Method and Device for the Stimulation of Functions for Controlling Operating Sequence
A method and a device for the stimulation of functions for controlling operating sequences are described, the functions accessing at least one global variable of at least one program for control, wherein at least one stimulation function accessing the at least one global variable via at least one software breakpoint is provided.
The present invention is directed to a method and a device for the stimulation of functions for controlling operating sequences, in particular in a motor vehicle. The present invention is also directed to a corresponding control unit and a corresponding computer for function stimulation and the associated computer program as well as the corresponding computer program product.
BACKGROUND INFORMATIONIn function development of control unit software, in particular in automotive control units for controlling the engine, brakes, transmission, etc., the bypass application is a rapid prototyping method for developing and testing new control unit functions. However, such development of functions is also possible with all other control unit applications, e.g., in the field of automation and machine tools.
Two applications of external control unit bypass, as described in German Published Patent Application No. 101 06 504, for example, and internal control unit bypass applications, as described in German Published Patent Application No. 102 28 610, for example, may be used as development methods here.
German Published Patent Application No. 101 06 504 describes a method and an emulation device for emulating control functions and/or regulating functions of a control unit or a regulating unit of a motor vehicle in particular. For emulation, the functions are transferred to an external emulation computer, a data link being established via a software interface of the emulation computer and a software interface of the control unit/regulating unit before the start of emulation. To greatly accelerate the development and programming of new control/regulating functions of the control unit/regulating unit, it is proposed that the software interfaces should be configured for emulation of different control/regulating functions before the start of emulation without any change in software.
German Published Patent Application No. 102 28 610 describes a method and a device for testing a control program by using at least one bypass function in which the control program is executed together with the at least one bypass function on an electric computing unit. The bypass functions are coupled to preselected interfaces via dynamic links.
Independently of these two methods and devices, interventions in the control unit software are necessary for applicability. Such interventions are referred to with the term bypass breakpoint or software breakpoint. A bypass breakpoint, i.e., software breakpoint, describes exactly the location in a software function where the content of a control unit variable is not described by the software program but instead is described via detours, e.g., via a bypass software function. Software breakpoints are highly individual and in the normal case are not part of a control unit software program because memory resources are used for this.
If a function developer requires a control unit program having software breakpoints, these are incorporated into a program version only after the development department has been commissioned. For this purpose, the software development manually modifies the source code of the corresponding function and, by running a compiler and link, creates a new control unit program which is used explicitly for the prototyping application.
The disadvantage of this method and/or the device as explained in the related art includes the long running time until availability of the rapid prototyping program version. An important factor here is the high technical and administrative cost for the specification and implementation of the software interventions.
According to the information currently available, a comparable method is based on the idea of replacing only the store instructions (write access to a control unit variable) via jump instructions to a subfunction. However, in microcontrollers having a mixed instruction set (16/32-bit CPU instructions), the store instructions may already be 16 bits because addressing is performed indirectly via address registers. These 16-bit instructions cannot be used to call a subfunction because a direct address-oriented call of a subfunction requires a 32-bit jump instruction. Therefore, the method according to the related art is usable only to a limited extent and may be used only with microprocessors having a strict 32-bit instruction set. In other words, when the store instruction has a fixed bit width, flexibility with regard to the function development is greatly restricted here. This is also true when a certain store instruction must not be manipulated at all for other reasons, so that populating in this way via a jump instruction to a subfunction is then not possible at all.
In function development for control unit software as mentioned above, testing of software functions is performed on laboratory vehicles (measurement sites) or via appropriate software testing environments (module test). When performing tests on laboratory vehicles, the control unit inputs are stimulated from the outside by electric signals to thereby observe and measure the corresponding responses of the control unit and the software. In the case of the available software test environments for the module tests, only the software functions to be investigated are considered in a stand-alone operation within the test environment without taking into account feedback effects or cross-coupling with the system as a whole.
SUMMARY OF THE INVENTIONThe object of the present invention is to stimulate software functions in an integrated state within a software program in runtime and to test them and thus overcome the aforementioned problems in the related art.
The present invention is directed to a device and a method for the stimulation of functions for controlling operating sequences, where the functions access at least one global variable of at least one program for control, at least one stimulation function which accesses the at least one global variable via at least one software breakpoint being advantageously provided.
The functions are expediently stimulated within the program during the runtime of the program, in particular in real time within a runtime system.
It is advantageous here that the global variable is assigned a first piece of data information and this first piece of data information is replaced by a second piece of data information corresponding to the new stimulation values.
It is preferably within the scope of the present invention for the stimulation of functions to be accomplished by an internal bypass, with the software breakpoint being accomplished by assigning address information to the global variable, the address information being loaded from a memory means by a load instruction and the address information of the global variable of the load instruction being replaced.
The address information of the global variable is advantageously replaced by the address information of a pointer variable, an initial address of the function being determined from the address information, and the functions for control of operating sequences being replaced by replacing the address information with additional functions.
The software breakpoint may also expediently be accomplished by having the global variable addressed by a store instruction and the store instruction manipulated onto the global variable by replacing the store instruction with a jump instruction and replacing the functions for control of the operating sequences with additional functions by replacing the store instruction with the jump instruction.
The present invention expediently uses “dynamic hooks” of software breakpoints without any changes in source code. The methods described for accomplishing this modify the address information of load instructions, modify the function calls and insert new program codes. These modifications are performed on an existing software program version, e.g., on the basis of targeted HEX code modifications.
It is also advantageous that the address information of the global variable is replaced by the address information of a pointer variable, the address information of the pointer variable being in a reserved memory area, in particular of the memory means in the control unit.
In addition to the modification with respect to the load instructions, in one embodiment a store instruction is advantageously manipulated onto the global variable by replacing the store instruction with a jump instruction. The functions for control of the operating sequences are expediently replaced and/or expanded by replacing the store instruction with the jump instruction through additional functions.
According to the aforementioned device and method, the present invention describes a control unit containing such a device and makes it the object of the present invention along with a computer program suitable for execution of such a method. This computer program is executed on a computer, in particular an application control unit system according to the present invention or an application PC. The computer program according to the present invention may be stored on any machine-readable medium. Such a computer-readable data medium or machine-readable medium may be in particular a diskette, a CD-ROM, a DVD, a memory stick or any other portable memory medium. Likewise, memory media such as ROM, PROM, EPROM, EEPROM or flash memories and volatile RAM memories, etc., are also possible for storage. The choice of memory medium, i.e., the machine-readable medium, is thus not to be regarded as restrictive with respect to the computer program product as the object of the present invention.
Using the present invention, the various rapid prototyping methods, software test methods and data calibration methods are rendered more rapidly usable and more flexible in handling. Thus the software breakpoints are used without tying up software development capacity. This results in a lower technical and administrative complexity on the whole and therefore reduces costs. At the same time, microprocessor types having a mixed instruction set of 16/32-bit CPU instructions, for example, may be supported.
When activating the test sequences, the control unit function to be investigated is advantageously stimulated automatically by the integrated test software within the runtime system.
The advantages of the object according to the present invention also include the fact that for the stimulation of the control unit function, no electric signals need be applied to the control unit from the outside. Another advantage is that the calculated output values of the stimulated control unit function are directly available again to the real time system. Thus, for example, complex control algorithms within the control unit may be investigated and tested in greater detail and developed further if necessary.
BRIEF DESCRIPTION OF THE DRAWINGS
The object described here modifies the address information of load instructions, modifies the content of store instructions, modifies the address information of function calls and adds new program codes. These changes are implemented here in the exemplary embodiment on an existing software program version on the basis of specific hex code modifications.
The various components with regard to the object “dynamic software breakpoint” according to the present invention being explained below are:
-
- Determination of the program points
- Modification of the program points including
- modification of the load/store instructions and
- modification of the function calls
- Creation of additional program code
- Tying in the software breakpoint code
- Segmenting the memory areas and
- Development process for creation of the program code
- Internal bypass
- Software test through the stimulation of functions.
The method described below is based on the use of microcontrollers having a mixed instruction set, in particular 16/32-bit CPU instructions. For example, the TriCore TC17xx microcontroller (RISC/DSP/CPU) from Infineon is the example used here; it is a component of a control unit for controlling operating sequences, in particular in a motor vehicle, e.g., for engine control or for controlling the steering, transmission, brakes, etc.
However, this method may also be used with microprocessors having a non-mixed instruction set, in particular in pure 32-bit microprocessors (RISC processors, e.g., PowerPC/MPC5xx).
Essentially in this method it is assumed that the code generator of the compiler arranges the machine instructions sequentially. This is understood to refer to the sequential arrangement of instructions for loading address information of an indirectly addressed control unit variable, for example, into the corresponding address registers. In contrast, in the case of a directly addressed variable, the address information is in the instruction itself. This is the case with most compilers.
Determination of the Program Points (
The starting point for this is a control unit software program which is available in the form of a hex code file, for example. Additional files may include a data description file (e.g., ASAP) and a linker file (e.g., ELF binary) which supply information about control unit variables and control unit functions.
Using a disassembler software program (e.g., a Windows software program), the hex code file is disassembled. The corresponding addresses of the control unit variables to be bypassed are taken from the data description file or from a reference databank created for the method.
The disassembler program created according to the present invention, e.g., a Windows software program, seeks the corresponding access instructions to the control unit variables (load/store instructions) in the disassembled program code with the assistance of the address information of these variables being sought, which affect the content of the variables.
This disassembler program as a Windows software program is a simulation program which checks the register contents after each assembler instruction. If a store instruction is localized and the content of the loaded address register corresponds to the address value of the control unit being sought or if the memory destination of the store instruction corresponds to the variable address, then this is a source where the content of the control unit variables is modified.
The manner in which the program code is modified at the source depends on the particular type of addressing of the control unit variables.
This is depicted in
Modification of the Program Points (FIGS. 3 Through 8)
First, the load instruction sources and/or the store instruction sources are localized according to different types of addressing and then the control unit function in which the sources are located is determined for these sources, so that all the function calls in the entire program code may be accomplished through function calls of the newly created hook function(s), so that the original function call of the control unit function may take place within the corresponding hook function.
Modification of the Load/Store Instructions
With the microcontroller(s) described here, there are a number of different types of addressing in a wide variety of embodiments. It is possible to minimize this variety.
Four methods which largely cover possible combinations of a write access to global variables are presented below. Other methods of code analysis are conceivable such as relative addressing via previously occupied address registers.
To do so,
Modification of the program points according to method 1 is illustrated in greater detail in
In method 1 the determined load instructions, based on the subsequent store instruction, are replaced by address information of a pointer variable. This pointer variable is generated via a development environment, in particular the DHooks development environment. The address of the pointer variable is in a reserved free area of the memory means, the memory layout for variables. The modified load instructions address the same address register as the original instructions. The difference in the modified load instructions is in the type of addressing of the address register and the address information.
Method 2 is a 32-bit store instruction in conjunction with indirect addressing. The 32-bit store instruction is replaced by an absolute jump instruction jla 512 to a software balcony function (balcony_M2) (see call 520 of the software balcony function). With the jla jump instruction, the jump back address is stored in register a11 (see 521).
In software balcony function 521 mentioned above, the content of address register %axx, by which the control unit variable is addressed, is replaced by the address value of a pointer variable (iB_PtrMsg_xxx). The index of address register %axx and of the previously loaded data register %dxx is identical in software balcony function 521.
When 32-bit store instructions are used for the software breakpoint, additional program code is required for this. This program code, generated in the DHooks development environment, is referred to as a balcony function. The balcony functions include additional initializing, copying and breakpoint mechanisms and are used as software functions to expand the breakpoint functionality. Balcony functions are used for breakpoint methods 2, 3 and 4.
The content of data register %dxx which is used remains unchanged by jump instruction jla. Addressing is then performed via the pointer in the software balcony function and thus the store instruction is diverted to the pointer variable. Store instruction st.x writes data as in the original code.
The sequence then jumps back into control unit function according to 522 via the jump back address stored in address register a11 via an indirect jump.
In method 3 a 32-bit store instruction st.t is used in combination with direct addressing 618 (store instruction having address 610). The 32-bit store instruction is replaced by a 32-bit function call (call balcony_M3, 603) of a software balcony function (balcony_M3, 621) (see 604). Software balcony function 621 includes the query of a breakpoint and the store instruction in the original state. With an activated breakpoint, no store instruction is executed. This variable is thus uncoupled from the control unit function. To do so, call 620 for balcony function 621 is carried out from 612. Jump back 622 to the control unit function takes place via the address of the control unit variable (adr. of ecu variable) 619.
Method 4 uses a 32-bit store instruction st.x (710) in combination with direct addressing (718). The 32-bit store instruction is replaced by a 32-bit jump instruction jla (jla balcony_M4—a). The jump instruction points to software balcony function 1 (balcony_M4—a(), 721) which is called with 720. In software balcony function 1 721, the content of the previously loaded data register %dxx is stored temporarily in a temporary DHook variable (iB_TmpMsg_xxx). Another balcony function (balcony_M4_b(), 724) is called from 721 with 723 via a function “call.” This second software balcony function 2 contains the actual breakpoint as in method 3. Software balcony function 724 contains the query of the breakpoint. When the breakpoint is deactivated, the content of temporary variable iB_TmpMsg_xxx is written back into the control unit variable (see 725). When the breakpoint is active, there is no rewriting. The control unit variable is thus uncoupled from the control unit function. The jump back to the control unit function then takes place via/22.
Modification of Function Calls (
For the localized load/store sources, the control unit function in which the sources are located is determined. This is done using the Windows software program developed for this method; on the basis of the position of the load/store instructions and with the help of reference information, it determines the corresponding beginning and end addresses of the control unit function.
Next, all function calls of the control unit function in the entire program code are replaced by function calls of the newly created hook function.
The original function call of the control unit function is performed within the corresponding hook function.
For reasons of simplicity,
Method for Creating Additional Program Code (
For each control unit function in which there is a breakpoint, a hook function may thus be created and/or is created.
The hook function thus includes the breakpoint mechanism which controls access to a rapid prototyping method via application data. In addition, initialization of pointer variables and function call of the actual control unit function are performed in the hook function if necessary.
Features of the hook functions are described below as a function of the breakpoint methods.
Re Breakpoint Methods 1 and 2:
Before a store instruction to a control unit variable addressed by a pointer may be described appropriately, the pointer variable must be addressed using a variable address. The pointer is initialized in the hook function. If the breakpoint access is not active, the pointer is initialized using the address of the control unit variable. If the breakpoint access is active, the pointer is initialized using the address of a temporary DHooks variable. At this point, write access is diverted to the temporary variable, e.g., in the case of indirect addressing of the control unit variable.
Re Breakpoint Methods 3 and 4:
These two methods involve direct addressing of a control unit variable. No pointers which must be initialized are used here. The hook function includes the mechanism for controlling the software breakpoint and the function call of the original control unit function.
At this point, the balcony function when replaced by a jump instruction as already explained above should be mentioned briefly. This use was explained above in detail. If 32-bit store instructions are used for the software breakpoint, then additional program code is required for this purpose. This program code is generated in the DHooks development environment and is referred to as a balloon function. Balloon functions include additional initialization, copying and breakpoint mechanisms and are used as software functions to expand the breakpoint functionality. Balcony functions are used for breakpoint methods 2, 3 and 4.
Segmenting the Memory Areas (
Dedicated memory areas of the memory means in memory layout S1 of the control unit software program are needed for the breakpoint method. According to
Development Process for Creating the Program Code (
The software breakpoint code is generated automatically via a development environment created for the method and is illustrated again in
- 1. Hex code file (includes the machine code, e.g., in Intel hex or Motorola S19 format)
- 2. Application data description file (includes, for example, addresses and conversion formulas for variables and parameters)
- 3. ELF binary file (linker output file having addresses of functions and variables)
- 4. Program for converting machine code into readable assembler instructions
- 5. Disassembled program code (used as input for the simulator)
- 6. Converter for Providing Program Information
- 7. Reference databank (used to resolve open references)
- 8. User creates selection of variables for breakpoints
- 9. Information about control unit variables to be bypassed
- 10. Program code simulator (reads all opcodes sequentially and checks the register contents)
- 11. Automatically generated source code (includes the program code for the software breakpoints, additional functions and information about the program code points to be modified)
- 12. Software development environment (controls all procedures for generating hex code and the application data)
- 13. Application data for controlling the breakpoints
- 14. Program code+breakpoint code+patch code
- 15. Hex/A2l merge procedure (dynamic hooks components are connected to the original program code)
- 16. Application data description file (includes the project application data and the breakpoint application data)
- 17. Program Version Having Software Breakpoints
Method for Tying in the Software Breakpoint Code
The software breakpoint code is tied in, by a hex-code merge run, for example In this action, the results (hex codes) of the development environment for the dynamic breakpoint method are copied into free areas of the original software program (hex code). The method has a structure similar to that of the internal control unit bypass in which hex code information from two separate software development runs is joined together.
Internal Bypass (
Coupling of the bypass program which includes at least one bypass function is performed by dynamic linking to predetermined interfaces in the control program. In this way, it is possible to access data present in the electronic computer unit during the program sequence of the control program.
A second block 66 gives a table of function pointers containing a number of bypass functions to be activated.
A third block 68 represents bypass services. A fourth block 70 and a fifth block 72 stand for activated bypass functions and a sixth block 74 stands for the control program.
Potential intervention points for the bypass functions are provided in control program 74. This is accomplished by activating a driver layer (bypass services).
Before checking control program 74, the application system loads the bypass functions into the memory of the ECU. References to the bypass functions are then entered by the application system into table 66 of the function pointers.
During the check, i.e., during the sequence of control program 74, bypass services 68 in the ECU decide on the basis of entries in vector table 60 which intervention is active, i.e., which bypass function must be activated and where the reference to the bypass function is stored, as indicated by arrows 76.
If a bypass function for a potential intervention point has been activated, it is retrieved via the reference (dynamic link), represented by arrows 78. Bypass services 68 execute the two active bypass functions 70 and 72 (arrow 80). With activated bypass functions 70 and 72, certain selected data 82 in control program 74 is accessed, as indicated by arrows 84.
In data transmission to bypass functions 70 and 72, the latter access their input variables and parameters (application values) via address references. Bypass functions 70 and 72 thus have read access to all data 82 statically present in the ECU.
The bypass drivers receive a reference to the stimulatable data flow in the data transmission of the control program, i.e., user software 74. In this way the data consistency requirements may be met.
The calculations of the bypass and the intervention into the data flow take place at the point in time when the value is also being calculated in the basic software. Due to the application of these trigger mechanisms and the communication described above, there is no dead time in the signal flow of the bypass function.
Software Test by Stimulation of Functions
The present invention relates to a software test method with which test sequences are generated according to the user's specifications in a test environment by using the methods of dynamic hooks (automatic software breakpoint) and internal bypass (rapid prototyping method) and these test sequences are run within the control unit software. Using the dynamic hooks software breakpoint method, the input variables of the corresponding control unit functions are bypassed. The test description, i.e., the test sequence over time, is generated in a program writing language developed for the method within the development environment created for the method. The source code thereby generated, describing the test sequence, is translated via a compiler and linking procedure into a runnable software program for the target hardware (control unit). The test sequence code is integrated and executed according to the internal bypass method.
Stimulation of Software Functions within a Runtime System (
In investigating a control unit function, the corresponding input quantities (RAM variables) of the software function are bypassed. The bypassed RAM variables are stimulated via the integrated test sequence program in the control unit software. Scheduling for the call of the test sequence code may be specified in the development environment. The bypassed RAM variables are accessed via references.
Stimulation values 95 (inp1s, inp2s, inp3s) and/or their data information are available from the test sequence software, i.e., stimulation functions 94, as a replacement within the context of the breakpoint for the interface variables, i.e., input variables 92, and are blended in on activation of the breakpoints.
Finally, the control unit software 96 itself is shown.
Method for Creating Test Sequence Software (
The test sequence is specified in a test description language developed for the method. In this test sequence, the input variables of the control unit function are brought to defined states. Various combinations of stimuli values, ramps or curves may be specified. The behavior over time is controlled via corresponding software functions within the description language.
E1 identifies the control unit software. E2 shows the test function and information about the interface variables. This also includes the scope of testing and the interface information on the software function or function to be tested or stimulated. E3 shows the bypass selection, i.e., the selection of bypass variables, and thus the software extent of the bypass. The dynamic hooks method is localized in E4 as described previously. The program version having bypassed input variables of the software function to be tested or stimulated, i.e., the control unit program having the software breakpoints, is accommodated in E5.
In E6 the test sequence script is created, i.e., processed; this is the test description of the test sequence using a script language. Code translatable from the test script(s), in particular C code, is created by converter, i.e., code generator, in E7. This generated code, i.e., the test sequence program code, is depicted in E8. Library functions in a library (LIB) for sequence control are shown in E9.
E10 shows the software test development environment for program code creation, i.e., the hex codes and application data. E10 also includes the compiler/linker tool set so that finally the software for the test sequence in the control unit is generated in E10. A distinction is made here between E11, the application data (A2L) for controlling the test sequence and the accesses to variables, and E12, the program code and test sequence code, i.e., the actual test sequence software (HEX).
The merge procedure (A2l-HEX merge procedure) takes place in E13 to generate the project software, having integrated software breakpoints, and the test sequence code.
Finally, this results in the control unit program having the integrated software test sequence. E14 contains the application data description file having the project data, i.e., breakpoint data and the application data for the test sequence control. E15 also contains the finished program version having the software breakpoints and the test sequence code.
It is thus possible according to the present invention through an integrated software test method and the corresponding device to test software functions, i.e., functions for control of operating sequences, in particular in a motor vehicle, within a control unit system during runtime by stimulation of their input variables via corresponding software interventions, i.e., software breakpoints under various operating points.
Claims
1.-15. (canceled)
16. A method for stimulating functions for controlling operating sequences, the functions accessing at least one global variable of at least one program for control, the method comprising:
- providing at least one stimulation function; and
- accessing the at least one global variable via at least one software breakpoint.
17. The method as recited in claim 16, wherein the functions are stimulated within the at least one program during a runtime of the at least one program.
18. The method as recited in claim 16, wherein the functions are stimulated in real time within a runtime system.
19. The method as recited in claim 16, further comprising:
- assigning the at least one global variable a first piece of data information;
- replacing the first piece of data information by a second piece of data information corresponding to new stimulation values.
20. The method as recited in claim 16, further comprising:
- stimulating the functions by an internal bypass.
21. The method as recited in claim 16, wherein:
- the software breakpoint is accomplished by assigning address information to the at least one global variable,
- the address information is loaded from a memory means by a load instruction, and
- the address information of the at least one global variable of the load instruction is replaced.
22. The method as recited in claim 21, further comprising:
- replacing the address information of the at least one global variable by address information of a pointer variable.
23. The method as recited in claim 21, further comprising:
- determining an initial address of the at least one stimulation function from the address information.
24. The method as recited in claim 21, further comprising:
- replacing functions for control of operating sequences by replacing the address information by additional functions.
25. The method as recited in claim 16, wherein:
- the software breakpoint is accomplished by addressing the at least one global variable via a store instruction, and
- the store instruction is manipulated onto the at least one global variable by replacing the store instruction by a jump instruction.
26. The method as recited in claim 25, wherein the functions for controlling the operating sequences by replacing the store instruction by the jump instruction are replaced by additional functions.
27. A device for stimulating functions for controlling operating sequences, the functions accessing at least one global variable of at least one program for control, comprising:
- a first stimulation arrangement for activating at least one stimulation function; and
- a control arrangement for generating at least one software breakpoint, the at least one stimulation function accessing the at least one global variable via the software breakpoint.
28. A control unit, comprising:
- a device for stimulating functions for control of operating sequences, the functions accessing at least one global variable of at least one program for control, the device including: a first stimulation arrangement for activating at least one stimulation function, and a control arrangement for generating at least one software breakpoint, the at least one stimulation function accessing the at least one global variable via the software breakpoint.
29. A computer program product for stimulating functions for controlling operating sequences, the functions accessing at least one global variable of at least one program for control, the product when executed resulting in a performance of:
- providing at least one stimulation function; and
- accessing the at least one global variable via at least one software breakpoint.
30. The computer program product as recited in claim 29, wherein a code of the product is executed on a computer.
Type: Application
Filed: Nov 4, 2004
Publication Date: Sep 13, 2007
Inventor: Martin Watzl (Markgroeningen)
Application Number: 10/578,341
International Classification: G06F 9/44 (20060101);