Simulation device for electronic control devices

Abstract

To provide a simulation device of an electric control device capable of carrying out tests of a software behavior on a general-purpose computer and operation in the event of an abnormality even if the software becomes larger and more complex, and capable of improving software development efficiency.SOLUTION: A general-purpose computer for test executions comprises: an application unit including multiple applications with different safety integrity requirements; a load control unit to terminate one of the operations of the multiple applications and to ensure the operations of the other applications in a prescribed case; a memory operation unit to detect an illegal access by the multiple applications to execute a prescribed procedure; and a protective function unit to realize a protective function related to the multiple applications. The general-purpose computer for test executions comprises a scenario management unit to manage a test scenario, a test instruction unit to instruct the test based on the scenario, and a data control unit to generate the test data based on the instruction content.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a simulation device for an automobile electronic control unit (ECU: Electronic Control Unit). [Background technology]

[0002] When developing software for an automobile's ECU and verifying its functions, the software is usually debugged on a general-purpose computer. However, as automobile ECU software becomes more complex and larger in scale due to the advancement of autonomous driving, debugging takes a lot of time when verifying software on an electronic control unit.

[0003] In addition, when debugging software in an electronic control device, it is necessary to use specific equipment, and there are limitations to the debugging means, so it is not easy to perform the intended verification, and the verification takes time. In particular, when testing an abnormal system, it is necessary to inject an error into the electronic control device to check its operation, but due to the above-mentioned issues, development takes time.

[0004] Thus, the efficient verification of autonomous driving software, which is becoming increasingly complex and large-scale, is becoming an issue. Patent Document 1 proposes a method for simulating software in an electronic control device. Specifically, this document proposes a method for simulating the circuit elements to be verified on a general-purpose computer when verifying the circuit elements in an electronic control device.

[0005] When developing software for autonomous driving that integrates object information output from multiple sensors and estimates the vehicle's driving path, a program is created on a general-purpose computer, then compiled, and the executable file is transferred to an electronic control unit to verify operation. At this time, a dedicated debugging tool is used to check the memory information and output information in the electronic control unit. However, the electronic control unit has many constraints on timing, memory access, etc., and debugging cannot be performed efficiently. In addition, as mentioned above, the use of a dedicated debugging tool also affects development costs. Furthermore, as autonomous driving software becomes larger and more complex, debugging in the electronic control unit becomes increasingly difficult.

[0006] In addition, when verifying software behavior when an error occurs, for example, it is necessary to periodically observe the status of multiple different CPU (Central Processing Unit) cores and processes, making the debugging process itself complicated and making it difficult to proceed with debugging easily. In particular, it takes time to confirm the behavior of software when an error is injected.

[0007] Although a method for simulating the circuit elements of an electronic control device has been proposed, such as in Patent Document 1, the simulation target is limited to the circuit elements, and such a configuration does not easily reproduce abnormal states of the software. [Prior art documents] [Patent documents]

[0008] [Patent Document 1] JP 2020-86701 A Summary of the Invention [Problem to be solved by the invention]

[0009] The present invention provides a simulation device for an electronic control device that can test the behavior of software and its operation under abnormal conditions on a general-purpose computer even when the software is large-scale and complex, thereby improving the efficiency of software development. [Means for solving the problem]

[0010] The simulation device for a vehicle control device according to the present invention is a simulation device that simulates the operation of a vehicle control device on a general-purpose computer, and includes a test execution general-purpose computer that executes a test, and a test control general-purpose computer that controls the test. The test execution general-purpose computer includes an application unit including a plurality of applications with different security requirements, a load control unit that terminates one of the operations of the plurality of applications and ensures the operation of the other applications in a predetermined case, a memory operation unit that detects unauthorized access by the plurality of applications and executes a predetermined process, and a protection function unit that realizes a protection function related to the plurality of applications. The test control general-purpose computer includes a scenario management unit that manages a test scenario, a test instruction unit that instructs the test based on the scenario, and a data control unit that generates test data based on the contents of the instruction. The test data is transmitted from the test control general-purpose computer at an arbitrary timing, and the test execution general-purpose computer checks the operation of the protection function in the protection function unit according to the test data. Effect of the Invention

[0011] According to the present invention, it is possible to provide a simulation device for an electronic control device that can test the operation of software and its operation under abnormal conditions on a general-purpose computer even when the software becomes large-scale and complex, thereby improving the efficiency of software development. [Brief description of the drawings]

[0012] [Figure 1] 1 is a block diagram illustrating a simulation device for an electronic control device according to an embodiment; [Diagram 2] 1 shows an example of a configuration for a time protection test. [Diagram 3] 13 is a flowchart showing a processing procedure for a time protection test. [Figure 4] 1 illustrates an example of a configuration for a memory protection test. [Diagram 5] 13 is a flowchart showing a processing procedure of a memory protection test. [Figure 6] 1 shows an example of a data protection test configuration. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] Hereinafter, the present embodiment will be described with reference to the accompanying drawings. In the accompanying drawings, functionally identical elements may be indicated by the same numbers. Note that the accompanying drawings show embodiments and implementation examples according to the principles of the present disclosure, but these are for understanding the present disclosure and are not to be used to interpret the present disclosure in a limiting manner. The description in this specification is merely a typical example and does not limit the scope or application of the present disclosure in any sense.

[0014] In the present embodiment, the description is given in sufficient detail for a person skilled in the art to implement the present disclosure, but it should be understood that other implementations and forms are possible, and that changes in configuration and structure and substitutions of various elements are possible without departing from the scope and spirit of the technical ideas of the present disclosure. Therefore, the following description should not be interpreted as being limited thereto.

[0015] A simulation device for an electronic control unit according to an embodiment will be described with reference to the block diagram of Fig. 1. This simulation device includes a test execution general-purpose computer 100 for performing a simulation, and a test control general-purpose computer 120 for controlling the simulation. The test execution general-purpose computer 100 is a device that executes a simulation of the operation of an electronic control unit, and the test control general-purpose computer 120 is a device that sends various instructions to the test execution general-purpose computer 100 for executing a simulation of the operation.

[0016] The test execution general-purpose computer 100 and the test control general-purpose computer 120 may be configured as separate general-purpose computers, or the test execution general-purpose computer 100 and the test control general-purpose computer 120 may be realized in one general-purpose computer. Although there are no special restrictions, the test execution general-purpose computer 100 and the test control general-purpose computer 120 are assumed to be configured to include storage areas such as a CPU (Central Processing Unit) and a RAM (Random Access Memory).

[0017] The test execution general-purpose computer 100 includes CPU simulation units 101 and 102, a test control unit 103, and an operating system (OS) 104.

[0018] The CPU simulation units 101 and 102 are each configured to be capable of simulating one CPU in an electronic control unit (ECU). The CPU simulation unit 101 is configured to simulate one CPU, and the CPU simulation unit 102 is configured to simulate another CPU. The test execution general-purpose computer 100 is provided with a plurality of CPU simulation units, thereby making it possible to asynchronously simulate CPUs in a plurality of ECUs. The illustrated example shows an example in which one test execution general-purpose computer 100 is provided with two CPU simulation units 101 and 102, but this is merely an example and is not limited to this.

[0019] The CPU in the electronic control unit (ECU) is simulated as a process or thread on the general-purpose computer. The operating system 104 installed in the test execution general-purpose computer 100 may be a commercially available operating system.

[0020] The test execution general-purpose computer 100 receives test instruction data transmitted from the test control general-purpose computer 120 via the communication control unit and analyzes the data to determine the test scenario to be performed. A test is performed in the test execution general-purpose computer 100 based on the determined test scenario. The means for transmitting data from the test control general-purpose computer 120 to the test execution general-purpose computer 100 may be CAN communication, Ethernet communication, serial communication, etc., and is not limited to a specific communication method.

[0021] Each of the CPU simulation units (101, 102) is composed of a wrapper unit 113, a middleware unit 114, a time protection unit 115, a memory protection unit 116, a data protection unit 117, an API unit 118, and an application unit 119, for example.

[0022] The wrapper unit 113 has a role of absorbing the differences between an electronic control device and a general-purpose computer. For example, there are differences between the operating system (OS) resources, system calls, and drivers used between an electronic control device and a general-purpose computer. The wrapper unit 113 abstracts these differences and separates the processes to be executed according to the operating environment.

[0023] The middleware unit 114 uses the same source code for both the electronic control device and the general-purpose computer. The middleware unit 114 receives and processes the test data sent from the test control general-purpose computer 120 using the same processing flow as the electronic control device, and stores the results in a buffer in the data management unit. The data management unit manages the data passed from the communication control unit, and transmits and receives data based on instructions from the API unit 118.

[0024] The application unit 119 has, for example, a function for recognizing the surrounding environment of the vehicle, a function for planning a driving route of the vehicle based on the result of the recognition of the vehicle, a function for calculating the control amount of the vehicle, and the like, and acquires necessary information via the API unit 118. In addition, the application unit 119 is composed of a plurality of applications with different safety requirements (for example, a high safety level application unit, a low safety level application unit).

[0025] The API unit 118 mediates data transmission between the middleware unit 114 and the application unit 119. The application unit 119 realizes data transmission with the middleware unit 114 via the API unit 118.

[0026] The time protection unit 115 has a function of checking whether the operation of each application, for example, the operation of a thread, is completed within a predetermined time.

[0027] The memory protection unit 116 has a function of checking whether or not there is any unauthorized access to the memory in each application.

[0028] The data protection unit 117 guarantees the integrity of data. If a message sent from outside has header information, the data protection unit 117 checks the contents of the header information to see if there has been any unauthorized rewriting. If unauthorized rewriting is confirmed, the data protection unit 117 executes a preset process, such as discarding the data.

[0029] The time protection unit 115, the memory protection unit 116, and the data protection unit 117 are one aspect of a protection function unit that realizes protection functions related to multiple applications. The CPU simulation units 101 and 102 may include all of the time protection unit 115, the memory protection unit 116, and the data protection unit 117, or may include only one of them. In addition, protection functions other than the time protection unit 115, the memory protection unit 116, and the data protection unit 117 may be provided.

[0030] Next, the test control unit 103 will be described. As an example, the test control unit 103 includes a load control unit 111 and a memory operation unit 112. When a low-security application unit with a low security requirement cannot complete processing within a predetermined time and affects the operation cycle of a high-security application unit with a high security requirement, the load control unit 111 terminates the low-security application unit and guarantees the operation cycle of the high-security application unit. When an application accesses a memory area to which it is not originally granted access rights, the memory operation unit 112 detects the unauthorized access and executes a predetermined action on the application that has made the unauthorized access.

[0031] The test control general-purpose computer 120 has a test control section 121 and an operating system (OS) 122. The test control section 121 may be composed of, for example, a data control section 123, a test instruction section 124, and a scenario management section 125. The operating system 122 may be different from the operating system 104 of the test execution general-purpose computer 100.

[0032] The test control unit 121 injects instructions for normal operation or test patterns for each abnormality based on the scenario of the scenario management unit 125. The abnormality tests include, for example, a data protection test, a time protection test, and a memory protection test. These tests may be performed individually, or a combination of the three tests may be performed.

[0033] The data control unit 123 generates abnormal data based on a command from the test control unit 121. When testing an abnormal system, the data control unit 123 rewrites the header information of normal data to generate abnormal data and transmits it to the general-purpose computer 100 for test.

[0034] The test instruction unit 124 generates instructions for various tests according to a scenario specified by the scenario management unit 125. The generated instructions are input to the test execution general-purpose computer 100 by the operating systems 122, 104. The scenario management unit 125 manages the scenarios of tests executed by the test execution general-purpose computer 100. Scenarios can be specified in advance by the user, or can be dynamically added or changed by the user.

[0035] 2 shows an example of the configuration of a time protection test executed by the time protection unit 115. A plurality of applications with different safety requirements (high safety application unit, low safety application unit) are arranged in the application unit 119. The high safety application unit 200 with a high safety requirement is, for example, an ASIL application, and the low safety application unit 201 with a low safety requirement is, for example, a QM application. At this time, an error is injected into the QM application. The processing flow at this time is shown in FIG. 3.

[0036] When an instruction to start a time protection test is given by the test control general-purpose computer 120, an abnormal scenario is generated in the scenario management unit 125 (step S11 in FIG. 3), and abnormal data is generated in the data control unit 123 according to this abnormal scenario. At this time, the load control unit 111 of the test execution general-purpose computer 100 raises the execution priority of the thread of the low safety level application unit 201 into which the abnormal data is to be injected (step S12), and issues an instruction to the target low safety level application unit 201 to execute a process that occupies the CPU for a long period of time. As a result, the low safety level application unit 201 occupies the CPU.

[0037] At this time, the time protection unit 115 compares a reference processing time of the low safety level application unit 201 scheduled in advance with the actual processing time. The actual processing time is supplied from a test management thread of the low safety level application unit 201. If the processing time of the low safety level application unit 201 exceeds the reference time, it is determined that a time violation has occurred (step S13), and the time protection unit 115 executes a safety function process implemented in advance. For example, the target low safety level application unit 201 is stopped.

[0038] Fig. 4 shows an example of the configuration of a memory protection test. Applications with different safety requirements (high safety application section, low safety application section) are placed in the application section 119. The high safety application section 200 with a high safety requirement is, for example, an ASIL application, and the low safety application section 201 with a low safety requirement is, for example, a QM application. At this time, an error is injected into the QM application. The processing flow at this time is shown in Fig. 5.

[0039] When the test control general-purpose computer 120 issues an instruction to start a memory protection test, the scenario management unit 125 generates an abnormal scenario (step S21 in FIG. 5), and the data control unit 123 generates abnormal data according to the abnormal scenario. The low safety application unit 201 that has received the memory access violation instruction accesses a memory area to which access is not permitted (step S22). At this time, an access violation signal SIGSEGV is issued by the kernel in response to the illegal memory access (step S23). The memory protection unit 116 checks the issued signal SIGSEGV, and applies a protection function previously implemented to the low safety application unit 201 that caused the illegal memory access violation. The protection function includes, for example, a process stop process for the target application (step S24), etc.

[0040] 6 shows an example of the configuration of a data protection violation. The test instruction unit 124 of the test control general-purpose computer 120 outputs a test instruction for a data protection violation to the data control unit 123 based on the scenario of the scenario management unit 125. The data control unit 123 tampers (changes) the header part of the message to be sent, and sends the tamped message to the test execution general-purpose computer 100. The data protection unit 117 of the test execution general-purpose computer 100 analyzes the header part of the received message, and when it detects tampering with the header part, it applies protection contents implemented in advance, such as discarding the message or notifying the application unit 119.

[0041] As described above, according to the simulation device of this embodiment, even if the software of an electronic control unit (ECU) becomes large-scale and complicated, it is possible to test the behavior of the software and the operation in an abnormal state on a general-purpose computer, thereby improving the efficiency of software development. Specifically, it becomes easy to simulate software time protection violations, memory protection violations, data protection violations, etc. on a general-purpose computer.

[0042] The present invention is not limited to the above-mentioned embodiment, and various modifications are included. For example, the above-mentioned embodiment has been described in detail to clearly explain the present invention, and is not necessarily limited to those having all of the configurations described. In addition, it is possible to replace a part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. In addition, it is possible to add, delete, or replace a part of the configuration of each embodiment with another configuration. [Explanation of symbols]

[0043] 100...General-purpose computers for testing 101, 102...CPU simulation section 103...Test control unit 104…Operating system 111...Load control unit 112…Memory operation unit 113…Rappers 114…Middleware Department 115…Time Protection Department 116…Memory protection unit 117…Data Protection Department 118…API section 119…Application section 120...General-purpose computer for test control 121...Test control unit 122…Operating system 123...Data control section 124...Test Instructions 125…Scenario Management Department 200…High-security application section 201…Low security application section

Claims

1. A simulation device that simulates the operation of a vehicle control device on a general-purpose computer, a general-purpose test execution computer for executing the test; a general-purpose test control computer for controlling the test; Equipped with The test execution general-purpose computer includes: an application section including a plurality of applications each having different safety requirements; a load control unit that, in a predetermined case, terminates an operation of one of the plurality of applications and ensures the operation of the other applications; a memory operation unit that detects unauthorized access by the plurality of applications and executes a predetermined process; a protection function unit that realizes a protection function for the plurality of applications; Equipped with The test control general-purpose computer includes: a scenario management unit that manages test scenarios; a test instruction unit that instructs the test based on the scenario; a data control unit that generates test data based on the content of the instruction; Equipped with Transmitting the test data from the general-purpose test control computer at any timing; confirming operation of the protection function in the protection function unit in accordance with the test data using the general-purpose test computer; The test control general-purpose computer inputs at least one test instruction of a memory protection violation, a data protection violation, and a time protection violation to the test execution general-purpose computer based on the instruction; When carrying out said data protection breach tests, the test instruction unit issues an instruction to the data control unit to change information in a header of the transmission data; the data control unit changes the content of the header based on the content of the instruction, and transmits the changed data to the test execution general-purpose computer to perform an operation test of the protection function unit. A simulation device for a vehicle control device, comprising:

2. When performing said test for time protection violation, The data control unit transmits time protection violation test start information to the test execution general-purpose computer; 2. The simulation device according to claim 1, wherein the test execution general-purpose computer controls the operation of at least one of the plurality of applications in the load control unit to cause the time protection violation, and the protection function unit performs a test to detect the time protection violation.

3. When performing the memory protection violation test, 2. The simulation device according to claim 1, wherein the test execution general-purpose computer instructs at least one of the plurality of applications to cause the memory protection violation to occur by the memory operation unit, and executes a test in which the protection function unit detects the memory protection violation.

Images