This is a flowchart illustrating the verification cycle setting of the verification device involved in Implementation Method 1.

[0028] Figure 4 This is a diagram illustrating the input signals of the verification device according to Embodiment 1.

[0029] Figure 5 This is a flowchart illustrating the processing of the verification apparatus involved in Embodiment 1.

[0030] Figure 6 This is a first flowchart illustrating the processing of the verification apparatus involved in Embodiment 2.

[0031] Figure 7 This is a second flowchart illustrating the processing of the verification apparatus involved in Embodiment 2.

[0032] Figure 8This is a third flowchart illustrating the processing of the verification device involved in Embodiment 2.

[0033] Figure 9 This is a fourth flowchart illustrating the processing of the verification device involved in Embodiment 2.

[0034] Figure 10 This is a fifth flowchart illustrating the processing of the verification apparatus involved in Embodiment 2.

[0035] Figure 11 This is a sixth flowchart illustrating the processing of the verification apparatus involved in Embodiment 2.

[0036] Figure 12 This is the seventh flowchart used to explain the processing of the verification device involved in Embodiment 2.

[0037] Figure 13 This is the eighth flowchart illustrating the processing of the verification apparatus involved in Embodiment 2. Detailed Implementation

[0038] 1. Implementation Method 1

[0039] Hereinafter, the verification apparatus according to Embodiment 1 will be described with reference to the accompanying drawings.

[0040] Figure 1 This is a block diagram showing the structure of the verification device 3 according to Embodiment 1. Figure 2 This is a diagram showing the hardware structure of the vehicle-mounted unit 1 according to Embodiment 1. Figure 3 This is a flowchart illustrating the verification cycle setting of the verification device 3 involved in Embodiment 1. Figure 4 This is a diagram illustrating the input signals of the verification device 3 according to Embodiment 1. Figure 5 This is a flowchart illustrating the processing of the verification device 3 involved in Embodiment 1.

[0041] <Vehicle-mounted machine>

[0042] like Figure 1 As shown, the vehicle-mounted unit 1 involved in Embodiment 1 consists of a vehicle-mounted control device 2 and a verification device 3. Figure 1 In this document, structural elements not directly related to Implementation Method 1 are omitted from the illustrations. The vehicle-mounted unit 1 is a control device that controls vehicle-mounted equipment, including power conversion control, engine control, transmission control, steering control, brake control, audio control, video control, collision prevention control, distance control, headlight control, door control, power window control, wireless key lock control, automatic driving control, and fault diagnosis control, and is accompanied by a verification device.

[0043] The various functions of the vehicle-mounted unit 1 are implemented by the processing circuitry it possesses. Specifically, the vehicle-mounted unit 1, as follows: Figure 2 As shown, the processing circuit includes an arithmetic processing unit 90 (computer) such as a CPU (Central Processing Unit), a storage device 91 that exchanges data with the arithmetic processing unit 90, an input circuit 92 that inputs external signals to the arithmetic processing unit 90, and an output circuit 93 that outputs signals from the arithmetic processing unit 90 to the outside.

[0044] The processing unit 90 can include ASICs (Application Specific Integrated Circuits), ICs (Integrated Circuits), DSPs (Digital Signal Processors), FPGAs (Field Programmable Gate Arrays), various logic circuits, and various signal processing circuits. Furthermore, the processing unit 90 can also include multiple processing units of the same or different types to share the execution of various processes. The storage device 91 includes non-volatile or volatile semiconductor memories such as RAM (Random Access Memory) configured to read and write data from the processing unit 90, ROM (Read Only Memory) configured to read data from the processing unit 90, flash memory, EPROM, and EEPROM. The input circuit 92 is connected to various sensors and switches, including an A / D converter that inputs the output signals of these sensors and switches to the processing unit 90. The output circuit 93 is connected to electrical loads and includes drive circuits that convert control signals from the processing unit 90 and output them to these electrical loads.

[0045] The various functions of the vehicle-mounted unit 1 are realized by the arithmetic processing unit 90 executing the software (program) stored in the storage device 91 such as ROM, and in cooperation with other hardware of the vehicle-mounted unit 1 such as the storage device 91, the input circuit 92, and the output circuit 93. In addition, the threshold, judgment value, and other setting data used by the vehicle-mounted unit 1 are stored in the storage device 91 such as ROM as part of the software (program).

[0046] right Figure 1 The functions of the structural elements of the vehicle-mounted unit 1 will be explained. Figure 1 The vehicle control device 2, the verification device 3, and the functions shown in 11 to 20 described inside the vehicle-mounted unit 1 can be constructed by software modules, or by a combination of software and hardware.

[0047] <Vehicle Control Device>

[0048] The vehicle control device 2 includes a sensor unit 11, a first program processing unit 12, an actuator unit 13, and a program recording unit 14. In Embodiment 1, the vehicle control device 2 is described as a power conversion device. The sensor unit 11 detects input signals such as AC voltage and AC current. The power conversion processing program recorded in the program recording unit 14 is read into the first program processing unit 12. The first program processing unit 12 uses the input signals detected by the sensor unit 11 to execute program processing and outputs it to the actuator unit 13 to control the power converter.

[0049] <Verification Device>

[0050] Verification device 3 is an apparatus that executes the current program and a new program in parallel, compares the outputs, and performs regression testing on the new program. Verification device 3 includes a new program recording unit 15, a second program processing unit 16, a third program processing unit 17, a comparison determination unit 18, a verification cycle setting unit 19, and a verification recording unit 20. In the second program processing unit 16, the current program read from the program recording unit 14 is copied. In the third program processing unit 17, the new program read from the new program recording unit 15 is configured. The second program processing unit 16 and the third program processing unit 17 acquire the input signal detected by the sensor unit 11 and perform processing at the cycle set by the verification cycle setting unit 19. The processing results of the second program processing unit 16 and the third program processing unit 17 are compared by the comparison determination unit 18 to verify whether the processing results are the same except for the modifications to the output caused by the specification changes of the new program obtained after the specification changes of the current program. The new program is a modified version of a part of the current program.

[0051] That is, the verification device 3 involved in Embodiment 1 is a device for verifying the vehicle control device 2. The vehicle control device 2 includes: a sensor unit 11; a program recording unit 14 that records the current program of the vehicle control device 2; and a first program processing unit 12 that takes in signals output by the sensor unit 11, executes the current program read from the program recording unit 14 based on the signals, and outputs the processing results to the actuator unit 13.

[0052] The verification device 3 includes a second program processing unit 16 that takes in a signal output by the sensor unit 11, executes a program identical to the current program based on the signal, and outputs the processing result.

[0053] The third program processing unit 17 takes the signal output by the sensor unit 11 as input, executes a new program based on the signal that has modified the specifications of the current program, and outputs the processing result; and

[0054] The comparison determination unit 18 compares the first output portion of the output of the third program processing unit 17 (excluding the output affected by specification changes) with the second output portion of the output of the second program processing unit 16 corresponding to the first output portion and determines their similarity.

[0055] Therefore, the verification device 3 does not affect the operation of the vehicle control device 2 equipped with the current software. It executes the current software and a new software obtained after partial modification of the current software in parallel and compares the outputs, thus enabling effective regression testing at low cost. Since it is installed on an actual vehicle and receives signals from the sensor unit 11, it is not necessary to prepare multiple input information in advance, and verification that is relevant to the actual situation can be performed.

[0056] Furthermore, even if it is necessary to shorten the execution cycle of the vehicle control device 2, the requirement can be met simply by increasing the processing cycle of the first program processing unit 12 of the vehicle control device 2. This is because even without shortening the processing cycles of the second program processing unit 16 and the third program processing unit 17, the function of comparing the output by executing the current program and the new program through the verification device can be realized. Therefore, the verification device 3 can directly address the shortening of the control cycle of the vehicle control device 2 and can implement effective regression testing at low cost.

[0057] Furthermore, if the verification device 3 reads the current program from the program record unit 14, the consistency between the object to be compared with the new program can be ensured, and program version errors can be prevented. Moreover, by sharing the program's storage location, resources such as memory can be utilized effectively. In addition, by providing a new program record unit 15 for reading the new program for comparison between the verification device 3 and the current program, the new program to be compared can be easily replaced, thereby contributing to improved software development efficiency.

[0058] Verification Cycle Setting Department

[0059] right Figure 1The verification cycle setting unit 19 will be described below. The verification cycle setting unit 19 has the function of setting the cycle for the verification device 3 to execute new software and current software in parallel and compare the outputs. The verification cycle setting unit 19 can set a value greater than or equal to the control cycle of the vehicle control device 2 (i.e., the first cycle) as the verification cycle (i.e., the second cycle). While setting the second cycle to a value larger than the first cycle is described here considering the software execution load, it is certainly acceptable to set the second cycle to be the same as the first cycle if the software execution load of the vehicle control unit 1 has sufficient margin. With the same cycle, it is very meaningful to verify the new program during the actual vehicle control timing, thus maintaining high verification efficiency. When the software execution load is below a specified value (e.g., 50%), the second cycle can be the same as the first cycle to maintain high verification efficiency. When the software execution load is above a specified value (e.g., 50%), the second cycle can be larger than the first cycle (e.g., twice the size) to prevent excessive software execution load. Furthermore, excessive software execution load can be prevented by continuously and significantly changing the second cycle according to the increase in software execution load. The advantages of setting the second cycle to a value greater than that of the first cycle are described below.

[0060] When the control cycle of the vehicle control device 2, i.e., the first cycle or higher, is set as the verification cycle of the verification device 3, i.e., the second cycle, the number of verifications performed by the verification device 3 is less than the number of times the actuator section 13 is controlled by the vehicle control device 2. Here, with the reduction in the number of verifications, the control performance of the vehicle control device 2 is not affected, the software execution load of the arithmetic processing unit 90 related to the verification device 3 is reduced, and the software execution load of the arithmetic processing unit 90 of the vehicle unit 1 as a whole is reduced.

[0061] Therefore, when the vehicle-mounted unit 1 executes the software processing of the first program processing unit 12, the second program processing unit 16, and the third program processing unit 17 through a single arithmetic processing unit 90, the software execution load of the arithmetic processing unit 90 is reduced, enabling the vehicle-mounted unit 1 to perform processing with a shorter effective cycle, or to perform processing of additional functions, which is of great significance.

[0062] When the vehicle-mounted unit 1 has multiple processing units 90, and the vehicle-mounted control unit 2 and the verification unit 3 are each equipped with different processing units 90, when the second cycle is set to be longer than the first cycle, the software execution load of the processing unit 90 of the verification unit 3 is reduced. This allows the processing unit 90 of the verification unit 3 to be replaced with a slower processing unit 90, thus reducing costs. Alternatively, the processing unit 90 of the verification unit 3 can also handle other functions, which is of great significance.

[0063] Furthermore, if the input signal detected by the sensor unit 11 has a periodic nature, the verification period setting unit 19 can calculate the period of the input signal and set the verification period of the verification device 3, i.e., the second period, based on the period of the input signal.

[0064] When the input signal remains unchanged, the comparison result of the output obtained by the verification device 3 from executing the current program and the new program also remains unchanged. Therefore, even if the second period, which is the verification cycle of the verification device 3, is set to a large value when the input signal changes only slowly, there will be no difference in the verification result, so there is no problem.

[0065] Conversely, when the input signal changes rapidly, setting the verification period (second period) of verification device 3 to a smaller value can increase the verification frequency and efficiency. Therefore, setting the second period based on the period of the input signal is of great significance.

[0066] Furthermore, if the input signal detected by the sensor unit 11 has a periodic nature, the verification period setting unit 19 can set the verification period, i.e. the second period, to a value that is shorter than the period of the input signal and different from the period obtained by dividing the period of the input signal by an integer.

[0067] Therefore, by setting a verification period, i.e., a second period, the situation where the verification period is an integer multiple of the input signal period can be avoided. This is because, when the verification period has a periodic nature, if the input signal is used as an integer multiple of its period, only the portion of the input signal with the same value will be sampled, thus limiting the input values ​​that can be used for verification and reducing verification efficiency. Therefore, by setting the verification period, i.e., the second period, to a value that is shorter than the input signal period and different from the period obtained by dividing the input signal period by an integer, the variety of input values ​​that can be used for verification can be increased and verification efficiency can be improved, which is of great significance.

[0068] Furthermore, the verification cycle setting unit 19 can set the verification cycle of the verification device 3, i.e., the second cycle, to a value that is different from an integer multiple of the control cycle of the vehicle control device 2, i.e., the first cycle.

[0069] When the verification cycle is an integer multiple of the control cycle, the verification performed by the verification device 3 is carried out every predetermined number of times the program processing of the vehicle control device 2 is performed. As a result, there are signals input from the sensor unit 11 every predetermined number of times. If the output of the current program and the new program differs due to this input, the verification device 3 may fail to detect the input signal that generates the output difference at different timings.

[0070] Therefore, by setting the verification cycle of the verification device 3, i.e. the second cycle, to a value that is different from the control cycle of the vehicle control device 2, i.e. the first cycle, the timing of the program processing of the vehicle control device 2 and the timing of the verification processing of the verification device 3 are gradually staggered, which can increase the types of input values ​​for verification processing and thus help improve verification efficiency. Therefore, it is of great significance.

[0071] right Figure 1 The comparison determination section 18 and the verification record section 20 described herein will be explained.

[0072] <Comparison and Judgment Department>

[0073] In the verification device 3, a signal output from the sensor unit 11 is input. Based on the signal, the second program processing unit 16 executes the current program and outputs the processing result, and the third program processing unit 17 executes the new program and outputs the processing result, and the two processing results are compared. However, due to specification changes, the new program sometimes outputs values ​​different from the current program.

[0074] If there are regions with different output values ​​due to specification changes, the comparison and determination unit 18 extracts the first output portion excluding the output of that region from the output of the new program. Then, it extracts the output portion corresponding to the first output portion as the second output portion from the output of the processing result of the current program executed by the second program processing unit 16.

[0075] The comparison and determination unit 18 compares a portion of the output of the second program processing unit 16, namely the second output portion, with a portion of the output of the third program processing unit 17, namely the first output portion, and determines their similarity.

[0076] When a new program has errors, it may produce different outputs when it should perform the same actions as the current program. Furthermore, due to errors in the new program, besides unexpected actions, the content of the specification changes and the programmer's interpretation of those changes may sometimes differ. In such cases, the impact of the specification changes may sometimes affect areas different from what was originally considered.

[0077] In this situation, the comparison determination unit 18 determines that the identity of the first output section and the second output section has been violated, and the comparison determination unit 18 determines that they are inconsistent. The comparison result of the comparison determination unit 18 is recorded in the verification record unit 20. When the determination result is inconsistent, the output result of the current program and the output result of the new program, as well as the values ​​of the input signals used in the processing, are recorded in the verification record unit 20.

[0078] Verification Records Department

[0079] By analyzing the records of input and output signals when the judgment results differ, it is possible to clarify the problems in the new program. Therefore, storing these records in the verification record unit 20 is of great significance. Records of consistent and inconsistent cases, as well as records of input and output signals under inconsistent cases, can also be retrieved from the verification record unit 20 via the vehicle's communication line or wireless communication. Since the retrieved verification information can be immediately used to improve the new program, it is effective in improving software development efficiency.

[0080] Furthermore, a structure can be adopted in which multiple control programs are set in the storage device 91, and any program can be sent to the program recording unit 14 and the new program recording unit 15 and stored according to external instructions. The programs executed by the first program processing unit 12 and the second program processing unit 16 are programs read from the program recording unit 14. The new programs executed by the third program processing unit 17 are programs read from the new program recording unit 15. Therefore, it is significant that the program to be executed or to be subjected to regression testing can be changed immediately. In addition, it can also be configured such that the vehicle-mounted unit receives the program via a communication line and stores it in the storage device 91. In this way, the program to be verified can be changed immediately according to external instructions, thereby effectively improving software development efficiency.

[0081] <Verification cycle setting process>

[0082] Next, the verification cycle setting process implemented by the verification cycle setting unit 19 in the verification device 3 of Embodiment 1 will be described. Figure 3 This is a flowchart illustrating the process of setting the verification cycle in the verification device 3 of Embodiment 1.

[0083] Figure 3 The processing is performed, for example, every 50 μs. In step S10, the processing begins by determining whether the input signal detected by the sensor unit 11 is periodic. Whether it is periodic is determined based on the history of past input signal magnitudes sequentially stored in the storage device 91. If the input signal is periodic, the process proceeds to step S20; otherwise, it proceeds to step S30.

[0084] In step S20, a period that is less than the period of the input signal and different from the period obtained by dividing the period of the input signal by an integer is set as the second period. The verification period of the verification device 3, i.e., the second period, is also set to a value larger than the first control period of the vehicle control device 2. After step S20, the process proceeds to step S90 and ends.

[0085] In step S30, the verification cycle is set to a predetermined value. Furthermore, this predetermined value is larger than the control cycle of the vehicle control device 2. After step S30, the process ends in step S90.

[0086] The period of the input signal detected by the comparison sensor unit 11 is smaller than the period obtained by dividing the period of the input signal by an integer, and larger than the control period of the vehicle control device 2. For example, if the input signal from the outside is a 50Hz sine wave, the period of the input signal is 20ms. The control period of the vehicle control device used to measure changes in the input signal and perform power conversion control is set to 50μs. At this time, Figure 4 The example shown is a period that is smaller than the period of the input signal and is not obtained by dividing the period of the input signal by an integer, and is larger than the control period of the vehicle control device 2. For example, 3ms is set as the verification period.

[0087] By making the verification cycle (second cycle) of verification device 3 longer than the control cycle (first cycle) of vehicle control device 2, the software execution load of verification device can be reduced, and the impact on the processing of vehicle control device 2 can be suppressed. Furthermore, as... Figure 4 As shown, by setting the verification period (i.e., the second period) as a value that is smaller than the period of the input signal and is not the period obtained by dividing the period of the input signal by an integer, the input signal used in the verification can be extracted without bias.

[0088] right Figure 4 Please provide a detailed explanation. Figure 4 The diagram shows a specific example of the verification cycle, i.e., the second cycle, and the acquisition of the input signal. Figure 4 The input signal waveform and the input signal value acquired over the verification period are shown. An example of a 50Hz voltage with a maximum input signal value of 100V is shown.

[0089] exist Figure 4In this process, the verification period is 3ms, and the input signal is acquired at verification period times of 3ms, 6ms, 9ms, 12ms, 15ms, 18ms, 21ms, 24ms, 27ms, 30ms, 33ms, 36ms, and 39ms. The voltage values ​​of the input signal at these times are 80.9V, 95.1V, 30.9V, -58.8V, -100.0V, -58.8V, 30.9V, 95.1V, 80.9V, 0.0V, -80.9V, -95.1V, and -30.9V. Therefore, a period smaller than the input signal period, different from the period obtained by dividing the input signal period by an integer, and larger than the first period (which is the control period of the vehicle control device 2) is set as the verification period, i.e., the second period. This avoids synchronizing the timing for acquiring the input signal with the 20ms period of the input signal. Therefore, verification can be performed without deviations such as the input signal value used in verification repeating the same value every 20ms. This can help improve verification efficiency.

[0090] In addition, in Embodiment 1, a verification period of 3ms is shown. However, the verification period is not limited to 3ms. It can be any period that is less than the period of the input signal and different from the period obtained by dividing the period of the input signal by an integer, and is larger than the control period of the vehicle control device 2.

[0091] <Verification Action Flow>

[0092] The process of the verification actions performed by the verification device 3 is explained. Figure 5 This is a flowchart illustrating the process of verification operations in the verification device 3 of Embodiment 1.

[0093] Figure 5 The flowchart, for example, is executed every 50 μs. Processing begins at step S101, and in step S102, it is confirmed whether a verification end flag has been set. If the verification end flag has been set, verification is not required, so proceed to step S199 and end the process.

[0094] If no verification end flag is set in step S102, proceed to step S110. In step S110, it is determined whether the set verification period has elapsed and the verification period timing has been reached (for example, 3ms has elapsed since the last execution). The verification period is set by the verification period setting unit 19. If the verification period timing has not been reached in step S110, the process ends in step S199.

[0095] If the verification cycle time has expired in step S110, proceed to step S120. In step S120, the input signal detected by the sensor unit 11 is acquired.

[0096] After step S120, in step S130, the second program processing unit 16 executes the current program read from the program recording unit 14 based on the input signal detected by the sensor unit 11. Then, the third program processing unit 17 executes the new program read from the new program recording unit 15 based on the input signal detected by the sensor unit 11, and proceeds to step S140.

[0097] In step S140, the comparison and determination unit 18 obtains the processing results of the current program and the new program. In the next step S150, based on pre-stored information about specification changes in the new program, the comparison and determination unit 18 extracts a first output portion from the output of the new program, excluding the output affected by the specification change. Then, it extracts a second output portion corresponding to the first output portion from the output of the current program. Next, it proceeds to step S160.

[0098] In step S160, the comparison determination unit 18 compares the second output portion and the first output portion to determine their similarity. If they are determined to be the same, the process proceeds to step S170; if they are determined to be different, the process proceeds to step S180.

[0099] In step S170, since the second output part is the same as the first output part, only the information "the processing result is the same" is saved to the verification record part 20, and the process proceeds to step S190.

[0100] In step S180, since the second output section and the first output section are different, the information that "the processing results are different", the record number (record consecutive number) under different conditions, the processing results of the current program and the new program respectively, and the information of the input signals used in the processing are saved to the verification record section 20 and the process proceeds to step 190.

[0101] In step S190, it is determined whether the verification has ended. If it is determined that verification should continue, the process proceeds to step S192, the verification end flag is cleared, and the process ends in step S199. During the period of clearing the verification end flag, the verification operation continues at the set verification cycle.

[0102] If the verification is deemed complete in step S190, the process proceeds to step S191, where a verification completion flag is set, and the process ends in step S199. Thus, no verification action will be performed from the next step. Alternatively, the completion of verification can be determined using a set time, a set number of verification attempts, or an external indicator signal.

[0103] Through the above steps, verification can be performed in the second cycle determined by the verification cycle setting unit 19. While the vehicle control device 2 performs normal processing, the verification device 3 can be used to perform regression testing on the output portion of the new program that is not affected by specification changes, and the results can be accumulated.

[0104] In Implementation Method 1, the verification device 3 is installed on the vehicle-mounted unit 1 together with the vehicle-mounted control device 2. Since it uses input information acquired during actual vehicle control to compare the processing results generated by the parallel processing of the current program and the new program, verification can be performed without the need to prepare input data. Furthermore, by setting the verification cycle of the verification device 3 to be longer than the control cycle of the vehicle-mounted control device 2, the software execution load of the verification device 3 can be reduced, avoiding insufficient processing performance of the vehicle-mounted unit 1's processing unit 90. Regression testing can be easily performed without affecting the operation of the vehicle-mounted control device in the current program.

[0105] 2. Implementation Method 2

[0106] In Embodiment 1, it was explained that by extending the verification execution cycle of the verification device 3, the software execution load of the verification device 3 is reduced, thereby avoiding insufficient processing performance of the computing processing unit 90 of the vehicle-mounted unit 1. In Embodiment 2, while extending the execution cycle of the entire verification process of the verification device 3, the verification process is subdivided and executed, shortening the occupancy period of the computing processing unit 90 during the execution of each part, thereby reducing the software execution load. This method is illustrated using a flowchart.

[0107] Figure 6 This is a first flowchart illustrating the processing of the verification device 3 involved in Embodiment 2. Figure 7 This is a second flowchart illustrating the processing of the verification device 3 involved in Embodiment 2. Figure 8 This is a third flowchart illustrating the processing of the verification device 3 involved in Embodiment 2. Figure 9 This is a fourth flowchart illustrating the processing of the verification device 3 involved in Embodiment 2. Figure 10 This is a fifth flowchart illustrating the processing of the verification device 3 involved in Embodiment 2. Figure 11 This is a sixth flowchart illustrating the processing of the verification device 3 involved in Embodiment 2. Figure 12 This is the seventh flowchart used to explain the processing of the verification device 3 involved in Embodiment 2. Figure 13 This is the eighth flowchart used to explain the processing of the verification device 3 involved in Embodiment 2.

[0108] In Embodiment 2, a structure is described in which the current program is divided into three parts, each being one-third, and can be executed sequentially. Similarly, a structure is described in which a new program is divided into three parts, each being one-third, and can be executed sequentially. Therefore, by adopting a structure that allows for segmented execution, the time for exclusive use of the processing unit 90 can be shortened, and by executing sequentially, the software execution load of the processing unit 90 can be reduced. Particularly when a single processing unit 90 controls both the vehicle control unit 2 and the verification unit 3, shortening the exclusive use period of the processing unit 90 of the verification unit 3 is advantageous in preventing interference with the control of the vehicle control unit 2 and ensuring the control performance of the vehicle control unit 2, especially when the control cycle of the vehicle equipment of the vehicle control unit 2 is short.

[0109] In Implementation 2, a regression test is performed by dividing the program into seven parts, in which the verification device 3 compares the outputs of the current program and the new program. The number of divisions is not limited to seven.

[0110] Figure 6 The process for determining which part of the segmented program to execute the verification process is shown. The process starting in step S201 is executed, for example, every 50 μs. In step S202, it is determined whether it is time for the segmentation process. In step S202, it is determined whether a set segmentation process period (e.g., 0.4 ms) has elapsed and it is time for the segmentation process of executing the segmented program. The segmentation process period is set by the verification period setting unit 19. The overall period for executing the segmented process of the verification program is the second period. Here, the 7 parts are executed one at a time of 0.4 ms, so the overall period is 2.8 ms, which is the second period.

[0111] If the segmentation processing time has not yet expired in step S202, the process ends in step S209. If the segmentation processing time has expired in step S202, in step S203, the execution counter performs an addition operation (increments by 1). The execution counter counts the number of which part of the program to be subdivided is being executed. Figure 6 In this case, the counter can take values ​​from 1 to 7.

[0112] After step S203, proceed to step S204 to check if the execution counter is greater than 7. Greater than 7 means the counter reached 8 in step S203. If the counter is greater than 7, set the execution counter to 1 in step S205 and proceed to step S206. If the execution counter is less than 7 in step S204, proceed directly to step S206.

[0113] In step S206, the next step is determined according to the execution counter number. When the execution counter is 1, proceed to step S251 as shown in (1). When the execution counter is 2, proceed to step S301 as shown in (2). When the execution counter is 3, proceed to step S401 as shown in (3). When the execution counter is 4, proceed to step S501 as shown in (4). When the execution counter is 5, proceed to step S601 as shown in (5). When the execution counter is 6, proceed to step S701 as shown in (6). When the execution counter is 7, proceed to step S801 as shown in (7).

[0114] Figure 7 The flowchart shows the case where the execution counter is 1. When... Figure 6 In step S206, if the execution counter is 1, proceed to step S251. After step S251, in step S253, the input signal detected by the sensor unit 11 is acquired.

[0115] After step S253, in step S254, based on the input signal detected by the sensor unit 11, the second program processing unit 16 executes the first part of the current program read from the program recording unit 14 after it has been divided into three parts. Then, the processing ends in step S259.

[0116] Figure 8 The flowchart shows the case where the execution counter is 2. When in... Figure 6 In step S206, when the execution counter is 2, the process proceeds to step S301. After step S301, in step S303, the second program processing unit 16 executes the second part of the current program after it has been divided into three parts. Then, the process ends in step S309.

[0117] Figure 9 The flowchart shows the case where the execution counter is 3. When... Figure 6 In step S206, when the execution counter reaches 3, the process proceeds to step S401. After step S401, in step S403, the second program processing unit 16 executes the third part of the current program after it has been divided into three parts. Then, in step S404, the processing result is saved to the verification record unit 20. Finally, in step S409, the processing ends.

[0118] Figure 10 The flowchart shows the case where the execution counter is 4. When in... Figure 6 In step S206, when the execution counter is 4, the process proceeds to step S501. After step S501, in step S503, based on the input signal detected by the sensor unit 11, the third program processing unit 17 executes the first part of the new program read from the new program recording unit 15 after it has been divided into three parts. Then, the process ends in step S509.

[0119] Figure 11 The flowchart shows the case where the execution counter is 5. When... Figure 6 In step S206, when the execution counter reaches 5, the process proceeds to step S601. After step S601, in step S603, the third program processing unit 17 executes the second part of the new program after it has been divided into three parts. Then, the process ends in step S609.

[0120] Figure 12 The flowchart shows the case where the execution counter is 6. When... Figure 6 In step S206, when the execution counter reaches 6, the process proceeds to step S701. Following step S701, in step S703, the third part of the new program, after being divided into three parts, is executed by the third program processing unit 17. Then, in step S704, the processing result is saved to the verification record unit 20. Finally, in step S709, the processing ends.

[0121] Figure 13 The flowchart shows the case where the execution counter is 7. When in... Figure 6 In step S206, when the execution counter is 7, proceed to step S801. After step S801, in step S802, the comparison and determination unit 18 obtains the processing results of the current program and the new program from the verification record unit 20.

[0122] In the next step S803, the comparison determination unit 18 extracts a first output portion from the output of the new program, excluding the output affected by the specification change, based on pre-stored information about the specification change of the new program. Then, it extracts a second output portion corresponding to the first output portion from the output of the current program. Next, it proceeds to step S804.

[0123] In step S804, the comparison determination unit 18 compares the second output portion and the first output portion to determine their similarity. If they are determined to be the same, the process proceeds to step S807; if they are determined to be different, the process proceeds to step S805.

[0124] In step S807, the second output part is the same as the first output part, so only the information "the processing result is the same" is saved to the verification record part 20, and the processing ends in step S809.

[0125] In step S805, the second output portion and the first output portion are different, so the information "processing results are different" is stored in the verification record unit 20. Then, in step S806, the record number (record consecutive number) of the different cases, the processing results of the current program and the new program respectively, and the information of the input signals used in the processing are stored in the verification record unit 20, and the processing ends in step S809.

[0126] As described above, the implementation method 1 is explained. Figure 5 The flowchart shows the processing steps of Implementation 2, where the program is divided into 7 parts for execution. By dividing the execution in this way, the execution time of the program in one run can be shortened. By shortening the time occupied by the computing processing unit 90, the computing processing unit 90 can quickly handle higher priority processing, which is of great significance. Here, one segment is executed every 0.4 ms, and the entire process is executed every 2.8 ms. The verification cycle setting unit 19 can set the time interval for executing the entire verification process as the verification cycle, i.e., the second cycle.

[0127] exist Figures 6 to 13 In the flowchart, for the sake of simplicity, the determination of the end of verification, the setting and clearing of the end of verification flag are omitted, but this process can be added.

[0128] In Embodiment 2, the explanation of setting the second period corresponding to the period of the input signal is omitted, but it can be handled in the same way as in Embodiment 1. Furthermore, the relationship between the first period and the second period is also the same.

[0129] In Embodiment 2, a method is described that the verification process executed by the verification device 3 is subdivided for execution, and the occupation period of the computing processing device 90 is shortened during the execution of each part, thereby reducing the software execution load. Besides subdividing the verification process in the verification device 3 and staggering its timing, the same effect can be achieved even if the verification process is executed with the usual priority and the control process of the vehicle control device 2 is executed during interrupt processing. While the verification process is executed during normal processing, the control process of the vehicle control device 2 can be executed without delay at the necessary timing through interrupt processing. Therefore, by making the implementation cycle of the verification process, i.e., the second cycle, longer than the control cycle, i.e., the first cycle, the overall software execution load of the computing processing device 90 can be reduced.

[0130] While this application describes various exemplary embodiments and examples, the various features, methods, and functions described in one or more embodiments are not limited to the application of a particular embodiment and can be applied to the embodiments individually or in various combinations. Therefore, it can be considered that numerous modifications not illustrated are also included within the scope of the technology disclosed in this application. For example, this includes cases where at least one constituent element is modified, added to, or omitted, and cases where at least one constituent element is extracted and combined with constituent elements of other embodiments.

[0131] Label Explanation

[0132] 1. Onboard unit, 2. Onboard control device, 3. Verification device, 11. Sensor unit, 12. First program processing unit, 13. Actuator unit, 14. Program recording unit, 15. New program recording unit, 16. Second program processing unit, 17. Third program processing unit, 18. Comparison and judgment unit, 19. Verification cycle setting unit, 20. Verification recording unit.

Claims

1. A verification device, which is a verification device for an on-board control device, the on-board control device comprising: Sensors section; A program record section that records the current program used for controlling onboard equipment; as well as The system receives a signal output from the sensor unit, executes the current program read from the program recording unit based on the signal, and outputs the processing result to the first program processing unit of the vehicle-mounted device. The verification device is characterized in that it includes: A second program processing unit receives the signal output by the sensor unit, executes the same program as the current program based on the signal, and outputs the processing result. A third program processing unit takes the signal output by the sensor unit as input, executes a new program based on the signal after specification changes to the current program, and outputs the processing result. A comparison determination unit compares the first output portion of the output of the third program processing unit (excluding the output affected by the specification change) with the second output portion of the output of the second program processing unit corresponding to the first output portion, and determines their similarity; and A verification cycle setting unit is configured to set a second cycle, which is an additional cycle preceding the first cycle in which the current program is executed by the first program processing unit. The second program processing unit executes the current program in the second cycle, and the third program processing unit executes the new program in the second cycle.

2. The verification device as described in claim 1, characterized in that, The verification device includes: The second program processing unit takes the signal output by the sensor unit as input, executes the current program read from the program recording unit based on the signal, and outputs the processing result. The storage unit contains a new program record section for the new program after the specification changes have been made to the current program; and The third program processing unit takes the signal output by the sensor unit as input, executes the new program read from the new program recording unit based on the signal, and outputs the processing result.

3. The verification device as described in claim 1, characterized in that, The verification cycle setting unit sets the second cycle based on the software execution load of the verification device.

4. The verification device as described in claim 1, characterized in that, When the signal output by the sensor unit is a periodic signal, the verification period setting unit sets a second period based on the period of the signal from the sensor unit.

5. The verification device as described in claim 4, characterized in that, The verification period setting unit sets the second period to a value that is shorter than the period of the signal output by the sensor unit and different from the period obtained by dividing the period by an integer.

6. The verification apparatus as described in any one of claims 1 to 5, characterized in that, The verification cycle setting unit sets the second cycle to a value that is different from an integer multiple of the first cycle.

7. The verification apparatus as described in any one of claims 1 to 5, characterized in that, When the comparison determination unit makes a negative identity determination, the verification device saves the processing result of the second program processing unit, the processing result of the third program processing unit, and the input of the sensor signal to the verification record unit.

Images