DE102013217601A1 - Method for emergency operation of a multi-core processor of a control unit of a motor vehicle - Google Patents

Abstract

The invention relates to a method for emergency operation of a multicore processor (20) of a control device (10), in particular of a motor vehicle, wherein the multicore processor has a plurality of cores (21, 22), wherein different processes the individual cores (21, 22) of the Multicore processor (20) are assigned and executed on these assigned cores, wherein, if at least one of the cores of the multicore processor fails, it is evaluated whether a computing power of the remaining, non-failed cores of the multicore processor is sufficient to all different ones Execute processes. If the score indicates that the processing power of the remaining cores is sufficient, all the different processes are assigned to and executed on the remaining cores. If the score indicates that the computational power of the remaining cores is insufficient, only certain of the different processes will be assigned to and executed on the remaining cores.

Description

The present invention relates to a method for emergency operation of a multi-core processor of a control device of a motor vehicle.

State of the art

A multicore processor has several different processor cores. These individual cores of the multicore processor may be assigned individually different processes and tasks during operation. The different processes and tasks only run on the correspondingly assigned cores.

Multicore microprocessors or microcontrollers are becoming increasingly important in real-time systems, in particular in control units of motor vehicles. Real-time systems are characterized by the fact that a result of an arithmetic operation (for example, process or task) is guaranteed to be calculated within a defined time interval, that is to say present before a certain time limit. In a real-time system, a so-called real-time operating system runs on the processor, which regulates the different processes and tasks.

For example, a control unit with a real-time system can control an internal combustion engine (so-called engine control unit), an antilock brake system or an airbag of a motor vehicle. For example, for an antilock brake system, this time interval is defined by a time in which brakes must be opened so that the wheel does not lock. For controlling the airbag, the control unit can process measured values from sensors within the time interval and decide whether and how strongly the airbag is triggered. For the engine control, for example, injection quantities and injection times must be calculated in good time.

If one of the cores of the multicore processor fails, this leads to a complete failure of the control unit and the motor vehicle can no longer be operated.

It is therefore desirable to provide a way to continue to operate a multi-core processor of a control unit of a motor vehicle in case of failure of one or more cores in an emergency operation.

Disclosure of the invention

According to the invention, a method for emergency operation of a multi-core processor of a control device of a motor vehicle having the features of patent claim 1 is proposed. Advantageous embodiments are the subject of the dependent claims and the following description.

In the course of the method according to the invention, if at least one of the cores of the multicore processor fails, the control unit continues to be operated in an emergency mode. The processes assigned to the failed core can no longer be executed on this core. Furthermore, there is a risk that the remaining processes assigned to the remaining, non-failed cores may no longer be executed correctly. In order to prevent this leading to a failure of the control device and of critical and important functions for the motor vehicle, according to the invention all the different processes are assigned to the remaining, non-failed cores.

In the course of the invention, it is first evaluated whether a computing power of the remaining, non-failed cores of the multicore processor is still sufficient to execute all the different processes. If so, all the different processes are assigned to and executed on the remaining cores. As a rule, however, there is not enough computing power available after one or more cores have failed. In this case, a functional scope of the processes is reduced in addition to the new assignment of the processes. As a result, only certain of the different processes will be assigned to and executed on the remaining cores.

In the latter case, those particular processes assigned to the remaining cores are selected for importance and importance for the safe operation of the motor vehicle and for the safety of occupants of the motor vehicle. The processes are assigned a priority and the processes are executed according to the assigned priority. Processes that have the highest relevance to the safety of the occupants, such as airbag control, are given the highest priority. Processes, such as control of an antilock brake system or engine controls, which are important but not critical to safety, are assigned medium priorities. Lowest priority is assigned to processes that implement non-essential functions such as fault diagnosis or long-term monitoring of components of the motor vehicle or that are responsible for comfort functions, for example for entertainment systems. Optionally, lowest priority processes are not assigned to the remaining cores at all. The priorities can be specified in particular by the programmer of the function.

The new allocations of the processes to the remaining cores can take place in the control unit itself after the core failure by a suitable software. Alternatively, the corresponding assignments can also be made manually by persons, in particular in advance, for example after the production of the software of the control unit.

In the course of the invention, each of the cores recognizes when one of the cores has failed. Since each of the cores can fail, it is not enough if only one of the cores can detect a possible core failure.

Advantages of the invention

By means of the method according to the invention, it can be ensured that at least one basic functionality of the multicore processor or of the control device is ensured. A failure of one or more cores thus does not necessarily lead to a total failure of the entire multicore processor and thus the entire controller. In the course of this basic functionality, the most important functions and processes are maintained, it can continue to ensure the safety of the occupants of the motor vehicle. If a failure of one or more cores, for example, take place on a highway or a busy main road without evasive options, is avoided by the inventive method that the vehicle fails completely and comes to a standstill on the highway or the main road at a dangerous point. It is thus ensured that the motor vehicle can be driven to the next workshop or at least up to a parking lot or rest area where the vehicle can be safely parked.

The method according to the invention is particularly suitable for multicore processors of a real-time system. Real-time systems are particularly suitable for controlling or regulating time-critical and safety-critical applications of the motor vehicle since it is guaranteed by the real-time systems that a result is calculated within a defined time interval or a process is executed within the defined time interval. Those processes of the real-time system which are involved in the time-critical or safe operation of the motor vehicle are assigned to the remaining cores in the course of the method according to the invention.

In particular, a notification is issued, for example, to a driver of the motor vehicle. This notification may include a warning signal, such as an audible warning tone or a warning indication, e.g. in a dashboard of the vehicle. Thus, the driver can be notified of the failure of the core or cores. Alternatively or additionally, an error message can be created and stored in the control unit, for example, so that information about the time and the more exact circumstances of the core failure is available to mechanics of a workshop.

Advantageously, if the computational power of the remaining cores is insufficient, predetermined basic functional processes that execute the basic functionalities of the multicore processor or controller are assigned to and executed on the remaining cores. These basic function processes can be one or more of the different processes which also take place in a normal operation without a failed core or failed cores on the multicore processor. However, these basic function processes can also be special processes, which do not run on the multicore processor in normal operation and are executed only in the case of failed cores. The basic function processes can be stored on multiple cores, for example, or stored in a secure memory area that is not located on any of the cores. This prevents the basic function processes from being located exclusively on the core that is failing.

Preferably, the different processes assigned to the remaining cores are each executed with individually reduced functionality or are no longer executed. Thus, especially in the case that the computational power of the remaining cores is insufficient, all processes are still assigned to the remaining cores, but possibly only with reduced functionality or not executed at all. As a reduced functionality, for example, a process relevance can be reduced. A sequence according to which processes are carried out according to their relevance is changed. Also, the defined time interval, after which the processes are performed according to any real-time system, can be changed as reduced functionality.

Especially in engine control units run processes that angle-synchronous (ie speed-dependent) or the time-synchronized (ie speed-independent) must be performed. An example of an angle-synchronous process is the calculation of an injection quantity, an example of a usually time-synchronous process is the acquisition, digitization and preprocessing of process variables (such as the intake air quantity or the pump current of the lambda probe, which is used to determine the mixture ratio).

Angular synchronous processes are performed at a frequency that depends on the speed of the engine. Angle-synchronous processes can be started, for example, via interrupts, which in turn are triggered at certain crankshaft angles. The faster the internal combustion engine rotates or the higher the rotational speed, the more frequently these angle-synchronous processes are executed and the more computing time is consumed for these angle-synchronous processes.

If angle-synchronous and time-synchronous processes are executed in parallel on a core, the time-synchronous processes are optionally interrupted unpredictably by an angle-synchronous process since angle-synchronous processes are usually executed with a higher priority than time-synchronous processes. In a multicore processor, angle-synchronous processes can therefore be assigned to a specific core, referred to as a speed-dependent kernel. This speed-dependent core is in particular designed such that even at a maximum speed of the internal combustion engine, it still executes all necessary processes on time, ie in particular in real time.

If, in such a situation, one of the cores on which time-synchronized processes occur, and in the course of the invention these processes, which are no longer executed, are at least partially also assigned to a speed-dependent core, then both angle-synchronous processes and time-synchronized processes are used on this core Processes executed. Therefore, the maximum speed of the internal combustion engine is preferably limited, so that sufficient computing time is available for the execution of the time-synchronous processes.

Advantageously, a clock frequency of the remaining cores is increased. Thus, the computing power of the remaining cores is increased. In normal operation, a lower clock frequency is usually selected to reduce power consumption and increase the lifetime of the multicore processor. In the case of a failed core of the multicore processor, however, an increase in the service life is obsolete.

In each case, an individual new assignment of the processes to the respectively remaining cores in the control unit is stored for the failure of each of the cores. In this case, a priori, before one of the cores fails, said new allocations of the processes are manually determined and stored. If one of the cores actually fails during operation of the motor vehicle, the control unit does not have to decide for itself which processes are assigned to which core, the corresponding assignment is already present in the control unit. In particular, this a priori determined allocation can also include which of the different processes in the event that the computing power of the remaining cores is no longer sufficient to execute all the different processes are determined to be assigned to the remaining cores or which processes with which reduced functionality or which processes are no longer executed. In particular, this a priori determination can take place in a manufacturing process of the control device, for example at a band end. Thus, it can be ensured that all processes are assigned to the most appropriate remaining core in the event of a core failure. Analogous to the basic function processes, these allocations can be stored, for example, on several cores or stored in a secure memory area.

In an advantageous embodiment of the invention, the assignment of the processes to the remaining cores is stored, a reset of the multicore processor is performed and the multicore processor is powered up in accordance with the stored allocation of the processes. In general, a reset of the control unit is required for the new distribution of processes to take effect. The new assignment of the processes can in particular be stored as parameters of a boot process or the startup process of the multicore processor. In particular, the new assignment is one of the assignments described in the preceding paragraph. If a higher clock frequency is selected for the remaining cores, it is also stored as a parameter for booting the multicore processor.

Preferably, when a master core fails, a synchronized startup process is assigned to one of the remaining cores. The master core is assigned a process that controls the synchronized booting of the cores. This is one of the relevant processes inherited from one of the remaining cores. In particular, it is determined a priori which of the remaining cores will take over this process should the master core fail.

An arithmetic unit according to the invention, e.g. a microcontroller or a control unit of a motor vehicle is, in particular programmatically, configured to perform a method according to the invention.

The implementation of the method in the form of software is also advantageous, since this causes particularly low costs, in particular if an executing control device is still used for further tasks and therefore exists anyway. Suitable data carriers for the provision of the computer program are, in particular, floppy disks, hard disks, flash memories, EEPROMs, CD-ROMs, DVDs, and the like. It is also possible to download a program via computer networks (Internet, intranet, etc.).

Further advantages and embodiments of the invention will become apparent from the description and the accompanying drawings.

It is understood that the features mentioned above and those yet to be explained below can be used not only in the particular combination indicated, but also in other combinations or in isolation, without departing from the scope of the present invention.

The invention is illustrated schematically with reference to an embodiment in the drawing and will be described in detail below with reference to the drawing.

Brief description of the drawings

1 schematically shows an embodiment of a method according to the invention as a block diagram.

2 schematically shows a controller with a multi-core processor, which may underlie the invention.

Embodiment (s) of the invention

In 1 an embodiment of a method according to the invention is shown schematically as a block diagram. Said embodiment runs in a control unit (see 10 in 2 ) of a motor vehicle, the control device having a multicore processor or microcontroller having a plurality of processor cores (so-called cores) 21 . 22 having. Each core is assigned individual processes, which are executed exclusively on this core.

In step 101 At least one of the cores of the multicore processor fails. In the following, the special case is considered, without restriction of generality, that exactly one core fails. In step 102 the control unit makes an assessment as to whether a computing power of the remaining, non-failed cores is sufficient to execute all the different processes.

If this is the case, the processes in step 103a redistributed to the remaining processors. This can be done according to a new a priori distribution of processes. In step 200 , which has already been done in a manufacturing process of the controller, a new distribution of the remaining processes to the remaining cores a priori has been set for the failure of each of the processors, which for the step 103a is being used. Alternatively, the new distribution of processes can also be currently set by the control unit. Priorities have been assigned to the processes in advance, preferably as a function of occupant safety, and the processes still to be carried out in the event of a fault are automatically selected according to the priorities.

If the processing power of the remaining, non-failed cores is insufficient, in step 103b only certain processes assigned to the remaining cores. Optionally, some of these particular processes may only be executed with limited functionality on the corresponding cores. Also this step 103b can according to one in step 200 a priori distribution. In step 200 It was also determined which of the processes are assigned to the remaining cores and which of these processes are executed with which reduced functionality.

In step 104 the new distribution of processes to the remaining cores is stored separately for a subsequent reset of the controller. Furthermore, it is stored for subsequent reset of the controller that the remaining cores are operated at a higher clock frequency. In step 105 the said reset of the control unit takes place. In step 106 the control unit starts up again according to the steps in step 104 stored parameters. The corresponding processes are now assigned to the respective remaining cores and are executed on them with the respective functionality. Furthermore, the cores are operated at the increased clock frequency.

In step 107 the control unit is now operated in this emergency operation until it can be repaired or replaced, for example, by mechanics in a workshop. Furthermore, a warning message is output, for example via a warning light in a dashboard region of the motor vehicle.

In 2 is an exemplary control device, as the invention may be based, shown schematically and with 10 designated. The control unit 10 has a microcontroller 20 on which a microprocessor with peripheral functions 25 equivalent. The microcontroller 20 has two processor cores 21 . 22 , a working memory 23 and a program memory 24 on that connected via a processor bus. The peripheral function may include, for example, a communication function for a CAN bus, wherein the control unit 10 via a CAN bus interface 11 features.

The exemplary control device shown here 10 also has an external digital data storage 30 and an analog-to-digital converter 40 on, with analog connections 41 connected is.

Claims (11)

Method for Emergency Operation of a Multicore Processor ( 20 ) of a control device ( 10 ) of a motor vehicle, wherein the multicore processor ( 20 ) several cores ( 21 . 22 ), wherein different processes are assigned to the individual cores of the multicore processor and executed on these assigned cores, wherein if at least one of the cores of the multicore processor ( 20 ) fails, - is evaluated ( 102 ), whether a computing power of the remaining, non-failed cores of the multicore processor ( 20 ) is sufficient to carry out all the different processes, if the evaluation shows that the computing power of the remaining cores is sufficient, all the different processes are assigned to the remaining cores and executed thereon ( 103a ), If the evaluation shows that the computing power of the remaining cores is insufficient, only certain of the different processes are assigned to the remaining cores and executed on them ( 103b ). The method of claim 1, wherein when the score indicates that the computational power of the remaining cores is insufficient, predetermined basic functional processes determine which basic functionalities of the controller ( 10 ), assigned to the remaining cores, and executed on them ( 103b ). The method of claim 1 or 2, wherein the different processes assigned to the remaining cores are each performed with individually reduced functionality or are no longer executed. Method according to one of the preceding claims, wherein processes that are no longer executed, a speed-dependent core on which processes are carried out in dependence on a speed of an internal combustion engine of the motor vehicle, assigned and the speed of the internal combustion engine is limited. Method according to one of the preceding claims, wherein a clock frequency of the remaining cores is increased. Method according to one of the preceding claims, wherein in each case an individual new assignment of the processes to the respectively remaining cores is stored for the failure of each of the cores ( 200 ). Method according to one of the preceding claims, wherein after the failure of the at least one core, a reset of the multicore processor ( 20 ) carried out ( 105 ) and then the multicore processor is started according to a stored assignment of the processes ( 106 ). The method of any one of the preceding claims, wherein if a master core fails, with a process assigned to it to control a synchronized boot of the cores, the synchronized boot process is assigned to one of the remaining cores. Arithmetic unit ( 20 ), which is adapted to perform a method according to any one of the preceding claims. Computer program that causes a computing unit to perform a method according to one of claims 1 to 8, when it is executed on the computing unit, in particular according to claim 9. A machine-readable storage medium having a computer program stored thereon according to claim 10.

Images