JP2002202891A - Electronic controller and recording medium - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an electronic controller or the like capable of reducing the capacity of a program, and improving the degree of freedom of an application by improving the independency of an application program, and ensuring reliability. SOLUTION: A body ECU inputs data from an in-vehicle LNA or an input port by input processing in an S6 according to timer interruption, and arbitrates the contradiction of the input data by input arbitration processing in an S7, and generates output data based on the input data arbitrated by application processing in an S8. Then, the contradiction of the output data is arbitrated by output arbitration processing in an S9, and the output data arbitrated by output processing in an S10 are outputted to the in-vehicle LAN or the output port. Also, the programs of input processing, input arbitration processing, and output arbitration processing, and output processing are executed by simple scheduling, and the program of the application processing is executed by event driven.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to an electronic control device and the like.

[0002]

2. Description of the Related Art Conventionally, according to an application program stored in a memory, states of various sensors and the like are input at predetermined time intervals, for example, and a control target (output device) is input in accordance with the input data. 2. Description of the Related Art There is known an electronic control device which determines whether or not to control the control, and when it is determined that the control is performed, performs an output for controlling the control target.

An application program for such an electronic control device is created for each predetermined processing unit according to a control object, a control purpose, and the like, and the created application programs are configured to be continuously executed. That is, by executing a plurality of application programs in a scheduling method (simple scheduling) for sequentially executing, a plurality of control targets or a plurality of control targets are realized by one electronic control device.

[0004] However, in such an electronic control device, there are the following problems because input->determination-> output processing is performed in each application program. That is, when input is performed by a plurality of application programs from the same input device, or output is performed by a plurality of application programs to the same output device, processing by an application program executed first and an application executed later In the processing by the program, the information input from the input device changes, causing inconsistency in the processing result, or outputting different information between the processing by the application program executed first and the processing by the application program executed later, The output device may malfunction. Therefore, it is necessary to perform arbitration in the processing by each application program so that inconsistency does not occur in the results of each processing, and it is necessary to exchange information between each application for the arbitration. And the design and maintenance of application programs become more difficult as the complexity of the system increases. Further, in such an electronic control device, input / output is performed in processing for each application program, and thus input / output is performed in the same input / output device by processing by a plurality of application programs, so that the program is useless. There were also problems.

Accordingly, the present invention solves the above-mentioned problems, eliminates duplication of input / output codes, reduces the memory capacity for storing programs, and provides modularity (independence) of application programs. It is an object of the present invention to provide an electronic control device or the like capable of increasing the degree of freedom of an application and improving the reliability of the application.

[0006]

Means for Solving the Problems and Effects of the Invention The electronic control device according to the first aspect of the present invention, which has been made to solve the above-mentioned problems, inputs a control process as illustrated in FIG. Processing, application processing, and output processing are separately executed and performed. At this time, the plurality of input processing programs for input processing are sequentially executed, while the plurality of application programs for application processing are executed from among the plurality of application programs in accordance with input data input in the input processing. The application program to be executed is determined, and the application program to be executed is executed. The output processing is performed by sequentially executing an output processing program that performs output based on output data generated by the application processing.
That is, the input / output processing is configured by a scheduling method (simple scheduling) in which calls are sequentially made, and the application unit performs processing when input data necessary for processing the application program exists (when an external event occurs).
Then, an application program corresponding to the input data (event) is executed (event-driven method). Therefore, since only the application in which the event has occurred is executed, an application program that does not require processing is not executed.

In the application processing, input / output to an input device and an output device is not performed. Therefore, the application program can be created without considering the dependency before and after input / output, and the reliability is improved. In addition, the application program can easily add or delete a function unit, for example, as an independent program. In addition, by dividing the control processing into input processing, application processing, and output processing in this way, it is possible to reduce the size of the program as compared with the conventional case where input / output is performed in each application processing, The capacity of a memory such as a ROM can be reduced.

Further, the control process is repeatedly executed, but can be configured as described in claim 2.
As described above, the control processing is periodically executed at predetermined time intervals, and the processing is completed within the predetermined time. It can be.

Further, it is preferable to perform input arbitration after completion of data input. That is, a process of determining whether or not the application program in the application process has been executed based on the input data is performed. For example, when both the input data A and the input data B are 1, it is determined that the event A is generated as an input arbitration result. Then, in the application processing, the application program to be executed when the event A occurs is executed. By doing so, each application program can be executed at a level necessary for processing in the application program, and it is not necessary to check for inconsistencies in input data in the application program. Therefore, creation of an application program is facilitated, modularity is improved, and reliability is improved.

Similarly, in output processing, output arbitration may be performed before data output is started (see claim 4). By doing so, for example, in application processing, it is sufficient to output higher-level output data without being aware of the detailed configuration of the output port. In addition, there is no need for each application program to determine whether there is any inconsistency in the contents of output data. This makes it easier to create an application program, improves modularity, and improves reliability.

Here, FIG. 1B shows an example of a relationship between programs composed of five layers that perform input arbitration according to claim 3 and output arbitration according to claim 4. If the arbitration processing of both the third and fourth aspects is performed in this way, the independence of the application program becomes extremely high.

Further, it is preferable to synchronize the input data as described in claim 5. In this way, the input data used in each process after the completion of data input is all in the same state. Therefore, for example, the inconsistency that the input data changes during the application processing and the application processing is performed based on the input data before the change and the changed input data does not occur. Therefore, reliability (safety) can be easily ensured.

Similarly, if the output data is synchronized as described in claim 6, all output data used in each processing after the completion of the application processing will be in the same state. Therefore, for example, inconsistency in which output data changes during output processing and output processing based on the output data before the change and the changed output data is performed does not occur. Therefore, reliability (safety) can be easily ensured.

Further, if the input arbitration results are synchronized as described in claim 7, the input arbitration results used in each processing after the completion of the input arbitration are all in the same state. Therefore, for example, there is no inconsistency that the input arbitration result changes during the application processing and the application processing based on the changed input arbitration result and the changed input arbitration result is performed. Therefore, reliability (safety) can be easily ensured.

Similarly, if the output arbitration results are synchronized as described in claim 8, the output arbitration results used in each processing after the output arbitration is completed are all in the same state. Therefore, for example, the output arbitration result changes during data output, and contradiction in which data output based on the output arbitration result before the change and the changed output arbitration result is not generated. Therefore, reliability (safety) can be easily ensured.

In the case where the processing result is used between application programs, the processing result (data) may not be directly transferred between the applications. For example, in data communication between applications, the output process and the input process are performed once and notified to another application, so that a safe design is possible. Then, the connection between the applications is broken, and a mechanism capable of attaching and detaching functions is provided. Therefore, the independence between the application programs is increased, and the development of the application programs becomes easy. Also, the reliability (safety) of the input / output signals can be easily ensured.

However, since the application program is executed in an event-driven manner as described above, for example, a situation in which an event corresponding to a certain application program does not start without being generated may continue for a long time. In such a case, if the processing result of the application program or the data in the RAM storing the output data changes due to an external noise or the like, the output processing based on the changed data causes a malfunction of the control target. Occurs. Then, it is good to make it like Claim 10. In this way, for example, the application is activated by the periodic event generating means, and the contents of the RAM storing the processing result are refreshed by the processing of the application program. That is, for example, an application program that is started by an event is provided with a mechanism that is also started by the occurrence of a regular event. Even so, data refresh at intervals that do not hinder the system is guaranteed. In this way, the influence of a malfunction can be minimized.

With the above configuration, the reliability of input / output signals can be ensured, the degree of freedom of applications can be improved, and the capacity of ROM for storing programs can be saved. In particular, in an electronic control device that controls input and output to an input device for inputting a human instruction and an output device that affects a human, the reliability of input and output signals is ensured. Since the necessity is high, the electronic control device described above exhibits particularly excellent effects. Further, when the input device or the output device is a device for transmitting information via a network,
Data input / output delay through the network can be arbitrated, and application design can be facilitated.

In addition, as shown in claim 13, claim 1
The functions for realizing the control processing in the electronic control device according to any one of the first to twelfth by a computer can be provided, for example, as a program activated by the computer. In the case of such a program, for example, floppy (registered trademark)
It can be used by recording it on a computer-readable recording medium such as a disk, a magneto-optical disk, a CD-ROM, a hard disk, and a ROM, and loading and activating the computer system as needed.

[0020]

Embodiments of the present invention will be described below with reference to the drawings. It is needless to say that the embodiments of the present invention are not limited to the following examples, and can take various forms within the technical scope of the present invention.

FIG. 2 is a diagram showing a body system 100 provided with a body ECU 10 which is an electronic control unit as an embodiment. The body system 100 includes a body ECU 10 connected to an in-vehicle LAN 50 corresponding to a network in the claims, and a communication target ECU 20 that can communicate with the body ECU 10 via the in-vehicle LAN 50. The body ECU 10 and the communication target ECU 20 include:
This is a computer system including a CPU, a ROM, a RAM, an I / O, and the like. An input device 30, an output device 40, and an in-vehicle LAN 50 are connected to the I / O.

The communication target ECU 20 reads the state of the input device 30, generates a packet, and transmits the packet to the body ECU 10 via the in-vehicle LAN 50. In-vehicle LAN 50
The output device 40 is controlled based on the control information of the packet from the body ECU 10 input through the control unit. The communication target ECU 20 is, for example, a D seat door ECU 20a, a P seat door ECU 20b, an instrument panel ECU 20c, or the like. The D-seat door ECU 20a is an EC installed on the driver's door.
U, a D-seat door control switch 30a or the like is connected as the input device 30, and a D-seat door lock motor 40a, a D-seat power window motor, or the like is connected as the output device 40. The P-seat door ECU 20b is an ECU installed on the door on the side of the auxiliary seat, and the input device 3
As 0, the P seat door control switch 30b and the like are connected, and as the output device 40, the P seat door lock motor 40b
And a power window motor for the P seat are connected.
The instrument panel ECU is an ECU installed on the instrument panel.
For example, a buzzer 40c, a lamp 40d, or the like is connected as the output device 40.

The body ECU 10 is a communication target ECU 20.
When a packet transmitted to the in-vehicle LAN 50 is received at predetermined time intervals, captured via I / O, an application corresponding to the content of the captured packet is started, and control of the output device 40 is required. Then, a control process of generating and transmitting a packet including a control instruction to the communication target ECU 20 to be controlled is performed.

The processing of the body ECU 10 will be described with reference to FIG. As shown in FIG. 3, when the power is turned on, the body ECU 10 performs each I / O in S1.
An initialization process for initializing a system such as a port and a RAM is performed. In S2, an idle task manager that manages idle tasks is executed. Then, in S3, a user-defined process executed at the time of idling is executed, and a CPU monitoring manager for monitoring the state of the CPU is executed. Then, the process returns to S2 to execute the idle task manager. Thus, S2 to S4 are executed in a loop.

The CPU receives a timer interrupt every 5 ms from a timer (not shown). Due to this timer interrupt, the processing shifts to the system manager in S5,
6, input arbitration processing in S7, application processing in S8, output arbitration processing in S9, output processing in S10,
The sleep manager of S11 is sequentially executed to return from the timer interrupt and return to the idle loop composed of the original S2 to S4. The main processing based on the timer interrupt is configured to be completed in a shorter time than the timer interrupt interval of 5 ms.

The processing of each step from the input processing in S6 to the output processing in S10 will be described in more detail. In S6, an input processing program for performing input processing from I / O is sequentially executed. That is, the input processing program 1, the input processing program 2, the input processing program 3, the input processing program 4,..., And the input processing program i are sequentially executed. When the execution of all the input processing programs is completed, the process proceeds to the input arbitration processing in S7.

The input arbitration process of S7 is a process of performing arbitration by integrating data input from the I / O by the input process of S6. That is, the process of determining whether to set an event flag for activating the application program of S8 based on the data input in the input process (S6). The input arbitration process (S7) is composed of a plurality of input arbitration programs corresponding to respective events, and is sequentially executed as in the input arbitration program 1, the input arbitration program 2,... The input arbitration program j. Then, when the execution of all the input arbitration processing programs is completed, the processing shifts to the application processing of S8.

The application processing (S8) is composed of a plurality of application programs 1, application programs 2,..., And an application program k.
It is configured not to perform input / output processing to the device. That is, the input is performed by an input layer (corresponding to the input processing of S3 and the input arbitration processing of S4) corresponding to the input processing in the claims via a memory, and the output is performed via a memory. This is performed by an output layer corresponding to the output processing in the claims (corresponding to the output arbitration processing in S9 and the output processing in S10).

The exchange of information between application programs is not performed directly. That is, FIG.
As shown in (2), for example, when the application program 1 and the application program 4 are executed, the data of the result of executing the application program 1 (processing result) is not used in the application program 4. That is, the application program 1 stores the processing result in the application processing result storage area on the RAM, but does not directly refer to the data from the processing of the application program 4. When the processing result of the application program 1 is required in the processing by the application program 4, the processing result stored in the application processing result storage area is copied to the input data storage area in the input arbitration processing in S7 in advance. I do. Then, when the application program 4 is started according to the event flag, the data of the processing result is referred to from the input data storage area. Therefore, even if the application program 4 is executed immediately after the application program 1, the application program 4 refers to the input result storage area instead of the output result storage area and uses it for processing. The application program 1 at the time of the timer interrupt one cycle earlier, not the processing result of 1.
The processing is performed using the processing result of (1).

As described above, the input / output processing and the processing other than the input / output are separated, and the data transfer is not performed directly between the application programs, so that the independence of each application is enhanced and the application is a functional unit. Addition and deletion of application programs can be easily performed.

Which application program is to be executed is determined by a simple OS process which is a management application program. This determination process is performed based on an event table that registers in advance which event each application program will execute (when an event flag is raised). In this event table, the address of the application program corresponding to the event flag is registered (stored). When the event flag is set by the input arbitration processing (when an event occurs), the address of the corresponding application program is stored. Call the address,
The processing shifts to the application program. When a plurality of applications are associated with one event in the event table, the applications corresponding to the event are executed sequentially. That is, when there are a plurality of application programs corresponding to the event flag 1 including the application program 1, the application program 2, and the application program x, the processing is shifted to the application program 2 when the application program 1 ends, and
When the processing is completed, the processing shifts to the application program 3. Then, when the processing of the application programs corresponding to all the event flags has been completed, the simple OS processing is terminated, and the routine goes to S9.

The output arbitration process of S9 is a process of arbitrating whether or not to perform output in the output process of S10 based on the data stored in the application process result storage area by the application process of S8. That is, for example, when a plurality of application programs store different output instructions for the same output target in the processing result storage area, arbitration is performed to determine which processing result is to be output. For example, the output arbitration process (S9) is composed of a plurality of output arbitration programs, and is sequentially executed as an output arbitration program 1, an output arbitration program 2,... Then, when the execution of all the output result arbitration programs is completed, the processing shifts to the output processing of S10.

In the output processing of S10, an output processing program for performing output processing to I / O is sequentially executed. That is, the output processing program 1, the output processing program 2,
.., Are sequentially executed like an output processing program m. When execution of all output processing programs is completed, S11
To sleep manager.

In this manner, the processing that has been conventionally performed collectively is replaced with the input processing of S6, the input arbitration processing of S7,
8 application processing, S9 output arbitration processing, S1
The process is divided into five output processes of 0, and data is synchronized in each process. That is, as shown in FIG. 5, data determined at a certain time is transferred to the next processing unit, and is not changed thereafter. For example, in the input processing of S6, the switch
After N is determined, the processing is performed with the switch ON state, even if the input state is OFF, until the input processing of the next cycle is executed. Similarly, the information determined in the input arbitration process in S7 is not changed until the input arbitration process in the next cycle. The information determined in the application processing in S8 is not changed until the next application processing. The information determined by the output arbitration process is not changed until the next output arbitration process. Therefore, the data is determined (synchronized) at the time when the processing of each processing unit is completed. Since the data generated by the previous processing unit does not change during the processing of each processing unit, avoid processing inconsistency such as performing processing based on the data before the change and processing based on the data after the change. And safety design can be facilitated.

As described above, the programs of the input layer and the output layer are sequentially executed. That is, it is executed by simple scheduling. On the other hand, in the application layer, which application program is to be executed is determined by a simple OS process by determining the presence or absence of an event.

With such a configuration, an application program in which no event occurs does not execute while no event occurs. Therefore,
The application processing result storage area for the application program that is not executed is not updated during that time. For this reason, if the data in the application processing result storage area is rewritten by external noise or the like (so-called RAM conversion), S8
Output arbitration processing and the output processing of S9 may result in erroneous output. Such a situation is more likely to occur as the application processing result storage area must be updated for a longer time. In particular, for example, when controlling a system that may adversely affect a person due to a control error, it is desirable to update the value of the memory every predetermined time so that such a case does not occur.

Therefore, as shown in FIG. 6, in the simple OS processing, the application programs that have not been started for a certain period of time are sequentially started, and the application processing result storage area for the application program is updated. This fixed time is an interval longer than the timer interrupt interval and a time that does not hinder system control even if data in the application processing result storage area changes due to external noise or the like. That is, in the body system 100 (see FIG. 1), a situation is assumed in which a garbled RAM outputs an instruction to close in a state where it should not be closed, as in the case of power window closing control (not shown). If the time during which such abnormal control continues is about 50 ms, there is no adverse effect on humans. Therefore, for example, the application programs that have not been started are sequentially executed for 40 ms. For example, FIG.
As shown in, the application 2, the application 3, and the application 4
If not executed for ms, the application 2 is executed, the application 3 is executed, and the application 4 is executed. Then, the above-described processing for executing the application corresponding to the event is performed. By adopting such a configuration, reliability and safety can be ensured even if the RAM is corrupted.

According to such a body system 100, for example, different instructions are given from both the D-seat door control switch 30a and a wireless (system for locking / unlocking the door using radio waves or the like) as the input device 30 (not shown). Are input substantially simultaneously at the same time, that is, for example, the D-seat door ECU 20a issues an instruction to lock all the doors based on the state of the D-seat door control switch 30a, and the wireless sends the instruction to unlock all the doors in the vehicle LAN 50.
Output to the body ECU 10 via the
U10 fetches these information from the I / O by the input processing of S6. Then, any one of the instructions is preferentially used by the input arbitration process in S7. For example, D
Arbitration is performed to give priority to the state of the seat door control switch 30a. Then, an event flag indicating that the instruction to lock all the seat doors has been input is set, and the process proceeds to S8. Therefore, the execution is transferred to the application corresponding to the event flag by the simple OS process. For example, by the processing of the application 1, an instruction to lock all the seat doors is written in the application processing result storage area. On the other hand, at this time, it is assumed that, for example, the application 2 is executed by an event based on the state of the other input device 30, and an instruction to unlock the D-seat door is written in the application processing result storage area as the processing result. In this case, the output arbitration process of S9 arbitrates the output and gives priority to locking of all the doors to the output process of S10, and the output process of S10 sends the door ECU to each door ECU connected to the output device 40. Send the locking instruction. Thus, it is possible to prevent the door from being unlocked → locked or locked → unlocked in a very short time. That is, a plurality of contradictory input data and output data can be arbitrated, and safe and highly reliable control can be realized.

As described above, when controlling a system operated by a human, the difference between the processing time (recognition time) between the human and the machine to be controlled can be adjusted by the above-described arbitration and synchronization. In addition, the influence of a delay in data arrival due to a delay or the like caused by the in-vehicle LAN 50 can be suppressed by these mechanisms.

[Brief description of the drawings]

FIG. 1 is an explanatory diagram illustrating hierarchization of control processing.

FIG. 2 is a block diagram illustrating a configuration of a body system.

FIG. 3 is an explanatory diagram illustrating a division state and an execution order of each process.

FIG. 4 is an explanatory diagram showing a method of exchanging data between application programs.

FIG. 5 is an explanatory diagram illustrating data synchronization in each process.

FIG. 6 is an explanatory diagram regarding resetting of a memory state.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 10 ... Body ECU 20 ... ECU to be communicated 20a ... D seat door ECU 20a 20b ... P seat door ECU 20b 30 ... Input device 30a ... D seat door control switch 30b ... P seat door control switch 40 ... Output device 40a ... D seat door lock motor 40b P door lock motor 40c Buzzer 40d Lamp 50 In-vehicle LAN 100 Body system

 ──────────────────────────────────────────────────の Continuing on the front page (72) Inventor Katsutoshi Haruna 1-1-1, Showa-cho, Kariya-shi, Aichi Prefecture Inside Denso Corporation (72) Inventor Kunitaka Egawa 1-1-1, Showa-cho, Kariya City, Aichi Prefecture Denso Corporation (72) Inventor Shirou Kato 1-1-1, Showa-cho, Kariya-shi, Aichi Prefecture Inside Denso Corporation (72) Inventor Shuichi Nitta 1-1-1, Showa-cho, Kariya City, Aichi Prefecture F-term (Reference) 3G084 DA04 DA13 EB02 EB03 EB06 5B098 GA08 GC01

Claims (13)

[Claims] 1. According to a program stored in a memory,
An input process for inputting data from a plurality of input devices to obtain input data, an application process for generating output data to be output to an output device based on the input data after the input process, and after the application process An electronic control device that repeatedly performs a control process including an output process for outputting data to an output device based on the output data, wherein the input process sequentially executes an input processing program corresponding to the input device. The application processing is performed by determining an application program to be executed from a plurality of application programs in accordance with the input data obtained by the input processing, and executing the application program to be executed. The processing includes an output processing program corresponding to the output device. An electronic control unit, which comprises carrying out in the following run. 2. The electronic control unit according to claim 1, wherein said control processing is executed at predetermined time intervals, and said control processing is completed within said predetermined time period. 3. The electronic control device according to claim 1, wherein, in the input processing, after completion of data input, whether or not each of the application programs is to be executed based on the input data. Performing input arbitration to determine whether the application program to be executed is determined by:
An electronic control device, wherein the control is performed based on the input arbitration result. 4. The electronic control device according to claim 1, wherein, in said output processing, an output target according to said output data by said application processing before starting output of data to said output device. An electronic arbiter for performing an output arbitration for arbitrating the output device to output an appropriate state, and outputting the data based on the output arbitration result. 5. The electronic control device according to claim 1, wherein after completion of data input in said input processing, said input data is determined, and said input data is not changed in subsequent processing. Electronic control device characterized by the following. 6. The electronic control device according to claim 1, wherein after the generation of the output data in the application processing is completed, the output data is determined, and in the subsequent processing, the output data is determined. An electronic control unit characterized by not changing. 7. The electronic control device according to claim 3, wherein after the input arbitration is completed in the input processing, the input arbitration result is determined, and in the subsequent processing, the input arbitration result is determined. An electronic control unit characterized by not changing. 8. The electronic control device according to claim 4, wherein after the output arbitration is completed in the output processing, the output arbitration result is determined, and in the subsequent processing, the output arbitration result is determined. An electronic control unit characterized by not changing. 9. The electronic control device according to claim 1, wherein in the application processing, a processing result obtained by executing one application program is used when another application program is executed. An electronic control device, wherein the processing result is not used until the other application is executed in the next repetition cycle. 10. The electronic control device according to claim 1, wherein in the application processing, a time during which the plurality of application programs are not determined to be the application to be executed and are not being executed is determined. If there is an application program that has reached
An electronic control device for executing the application program. 11. The electronic control device according to claim 1, wherein at least one of said input device and said output device has an effect on a device for inputting a human instruction or on a human. An electronic control device, wherein the electronic control device is a device that performs an operation of providing a control signal. 12. The electronic control device according to claim 1, wherein at least one of the input device and the output device is a device connected via a network. Electronic control unit. 13. A recording medium on which a program for causing the electronic control device according to claim 1 to execute the control processing is recorded.