Method, apparatus and program for testing control program

The present invention relates to a testing method for a control program which is used for controlling a control object, and a testing apparatus and a testing program which are used for testing the control program.

The development of a control program which controls a vehicle engine, etc. for example includes generally the steps of (a) writing (coding) a control program based on design (control) specifications (control model), (b) verifying (debugging) the presence or absence of abnormality in the written control program, (c) debugging and fitting the debugged control program on a real vehicle (on-vehicle check), and (d) further modifying the control program based on the result of the on-vehicle check.

The recent trend of control program development includes the development of a model base having a step of producing automatically a control program which is written in a programming language from a control model which represents requisite specifications. In this model base development, a control model is simulated with existing software on a computer thereby to test the operational fitness of the control model.

The control program produced automatically from such a tested control model is high in completeness, enabling the reduction of correction of control program at the step of the above item (d). Constructing a control model is easier than writing a control program. Accordingly, adopting the model base development also enables to enhance the efficiency of control program development.

An automatically-generated control program can possibly be given newly an execution sequence of processing defined by control model which may not be given inherently to the control model.

On this account, adopting the above model base development will encounter the difficulty in the debugging work for the control program which has been produced automatically from the control model and in the debugging work for testing and modifying the fitness of the control model to be used for the automatic generation of control program. This is attributable to the uncertain consistency in execution sequence between the control model and the control program as described above. When any problem is found in one of the control model and the control program in the debugging work, it will be difficult to determine the spot of the other corresponding to the former problematic spot.

It is therefore an object of the present invention to provide a control program testing method which is capable of testing easily the presence or absence of abnormality in a control program or a control model in the model base development, and a testing apparatus and a testing program which are used for the control program testing.

In order to achieve the object, a control program testing method a control program testing apparatus are designed to produced operation results of simulation which simulates the operation of a control model and operation results of program execution which executes the control program, while making a relational linkage between individual corresponding operation results, and tests the presence or absence of abnormality in at least one of the control model and the control program.

At the testing of the presence or absence of abnormality through the execution of the control program, the control program execution results and corresponding control model simulation results are produced, with the relational linkage being made between them, whereby it becomes possible to test easily the presence or absence of abnormality in the control program or control model.

The above and other objects, features and advantages of the present invention will become more apparent from the following detailed description made with reference to the accompanying drawings. In the drawings: <ul id="ul0001" list-style="none" compact="compact"><li>FIG. 1 is a flowchart showing the process of creation and testing of a control program based on an embodiment of the present invention.</li><li>FIG. 2 is a block diagram showing the arrangement of the system which performs the creation and testing of the control program based on this embodiment.</li><li>FIG. 3 is a block diagram showing an example of control model.</li><li>FIG. 4 is a diagram showing an example of control program which is generated automatically.</li><li>FIG. 5 is a diagram showing an example of correspondence information which indicates the correspondence relationship between the control model and the control program based on this embodiment.</li><li>FIG. 6 is a flowchart showing the procedure of processing for setting break points based on this embodiment.</li><li>FIG. 7 is a flowchart showing the procedure of processing of the simulation section based on this embodiment.</li><li>FIG. 8 is a flowchart showing the procedure of processing of the program execution section based on this embodiment.</li><li>FIG. 9 is a flowchart showing the procedure of processing of the synchronizing section based on this embodiment.</li></ul>

A control program testing method, testing apparatus and testing program of the present invention will be described in detail with reference to an embodiment applied to testing of a vehicle control program.

Referring to FIG. 1, step 101 constructs, by using a requisite specifications writing language, a control model which defines the requisite specifications of a control program which is the object of testing. Next, the constructed control model undergoes the simulation to verify as to whether or not it is correct in function and proper in performance. The control model is modified based on the test result.

Next, step 102 produces automatically a control program, which is written in the C language for example, from the control model. This control program is given newly an execution sequence of processing defined by the control model which is not given inherently depending on the control model.

Step 103 simulates the control model and executes the control program thereby to test the presence or absence of abnormality in the control model or control program, while keeping a correspondence relationship between them. If the control program is determined to have abnormality, it is modified. In case the control model is determined to be improper as a result of testing, the process may be designed to return to step 101 to modify the control model.

On completion of debugging of the control program, step 104 implements the on-vehicle debugging and matching of the control program which is installed in the electronic control unit of the vehicle. In case step 105 determines there are improper or inappropriate portions in the control program revealed by the on-vehicle debugging, the process returns to step 101 to modify the control model, and the processing of step 101 through step 104 are repeated. This series of processing takes place until the control program is determined to be appropriate at step 105.

The debugging work of the step 103 for the control program is described next in detail.

FIG. 2 is a diagram showing the overall arrangement of a system (testing apparatus) which is used for the control program generation and debugging.

In this system, the control model which has been constructed and tested in Step 1 of FIG. 1 is stored in a model storage section 10. FIG. 3 shows schematically an example of a control model.

The control model shown in FIG. 3 is a model which calculates the fuel injection quantity and injection timing of a vehicle engine. Block 1 (B1) is a block which sends a trigger to Block 2 and Block 6 when the crank angle of the engine (not shown) coincides with the specified crank angle. Block 2 is a block which calculates a basic injection quantity by being triggered at the specified crank angle. Block 3 is a block which prompts the writing of the basic injection quantity, which is calculated by the Block 2, to Block 4. Block 4 is a block which stores the basic injection quantity. Block 5 is a block which reads out the stored basic injection quantity. Block 6 is a block which calculates a correction value for the base fuel injection quantity by being triggered at the specified crank angle. Block 7 is a block which calculates the injection timing based on the correction value and the read-out basic injection quantity.

In FIG. 3, the solid-line arrows define the sequence of processing and also show the flow of processed data. Specifically, for example, the order of processing is defined such that the processing of Block 7 takes place after the processing of Block 5 and Block 6. However, the order of processing of Block 2 and Block 6 is not defined. Similarly, the order of processing of Block 3 and Block 5, i.e., writing of basic injection quantity to the memory and readout of it from the memory is not defined. Accordingly, it is conceivable for this model that the processing of Block 5 takes place earlier and the processing of Block 3 takes place later.

In the system shown in FIG. 2, an automatic code generation section (automatic code generation means) 12 is a section which reads the control model, produces the control program written in the C language from the control model, and stores the program in a program storage section 14. The program storage section 14 stores control programs which have been generated by the automatic code generation section 12.

FIG. 4 shows an example of the control program which have been produced automatically from the control model shown in FIG. 3. As shown in FIG. 4, even though the processing for Block 3 of the control model shown in FIG. 3 needs to take place prior to the processing for Block 5, it takes place after the processing for Block 5. This is caused because the control model is not necessarily given inherently the execution sequence of processing indicated by functional blocks, but the execution sequence is given newly by the automatic code generation section 12. Namely, FIG. 4 shows the case where the control model has not been given the execution sequence of the processing of Block 5 and Block 3 and the sequence arrangement by the automatic code generation section 12 does not result in a proper model.

In the system shown in FIG. 2, a correspondence information formation section 16 is a section which forms, at the generation of control program by the automatic code generation section 12, correspondence information which indicates the correspondence relationship between the control model and the control program based on information held by the automatic code generation section 12, and stores the formed information in a correspondence information storage section 18. The correspondence information includes execution position correspondence information indicative of the correspondence relationship between blocks of the control model and execution points of the control program, and variable correspondence information indicative of links of blocks (variables indicated by links among blocks) of the control model and correspondence relationship between storages (storing blocks such as Block 4) and variables of control program.

FIG. 5 shows an example of correspondence information which consists of the execution position correspondence information and variable correspondence information. In the example shown, the execution position correspondence information relates the blocks of the control model to the labels L1-L5 held by the control program. The variable correspondence information relates the block links and storages of the control model to the variables of the control program. These sets of correspondence information are stored in the correspondence information storage section 18 shown in FIG. 2.

In the system shown in FIG. 2, a simulation section (simulation means) 20 is a section which reads the control model from the model storage section 10 and simulates the operation of the model.

In the system shown in FIG. 2, a program execution section (program execution means) 22 is a section which reads a control program from the program storage section 14 and executes the program. This embodiment uses a compiler having a debugger function for the program execution section 22.

In this system, a break point setting section 24 is a section which instructs the simulation section 20 and program execution section 22 to set break points which specify operation suspend points of one of the control model and control program in accordance with the external input. Break points can be set individually for the blocks of the control model. Break points can be set, for example, at individual execution points which are specified by use of the labels L1-L5 of the control program.

In the system shown in FIG. 2, a synchronizing section (synchronizing means) 26 is a section which has a function of setting, when a break point for specifying an operation suspend point has been set to one of the control model and control program through the break point setting section 24, a break point for specifying a corresponding operation suspend point to the other based on the correspondence information. In this embodiment, a break point is set, by using execution position correspondence information among the correspondence information, by searching for an execution point of a corresponding control program from the block of control model or by searching the block of control model from an execution point of control program.

The synchronizing section 26 further includes a comparing section (comparing means) which, when the operation of both the simulation section 20 and program execution section 22 suspend temporarily at break points, compares the operation results of the simulation section 20 and program execution section 22.

In the system shown in FIG. 2, a display section (display means) 28 is a section which displays visually the ordinary operational guidance and a problem of the control model or control program detected as inconsistency in the result of comparison by the comparing section. A result storage section 30 stores the comparison result provided by the comparing section.

The model storage section 10, program storing section 14, correspondence information storage section 18, and result storage section 30 of the system shown in FIG. 2 are formed of a storage unit such as a hard disk unit for example. The automatic code generation section 12, correspondence information formation section 16, simulation section 20, program execution section 22, break point setting section 24, and synchronizing section 26 are formed of a storage unit, e.g., hard disk unit or ROM, which records programs of processing procedure, and a computer.

The processes of control program testing and debugging performed by the system (testing apparatus) are executed as follows.

In this embodiment, the operation result of the simulation section 20 which simulates the control model stored in the model storage section 10 and the operation result of the program execution section 22 which executes the control program stored in the program storage section 14 are synchronized (made relational linkage) through the synchronizing section 26. When the operations of the simulation section 20 and program execution section 22 suspend at the break points, the presence or absence of abnormality in the control model or control program is tested based on comparison between the simulation result and the program execution result by the comparing section. If the control program is found to be problematic as a result of the testing, or if the control model cannot produce a proper control program, the control program or control model is modified.

By comparing the execution result of control program and the simulation result of control model, with a relational linkage being made between them, it becomes possible to determine easily the correspondence relationship between the control program, which can possibly be given an execution sequence of processing defined by the control model which is not given inherently to the control model, and the control model. Consequently, in the model base development, it becomes possible to test easily the presence or absence of abnormality in the control program and the control model.

First, the process of break point setting by the break point setting section 24 and synchronizing section 26 will be described with reference to FIG. 6. FIG. 6 is a flowchart showing the procedure of processing for break point setting by the synchronizing section 26.

In this series of processing, step 301 and step 302 determine as to which of the simulation section 20 or program execution section 22 has a break point been set through the break point setting section 24. Specifically, the synchronizing section 26 makes access to the simulation section 20 and program execution section 22 to determine the setting of break point.

On finding the setting of break point in step 301, the process proceeds to step 303. This step 303 determines, based on the execution position correspondence information, the position in the control program corresponding to the break point which has been set on the control model, and instructs the program execution section 22 to set a break point at the determined position in the control program.

If step 302 determines the setting of break point in step 302, the process proceeds to step 304. This step 304 determines, based on the execution position correspondence information, the position on the control model corresponding to the break point which has been set in the control program, and instructs the simulation section 20 to set a break point at the determined position on the control model.

In the case of ending of the processing of step 303 or step 304 or in the case of determination that a break point has not been set in step 302, the series of processing are terminated. Instead of repeating this series of processing at certain intervals, it is more preferable to implement the processing in response to the input of control model to the simulation section 20 and the input of control program to the program execution section 22.

In the case of the control model shown in FIG. 3, break points should be set individually to the Block 3 and Block 5 for example. Alternatively, a break point may be set only to Block 7 which is the final output stage.

Next, the process of control model simulation by the simulation section 20 will be described with reference to FIG. 7. FIG. 7 is a flowchart showing the procedure of processing for the simulation of control model.

In this series of processing, step 311 reads a control model which is stored in the model storage section 10. Next, step 312 and step 313 set break points at certain positions on the control model. Specifically, the step 312 and step 313 either set a break point in response to the instruction by the break point setting section 24 or set a break point in response to the instruction by the synchronizing section 26 in the process shown in FIG. 6.

The subsequent step 314 determines as to whether or not the execution of simulation is instructed by the synchronizing section 26. On detecting the instruction of execution in step 314, step 315 implements the simulation of control model. This simulation takes place such that pseudo-data for sensor signals for example is given to the simulation section 20, and it processes the data in accordance with the control model.

The simulation takes place until the whole control model is simulated (step 316), or until a break point is detected (step 317). On detecting a break point in step 317, the simulation is suspended, and step 318 indicates the suspend of simulation to the outside through the display section 28 or an output device such as an indicator equipped on the simulation section 20.

When the simulation suspends at a break point, the system waits for the instruction of another execution from the synchronizing section 26 (step 314), or an abnormality indication from the synchronizing section 26 (step 319). With another execution being instructed, the control model simulation is resumed by implementing the processing of step 315 and following steps.

In the case of abnormality indication from the synchronizing section 26 in step 319, this series of processing are terminated. At this time, the simulation section 20 holds information on the suspend point at the time of abnormality indication. It is preferably released to the outside through the display section 28 or an output device such as a display device equipped on the simulation section 20. Furthermore, in case there is an abnormality indication from the synchronizing section 26, the system may be designed to store the abnormality information in the result storage section 30 (FIG. 2) and wait for the instruction of execution from the synchronizing section 26 at step 314 (refer to the dashed line of FIG. 7).

In case this abnormality information pertains to a variable, the system may be designed to alter the variable value which has been calculated by the simulation. Specifically, the variable value calculated by the simulation is altered so that the simulation condition of control model and the execution condition of control program are made equal again, and the process is brought back to step 314 for waiting.

In case step 316 determines that the whole control model is finished, step 320 indicates the end of simulation to the outside through the display section 28 or an output device such as an indicator equipped on the simulation section 20, and this series of processing are terminated.

Next, the process of control program execution by the program execution section 22 will be described with reference to FIG. 8. FIG. 8 is a flowchart showing the procedure of processing for the execution of control program.

In this series of processing, step 331 reads a control program which is stored in the program storage section 14. Next, step 332 and step 333 set break points at certain positions in the control program. Specifically, the step 332 and step 333 either set a break point in response to the instruction by the break point setting section 24 or set a break point in response to the instruction by the synchronizing section 26 in the process shown in FIG. 6.

The subsequent step 334 determines as to whether or not the execution of control program is instructed by the synchronizing section 26. On detecting the instruction of execution in step 334, step 335 executes the control program. This control program execution also takes place such that pseudo-data for sensor signals for example is given to the program execution section 22, and it processes the data in accordance with the control program.

The program execution takes place until the whole control program is finished (step 336), or until a break point is detected (step 337). On detecting a break point in step 337, the control program execution is suspended, and step 338 indicates the suspend of program execution to the outside through the display section 28 or an output device such as an indicator equipped on the program execution section 22.

When the control program execution suspends at a break point, the system waits for the instruction of another execution from the synchronizing section 26 (step 334), or an abnormality indication from the synchronizing section 26 (step 339). With another execution being instructed, the control program execution is resumed by implementing the processing of step 335.

In the case of abnormality indication from the synchronizing section 26 in step 339, this series of processing are terminated. At this time, the program execution section 22 holds information on the suspend point at the time of abnormality indication. It is preferably released to the outside through the display section 28 or an output device such as a display device equipped on the program execution section 22. Furthermore, in case there is an abnormality indication from the synchronizing section 26, the system may be designed to store the abnormality information in the result storage section 30 (FIG. 2) and wait for the instruction of execution from the synchronizing section 26 at step 334 (refer to the dashed line of FIG. 8).

In case this abnormality information pertains to a variable, the system may be designed to alter the variable value which has been calculated by the control program execution. Namely, the variable value calculated by the program execution is altered so that the simulation condition of control model and the execution condition of control program are made equal again, and the process is brought back to step 334 for waiting.

In case step 336 makes a determination of the completion of execution of the whole control program, step 340 indicates the end of control program execution to the outside through the display section 28 or an output device such as an indicator equipped on the program execution section 22, and this series of processing are terminated.

Next, the process for detecting the presence or absence of abnormality in the control model and control program implemented by the synchronizing section 26 will be described with reference to FIG. 9. FIG. 9 is a flowchart showing the procedure of processing of this testing. This process takes place on condition that the process shown in FIG. 6 has ended, namely, on condition that break points have been set on the control model and in the control program.

In this series of processing, step 351 instructs the simulation section 20 to simulate the control model and instructs the program execution section 22 to execute the control program. The simulation of control model and the execution of control program take place until the control model is suspended by the simulation section 20 and the control program is suspended by the program execution section 22. The control model and control program are given the same input data (initial values) so that the simulation of control model and the execution of control program take place in the same condition.

If step 352 determines that both the control model and control program have suspended and step 353 determines that the executions of the model and program have not yet completed, the processing of step 354 and following step to test the presence or absence of abnormality in the control model and control program.

Specifically, step 354 checks based on the execution position correspondence information as to whether or not the suspend point of control model and the suspend point of control program are correspondent positions. On determining their positions to be not in correspondence with each other (step 355), step 356 indicates through the display section 28 that the suspend points of the control model and control program are not consistent ("abnormal suspend points").

When step 355 determines the suspend points to be the same or consistent, the process proceeds to the processing of step 357. This step 357 determines based on the variable correspondence information as to whether or not the value of block link or storage (variable value) at the suspend point of the control model and the variable value held at the suspend point of the control program are in correspondence with each other. If their values are determined to be not in correspondence with each other (step 358), step 359 indicates through the display section 28 that the value of block link or storage of the control model and variable value of the control program are not in correspondence with each other ("abnormal variable value").

Determination as to whether or not the value of block link or storage of the control model and the variable value of the control program are in correspondence with each other is based on determination as to whether or not the difference between these values is within the allowable range which has been determined in advance. For example, in case the value of block link or storage of the control model and the variable value of the control program are both values resulting from integer calculation, only their equality is accepted to be within the allowable range. In case the value of block link or storage of the control model and the variable value of the control program are both values of floating point type, their difference in absolute value smaller than a prescribed value is accepted to be within the allowable range.

When the variable values are determined to be within the allowable range in step 358, the process returns to step 351 to resume the simulation of control model and the execution of control program. When step 353 determines that the whole control model and control program have been finished, step 360 indicates the affair ("end of whole model and program").

On completion of processing of the step 356, step 359 and step 360, this series of processing are terminated. Alternatively, when the finish of the whole control model and control program is determined at the step 353, the processing of step 357, etc. may be implemented prior to shifting to the processing of step 360.

This embodiment is designed to determine with the synchronizing section 26 (comparing section) as to whether or not the suspend point of control model and the suspend point of control program are in correspondence with each other. Consequently, when the control program generated by the automatic code generation section 12 is given newly an execution sequence for multiple processing defined by the control model, it is possible to detect the improperness of the sequence.

In case the processing sequence is erroneous or in case the generated control program itself is erroneous, the difference of variable values can be detected by the process of FIG. 9.

According to this embodiment, when a problem is detected in the debugging work of control program, it is possible to make automatically a relational linkage with the position of control model and processing state (block link and storage) of control model.

As a result of debugging of the control program by the work described above, i.e., the processing of step 3 shown in FIG. 1, when the control program is determined to be proper, the control program is stored on a ROM (Read Only Memory) or the like, and the ROM is mounted on the electronic control unit. Subsequently, the control program installed in the electronic control unit undergoes the processing of Step 4 (FIG. 1), i.e., debugging and fitting on a real vehicle, and if the control program is determined to have abnormality, correction of the control program or control model will take place as written previously.

As described above in detail, this embodiment achieves the following advantages. <ul id="ul0002" list-style="none" compact="compact"><li>(1) When a control program undergoes the testing of the presence or absence of abnormality by being executed with the program execution section 22, the program execution is synchronized with the simulation of control model, whereby the state of simulation of the control model and the state of execution of the control program can readily be compared.</li><li>(2) By using correspondence information produced by the correspondence information formation section 16, it is possible to make properly the correspondence between the spot of simulation of control model by the simulation section 20 and the spot of execution of control program by the program execution section 22.</li><li>(3) When break points are set to one of the control model and control program, break points are set automatically to the other by the synchronizing section 26. Consequently, setting break points to one of the control model and control program selectively by the user from the outside enables the synchronizing process.</li><li>(4) Since break points can be set individually to functional blocks of control model, the presence or absence of abnormality in the generated control program can be tested easily in correspondence to the control model when the control program is newly given an execution sequence.</li><li>(5) By comparing the simulation sequence of control model and the execution sequence of control program, it becomes possible to detect automatically the abnormality regarding the inconsistency of sequences.</li><li>(6) By comparing the value produced by the simulation of control model and the value resulting from the execution of control program with the comparing section, it becomes possible to detect automatically the abnormality regarding the inconsistency of values.</li><li>(7) At an abnormality indication in regard to a variable, in case at least one of variable values of step 319 of FIG. 7 and of step 339 of FIG. 8 is made alterable, the following effectiveness is added. Namely, at a determination of the presence of abnormality in variable, it is possible to make equal again the simulation condition of control model and the execution condition of control program, and eventually it becomes possible to resume the testing of the presence or absence of abnormality from the spot of the determination of abnormality.</li><li>(8) By producing data of an inconsistent comparison result provided by the comparing section to the display section 28 to display visually, it becomes possible to for the user oneself to know easily the spot of abnormality determination.</li></ul>

The foregoing embodiment may be altered as follows.

Suspend points of operations of the simulation section 20 and program execution section 22 are not confined to those written above. Instead, for example, the simulation section 20 may be synchronized with the program execution section 22 which executes and suspends the control program one line at a time. This operation may be implemented by setting a break point to each line of control program, and setting break points to the control model through the process shown in FIG. 6.

The simulation section 20 and program execution section 22 are not confined to those which implement the simulation and program execution by putting in input data to the control model and control program. Instead, for example, the simulation section and program execution section may be the ones which test the control model and control program while writing a virtual control object of the control program and a virtual environment of the object on the computer.

The function of the break point setting section 24 may be included in the simulation section 20. Otherwise, it may be included in the program execution section 22.

Although, in the foregoing embodiment, the allowable range used for the testing of the presence or absence of abnormality is made alterable depending on the data type of variables, the manner of range setting is arbitrary. Setting of allowable range is not always requisite, but the criterion of the determination of the presence or absence of abnormality may solely be the equality of both variable values.

In the foregoing embodiment, it is considered to make alterable at least one of the variable values in step 319 of FIG. 7 and step 339 of FIG. 8 in the case of abnormality indication in regard to the variable. Instead, an alternative design may be that the control program is tested by intentionally putting in abnormal data as a variable value in the normal state for example.

Control programs generated automatically from control models are not confined to those written in the C language, but control programs may be written in an arbitrary programming language. If the control program can possibly be newly given an execution sequence of processing defined by the control model which is not given inherently to the control model, testing of the control program and control model in synchronism with each other is particularly effective.

In the foregoing embodiment, the synchronizing section 26 is designed to have a comparing section for comparing the simulation result of control model and the execution result of control program and produced an inconsistent comparison result to the display section 28. Alternatively, the synchronizing section 26 may be designed to receive the simulation result of control model and the execution result of control program and produced the results intact without comparison to the display section 28. Display output to the display section 28 may be direct from the simulation section 20 and program execution section 22 instead of being through the synchronizing section 26. The operation results, which are produced directly or through the synchronizing section 26, may be stored in the form of data files in an arbitrary storage unit.

Instead of arranging the correspondence information formation section 16, synchronizing section 26, etc. by means for a computer and software, they may be arranged in specialized hardware devices.

The control program testing process, which is based on the use of model base development, may be altered arbitrarily within the range of alteration in which the presence or absence of abnormality is tested by synchronizing the simulation of control model and the execution of control program.

The present invention is applicable not only to the creation of control programs for vehicle engines, but also to the case of writing control programs by adopting the model base development.

An automatic code generation section (12) reads a control model, and generates and releases a control program which is written in the C language. At the generation of the control program, a correspondence information formation section (16) creates correspondence information indicative of the correspondence relationship between the control model and the control program. A simulation section (20) reads the control model and simulates its operation. A program execution section (22) reads the control program and executes it. A synchronizing section (26) makes synchronization, that is, a relational linkage, between the operation results of the simulation section (20) and the program execution section (22) based on the correspondence information.