JP2018112977A - Microcomputer - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a microcomputer capable of allocating arithmetic processing which has been executed by an abnormality occurrence core before resetting to a normal core, and suppressing the arithmetic processing which becomes unexecutable after resetting to the necessary minimum.SOLUTION: A microcomputer comprises a plurality of cores 21, 22. A core abnormality detection part 31 of each of the plurality of cores specifies an abnormality occurrence core. An operation mode determination part 33 of each of the plurality of cores determines an operation mode on the basis of the specified abnormality occurrence core. A resetting part 34 resets the plurality of cores when the abnormality occurrence core is specified. A startup core control part 35 starts up the core other than the abnormality occurrence core between the plurality of cores after the plurality of cores are reset. An execution processing determination function 45 of each of the plurality of cores sets processing to be executed by the core after the core other than the abnormality occurrence core is started up for each startup core on the basis of the determined operation mode.SELECTED DRAWING: Figure 2

Description

  The present disclosure relates to a microcomputer including a plurality of cores.

As disclosed in Patent Document 1, there is known a microcomputer that includes a plurality of cores and is configured to execute a plurality of processes in parallel by assigning a plurality of processes to each core.
Conventionally, when an abnormality occurs in a specific core in a multi-core microcomputer having a plurality of cores, an attempt is made to reset the entire microcomputer to restore the specific core.

JP 2008-123439 A

However, when an abnormality in a specific core continues even after resetting, there is a possibility that processing in other cores cannot be executed due to the abnormality that occurred in the specific core.
The present disclosure is intended to suppress the influence of an abnormality occurring in a specific core on other cores.

  One aspect of the present disclosure is a microcomputer (3) including a plurality of cores (21, 22, 23) that execute one or a plurality of arithmetic processes, and includes an abnormality identification unit (31) and a mode determination unit (33). ), A reset unit (34), an activation unit (35), and a process setting unit (45).

The abnormality specifying unit is configured to be able to specify an abnormality occurring core that is a core in which an abnormality has occurred among the plurality of cores.
The mode determination unit is configured to determine an operation mode for executing a calculation process by a core other than the abnormality occurrence core based on the abnormality occurrence core identified by the abnormality identification unit.

The reset unit is configured to reset a plurality of cores when the abnormality specifying unit specifies an abnormal core.
The activation unit is configured to activate a core other than the abnormality occurring core identified by the abnormality identification unit among the plurality of cores after the plurality of cores are reset.

  The process setting unit sets, for each activated core, one or a plurality of arithmetic processes to be executed by the core after activation of a core other than the abnormal core based on the operation mode determined by the mode determination unit. Composed.

  In the microcomputer according to the present disclosure configured as described above, when an abnormality occurrence core is specified, a plurality of cores are reset. Therefore, when an abnormality occurs in at least one core, the influence of the abnormality can be eliminated. . Moreover, since the microcomputer of this indication starts cores other than a malfunctioning core among several cores, it can suppress the influence which the malfunction resulting from a malfunctioning core has on another core after reset. And the microcomputer of this indication sets the arithmetic processing performed for every started core based on an operation mode. For this reason, the microcomputer according to the present disclosure can assign the arithmetic processing executed by the abnormal core before the reset to a normal core, and can suppress the arithmetic processing that cannot be executed after the reset to the minimum necessary. it can.

  Note that the reference numerals in parentheses described in this column and in the claims indicate the correspondence with the specific means described in the embodiment described later as one aspect, and the technical scope of the present disclosure It is not limited.

2 is a block diagram showing a configuration of an ECU 1. FIG. 3 is a block diagram showing a configuration of cores 21 and 22. FIG. It is a flowchart which shows abnormality handling processing. It is a flowchart which shows the initialization process. It is a figure which shows an execution process table. It is a figure which shows the process which the cores 21, 22, and 23 perform whenever the execution timing comes in the normal time and the fail safe time. It is a figure explaining the method for performing the process of an abnormal core by another core. FIG. 6 is a first sequence diagram showing operations of cores 21 to 23. It is a 2nd sequence diagram which shows operation | movement of the cores 21-23.

Hereinafter, embodiments of the present disclosure will be described with reference to the drawings.
An electronic control device 1 (hereinafter referred to as ECU 1) according to the present embodiment is mounted on a vehicle, and includes a microcomputer 3 (hereinafter referred to as microcomputer 3), an input circuit 4, an output circuit 5, and a reset circuit 6, as shown in FIG. ing. ECU is an abbreviation for Electronic Control Unit.

  Signals from a crank angle sensor, an air flow meter, a throttle opening sensor, an intake pressure sensor, an air-fuel ratio sensor, and the like (not shown) are input to the microcomputer 3 via the input circuit 4.

  The crank angle sensor detects the rotation angle of the crankshaft of the engine. The air flow meter detects the amount of air supplied to the engine through the intake pipe. The throttle opening sensor detects the opening of the throttle valve. The intake pressure sensor detects the pressure in the intake pipe. The air-fuel ratio sensor detects the air-fuel ratio of the fuel mixture supplied to the engine from the oxygen concentration in the exhaust gas.

  The microcomputer 3 detects the state of the engine based on the signals input via the input circuit 4, and based on the detection result, the throttle motor that changes the opening of the throttle valve, and the ignition in each cylinder. A drive signal for driving various actuators such as a plug and an injector in each cylinder is output via the output circuit 5 to operate the engine.

The reset circuit 6 resets the entire microcomputer 3 by outputting a reset signal to the microcomputer 3.
The microcomputer 3 includes a CPU 11, a ROM 12, a RAM 13, a flash ROM 14, an I / O 15, a bus line connecting these components, and the like, and various control processes for controlling the engine based on a program stored in the ROM 12. Execute. The flash ROM 14 is a non-volatile memory that can rewrite stored contents.

  Various functions of the microcomputer are realized by the CPU 11 executing a program stored in a non-transitional physical recording medium. In this example, the ROM 12 corresponds to a non-transitional tangible recording medium that stores a program. Further, by executing this program, a method corresponding to the program is executed.

  Further, the CPU 11 includes CPU cores (hereinafter referred to as cores) 21, 22 and 23 including an arithmetic unit for executing a program, a register, and the like. The cores 21, 22, and 23 execute various control processes for controlling the engine in a distributed manner. The cores 21, 22, and 23 are connected to each other so that data communication is possible.

  The CPU 11 also includes a register 24 and a clock supply circuit 25. The register 24 is configured to be accessible from the cores 21, 22, and 23. The clock supply circuit 25 supplies a clock signal input to the microcomputer 3 from an oscillation circuit (not shown) to the cores 21, 22 and 23. The clock supply circuit 25 is configured to be able to select a core that supplies a clock signal, based on later-described startup core information stored in the register 24.

  As shown in FIG. 2, the cores 21 and 22 include a core abnormality detection unit 31, a core abnormality management unit 32, an operation mode determination unit 33, a reset unit 34, a startup core control unit 35, and a process execution unit 36. Although not shown in FIG. 2, the core 23 is similar to the cores 21 and 22, the core abnormality detection unit 31, the core abnormality management unit 32, the operation mode determination unit 33, the reset unit 34, the activation core control unit 35, and A processing execution unit 36 is provided.

  The core abnormality detection unit 31 includes a self-core abnormality detection function 41 and a core mutual monitoring function 42. The own core abnormality detection function 41 detects an abnormality of a core (hereinafter referred to as the own core) in which the core abnormality detection unit 31 is mounted, for example, by a WDT interrupt and an exception interrupt. WDT is an abbreviation for Watch Dog Timer. Examples of exception interrupts include undefined instruction exceptions, privileged instruction exceptions, access exceptions, and floating-point exceptions. The core abnormality detection unit 31 may detect an abnormality by a lock step operation. Hereinafter, of the cores 21, 22 and 23, cores other than the own core are referred to as other cores.

  The core mutual monitoring function 42 monitors the abnormality between the cores 21, 22, and 23. Specifically, the monitored core mutual monitoring function 42 executes a test operation for monitoring. The monitoring core mutual monitoring function 42 periodically checks the result of the test calculation executed by the monitored core mutual monitoring function 42 and determines whether or not the calculation result is correct. FIG. 2 shows a state in which mutual monitoring is performed between the core mutual monitoring function 42 of the core 21 and the core mutual monitoring function 42 of the core 22. However, the core mutual monitoring function 42 of the core 21 and the core mutual monitoring function 42 of the core 22 are mutually monitored with the core mutual monitoring function 42 of the core 23. The arrow Y1 in FIG. 2 indicates that the core mutual monitoring function 42 of the core 21 is monitoring the core mutual monitoring function 42 of the core 22. An arrow Y <b> 2 in FIG. 2 indicates that the core mutual monitoring function 42 of the core 22 is monitoring the core mutual monitoring function 42 of the core 21.

  When the self-core abnormality detection function 41 or the core mutual monitoring function 42 detects a core abnormality, the core abnormality detection unit 31 displays abnormal core information indicating a core in which an abnormality has occurred (hereinafter referred to as an abnormal core). To the core abnormality management unit 32. An arrow Y <b> 3 in FIG. 2 indicates that the core abnormality detection unit 31 of the core 21 outputs abnormal core information to the core abnormality management unit 32 of the core 21. 2 indicates that the core abnormality detection unit 31 of the core 22 outputs abnormal core information to the core abnormality management unit 32 of the core 22.

  The core abnormality management unit 32 includes an abnormality notification reception function 43. When abnormality core information is input from the core abnormality detection unit 31, the abnormality notification reception function 43 transmits a pre-reset notification described later to the abnormality notification reception function 43 of the other core. Further, when the abnormal core information is input from the core abnormality detection unit 31, the abnormality notification reception function 43 outputs the abnormal core information to the operation mode determination unit 33 of the own core. The abnormality notification receiving function 43 receives a pre-reset notification from another core. An arrow Y5 in FIG. 2 indicates that the abnormality notification reception function 43 of the core 21 transmits a pre-reset notification to the abnormality notification reception function 43 of the core 22. An arrow Y6 in FIG. 2 indicates that the abnormality notification reception function 43 of the core 22 transmits a pre-reset notification to the abnormality notification reception function 43 of the core 21. An arrow Y7 in FIG. 2 indicates that the abnormality notification reception function 43 of the core 21 transmits abnormal core information to the operation mode determination unit 33 of the core 21. An arrow Y8 in FIG. 2 indicates that the abnormality notification reception function 43 of the core 22 transmits abnormal core information to the operation mode determination unit 33 of the core 22.

  The operation mode determination unit 33 includes an operation mode determination function 44. When the abnormal core information is input from the core abnormality management unit 32, the operation mode determination function 44 determines the operation mode after reset and the core to be activated after reset based on the abnormal core indicated by the abnormal core information. . The core that is activated after the reset is a core other than the abnormal core indicated by the abnormal core information. Details of the process for determining the operation mode after reset will be described later.

  The operation mode determination unit 33 stores operation mode information indicating the determined operation mode in the operation mode storage unit 51 provided in the flash ROM 14. An arrow Y9 in FIG. 2 indicates that the operation mode determination unit 33 of the core 21 stores the operation mode information in the operation mode storage unit 51. An arrow Y10 in FIG. 2 indicates that the operation mode determination unit 33 of the core 22 stores the operation mode information in the operation mode storage unit 51.

  In addition, when the abnormal core information is input from the core abnormality management unit 32, the operation mode determination unit 33 performs a pre-reset process that is set in advance before being reset. Examples of the pre-reset process include saving necessary information after starting the core and setting the core port to the safe side. After the pre-reset process is completed, a reset request is output to the reset unit 34 of the own core. An arrow Y11 in FIG. 2 indicates that the operation mode determination unit 33 of the core 21 outputs a reset request to the reset unit 34 of the core 21. The arrow Y12 in FIG. 2 indicates that the operation mode determination unit 33 of the core 22 outputs a reset request to the reset unit 34 of the core 22.

The reset unit 34 outputs a reset request to the reset circuit 6 when a reset request is input. As a result, the reset circuit 6 resets the entire microcomputer 3.
When the operation mode determination unit 33 determines a core to be activated after reset, the operation mode determination unit 33 outputs activation core information indicating the core to be activated after reset to the activation core control unit 35. 2 indicates that the operation mode determination unit 33 of the core 21 outputs the activation core information to the activation core control unit 35 of the core 21. An arrow Y14 in FIG. 2 indicates that the operation mode determination unit 33 of the core 22 outputs the activation core information to the activation core control unit 35 of the core 22.

  When the activation core information is input, the activation core control unit 35 stores the activation core information in the register 24. Thereby, the clock supply circuit 25 refers to the activation core information stored in the register 24 after the reset, and selects the core that supplies the clock signal. Specifically, when the activation core information indicates the cores 21 and 22, the clock supply circuit 25 supplies a clock signal to the cores 21 and 22 and does not supply a clock signal to the core 23. Thereby, after resetting, the cores 21 and 22 are activated, and the core 23 is not activated. Similarly, when the activation core information indicates the cores 21 and 23, the clock supply circuit 25 supplies a clock signal to the cores 21 and 23 and does not supply a clock signal to the core 22. When the activation core information indicates the cores 22 and 23, the clock supply circuit 25 supplies a clock signal to the cores 22 and 23 and does not supply a clock signal to the core 21.

The process execution unit 36 includes an execution process determination function 45 and a process execution function 46.
The process execution unit 36 acquires operation mode information from the operation mode storage unit 51. An arrow Y15 in FIG. 2 indicates that the process execution unit 36 of the core 21 acquires the operation mode information from the operation mode storage unit 51. An arrow Y <b> 16 in FIG. 2 indicates that the processing execution unit 36 of the core 22 acquires operation mode information from the operation mode storage unit 51.

  The execution process determination function 45 determines an operation mode based on the operation mode information acquired by the process execution unit 36, and sets a process to be executed by the process execution function 46 based on the determined operation mode. An arrow Y17 in FIG. 2 indicates that the execution process determination function 45 of the core 21 sets a process to be executed by the process execution function 46 of the core 21. An arrow Y18 in FIG. 2 indicates that the execution process determination function 45 of the core 22 sets a process to be executed by the process execution function 46 of the core 22.

The process execution function 46 executes the process in the operation mode set by the execution process determination function 45.
The technique for realizing these elements constituting the cores 21, 22, and 23 is not limited to software, and some or all of the elements may be realized using one or a plurality of hardware. For example, when the above function is realized by an electronic circuit that is hardware, the electronic circuit may be realized by a digital circuit including a large number of logic circuits, an analog circuit, or a combination thereof.

Next, the procedure of the abnormality handling process executed by the cores 21, 22, and 23 will be described. The abnormality handling process is a process that is started after the cores 21, 22, and 23 are activated.
When this abnormality handling process is executed, as shown in FIG. 3, the cores 21, 22, and 23 first detect a core abnormality by using the own core abnormality detection function 41 and the core mutual monitoring function 42 in S10. . Then, in S20, it is determined whether or not an abnormal core is present based on the detection result in S10. If no abnormal core is present, the process proceeds to S10. On the other hand, if there is an abnormal core, the operation mode after reset is determined based on the abnormal core in S30. Specifically, when the abnormality occurrence core is the core 23, the operation mode is the first failsafe mode, and when the abnormality occurrence core is the core 22, the operation mode is the second failsafe mode, and the abnormality occurrence core is the core 21. In some cases, the operating mode is determined to be the third failsafe mode. Hereinafter, the first fail-safe mode, the second fail-safe mode, and the third fail-safe mode are collectively referred to simply as a fail-safe mode.

  In S40, operation mode information indicating the operation mode determined in S30 is stored in the operation mode storage unit 51. Further, in S50, a core to be activated after reset (hereinafter referred to as activation core) is determined based on the abnormality occurrence core. Specifically, when the abnormality occurrence core is the core 23, the activation core is the cores 21 and 22, and when the abnormality occurrence core is the core 22, the activation cores are the cores 21 and 23. Is the core 21, the activation core is determined to be the cores 22 and 23.

  In S60, activation core information indicating the activation core determined in S50 is stored in the register 24. Next, in S70, a pre-reset notification is transmitted to the other cores except the abnormal core. Thus, the core that has received the pre-reset notification executes pre-reset processing.

  Further, in S80, the above-described reset pre-processing is executed. When the pre-reset process ends, a reset request is output to the reset circuit 6 in S90, and the abnormality handling process ends.

Next, the procedure of initialization processing executed by the cores 21, 22, and 23 will be described. The initialization process is a process that is executed only once immediately after the cores 21, 22, and 23 are activated.
When this initialization process is executed, the cores 21, 22, and 23 obtain operation mode information from the operation mode storage unit 51 in S 210 as shown in FIG. In S220, it is determined whether or not the operation mode information is stored in operation mode storage unit 51. Here, when the operation mode information is not stored, in S230, a process to be executed in a normal mode to be described later is set based on the execution process table.

The execution process table is stored in the ROM 12, and processes executed by the cores 21, 22, and 23 are set for each operation mode.
For example, as shown in FIG. 5, in the execution process table, in the normal mode, the core 21 sequentially executes the processes A1, A2, A3, A4, A5, A6, and the core 22 performs the processes B1, B2, B3, B4. , B5 are sequentially executed, and the core 23 is set to sequentially execute the processes C1, C2, C3, C4, and C5.

  In the execution process table, in the first failsafe mode, the core 21 sequentially executes the processes A1, C2, A3, A5, and A6, the core 22 sequentially executes the processes B1, C4, and B4, and the core 23 It is set not to execute processing.

  The execution processing table indicates that in the second fail-safe mode, the core 21 sequentially executes the processes A1, B2, A3, A5, and A6, the core 23 sequentially executes the processes C2, B4, and C4, and the core 22 It is set not to execute processing.

  In the third fail-safe mode, the core 22 sequentially executes processes A1, B2, B4, and A6, the core 23 sequentially executes processes C2, A3, A5, and C4, and the core 21 It is set not to execute processing.

  Accordingly, in S230, for example, the core 21 is set to sequentially execute the processes A1, A2, A3, A4, A5, and A6, and the core 22 sequentially executes the processes B1, B2, B3, B4, and B5. Thus, the core 23 is set to sequentially execute the processes C1, C2, C3, C4, and C5.

  The execution process table shown in FIG. 5 shows a part of the processes executed by the cores 21, 22, and 23. For example, the cores 21, 22, and 23 execute at least an angle synchronization task and a time synchronization task. The angle synchronization task is executed every time a preset angle event generation condition is satisfied. The angle event generation condition is, for example, that the crankshaft rotates in a preset event generation angle (for example, 30 ° CA). The time synchronization task is executed every time a preset time event generation condition is satisfied. The time event generation condition is, for example, that a preset event generation time (for example, 1 ms) elapses.

  In the execution process table, at least a process executed in the angle synchronization task and a process executed in the time synchronization task are set. The execution process table illustrated in FIG. 5 indicates, for example, processes executed in the time synchronization task.

  On the other hand, as shown in FIG. 4, when the operation mode information is stored in the operation mode storage unit 51 in S220, the first failsafe mode is determined in S240 based on the operation mode information and the execution processing table. The process to be executed in the second failsafe mode or the third failsafe mode is set. For example, when the operation mode indicated by the operation mode information is the second failsafe mode, the core 21 is set to sequentially execute the processes A1, B2, A3, A5, and A6, and the core 23 is set to the process C2. , B4, C4 are set to be executed sequentially.

Thereafter, in S250, the process execution unit 36 is started to execute the process set in S240, and the initialization process is terminated.
Thereby, as shown in FIG. 6, when the cores 21, 22, and 23 are normal (that is, in the normal mode), the core 21 performs processing A1, A2, A3, A4 each time the execution timing comes. , A5, A6 are sequentially executed, the core 22 sequentially executes the processes B1, B2, B3, and B4, and the core 23 sequentially executes the processes C1, C2, C3, C4, and C5.

  When the core 23 is abnormal (that is, the first failsafe mode), the core 21 sequentially executes the processes A1, C2, A3, A5, and A6 each time the execution timing comes. The processes B1, C4, and B4 are sequentially executed, and the core 23 does not execute the processes.

  When the core 22 is abnormal (that is, the second fail-safe mode), the core 21 sequentially executes the processes A1, B2, A3, A5, and A6 each time the execution timing arrives. The processes C2, B4, and C4 are sequentially executed, and the core 22 does not execute the processes.

  When the core 21 is abnormal (that is, the third fail-safe mode), the core 22 sequentially executes the processes A1, B2, B4, and A6 each time the execution timing comes, and the core 23 performs the process C2, A3, A5, and C4 are sequentially executed, and the core 21 does not execute processing.

In this manner, during fail-safe, the ECU 1 executes only the processing necessary for the retreat travel among the processing executed at the normal time using the normal core.
Here, a method for enabling the processing of an abnormal core to be executed by another core will be described. In order to simplify the explanation, as shown in FIG. 7, it is assumed that the core A sequentially executes the processes A1, A2 and A3 and the core B sequentially executes the processes B1 and B2 as shown in FIG. .

  It is assumed that programs PG1, PG2, PG3, PG4, PG5, PG6, and PG7 are stored in the ROM. The program PG1 is a program for the core A to execute various processes. The program PG2 is a program for the core B to execute various processes. The program PG3 is a program for executing the process A1. The program PG4 is a program for executing the process A2. The program PG5 is a program for executing the process A3. The program PG6 is a program for executing the process B1. The program PG7 is a program for executing the process B2.

The execution process table is stored in the ROM, and processes executed by the core A and the core B are set for each operation mode.
This execution processing table is set so that, in the normal mode, the core A sequentially executes the processes A1, A2, and A3, and the core B sequentially executes the processes B1 and B2. In the first fail-safe mode, the execution process table is set so that the core A sequentially executes the processes A1, A2, and B1, and the core B does not execute the process. In the second fail-safe mode, the execution process table is set so that the core B sequentially executes the processes A1, A2, and B1, and the core A does not execute the process.

  The program PG1 specifies the execution process ID based on the execution process table [0], [operation mode], and the process number [i] while sequentially incrementing the process number i, and executes the specified process. Similarly, the program PG2 specifies the execution process ID by the execution process table [1], [operation mode], and the process number [i] while sequentially incrementing the process number i, and performs the specified process. Run.

  The execution process table [0] specifies the core A in the execution process table. The execution process table [1] specifies the core B in the execution process table. [Operation mode] is set to one of “normal”, “first fail-safe mode”, and “second fail-safe mode”.

  For example, in the program PG1, when the [operation mode] is “normal”, the process A1 is performed by referring to the execution process table when the number of processes is [0], [1], and [2]. , A2 and A3 are set. Thus, in the program PG1, the processes A1, A2, and A3 are sequentially executed by the process execution (execution process ID).

  Similarly, in the program PG2, when the [operation mode] is “normal”, the execution process IDs indicating the processes B1 and B2 are set when the number of processes is [0] and [1], respectively. Thereby, in the program PG2, the processes B1 and B2 are sequentially executed by the process execution (execution process ID).

  In the program PG1, when the [operation mode] is the “first failsafe mode”, the execution process table is referred to when the number of processes is [0], [1], and [2], respectively. , Execution process IDs indicating the processes A1, A2, and B1 are set. Thereby, in the program PG1, the processes A1, A2, and B1 are sequentially executed by the process execution (execution process ID).

  Similarly, in the program PG2, when the [operation mode] is the “second failsafe mode”, the processes A1, A2, and B1 are performed when the number of processes is [0], [1], and [2], respectively. The execution process ID shown is set. Thereby, in the program PG2, the processes A1, A2, and B1 are sequentially executed by the process execution (execution process ID).

Next, a specific example of the operation of the cores 21 to 23 will be described.
As illustrated in FIG. 8, first, it is assumed that an abnormality occurs in the core 23 and the core 22 detects an abnormality in the core 23. In this case, the core 22 determines the operation mode and the core to be activated after reset. Then, the core 22 transmits a pre-reset notification to the core 21. The core 21 that has received the pre-reset notification executes pre-reset processing. Furthermore, the core 22 transmits a reset request to the reset circuit 6 after executing the pre-reset process. As a result, the reset circuit 6 resets the entire microcomputer 3. Thereafter, the cores 21 and 22 are activated. Each of the activated cores 21 and 22 sets a process to be executed based on the operation mode determined by the core 22 and starts executing the set process.

  The microcomputer 3 configured as described above includes a core 21 that executes processes A1, A2, A3, A4, A5, and A6, a core 22 that executes processes B1, B2, B3, and B4, and processes C1, C2, and C3. , C4, and C5.

The core abnormality detection unit 31 of the cores 21, 22, 23 identifies an abnormality occurrence core among the cores 21, 22, 23.
The operation mode determination unit 33 of the cores 21, 22, and 23 determines the operation mode based on the specified abnormality occurrence core.

The reset unit 34 of the cores 21, 22, 23 resets the cores 21, 22, 23 by transmitting a reset request to the reset circuit 6 when an abnormal core is specified.
The activation core control unit 35 of the cores 21, 22, 23 stores the activation core information in the register 24, so that after the cores 21, 22, 23 are reset, the abnormal cores among the cores 21, 22, 23 are reset. Start a non-core.

  The execution process determination function 45 of the cores 21, 22, and 23 sets, for each activated core, a process to be executed by the core after activation of a core other than the abnormality-occurring core based on the determined operation mode.

  Thus, since the cores 21, 22, and 23 are reset when the abnormal core is specified, the microcomputer 3 can eliminate the influence of the abnormality when an abnormality occurs in one core. In addition, since the microcomputer 3 activates the cores other than the abnormality occurring core among the cores 21, 22, and 23, the influence caused by the abnormality caused by the abnormality occurring core after the reset can be suppressed. The microcomputer 3 sets processing to be executed for each activated core based on the operation mode. For this reason, the microcomputer 3 can assign the process executed by the abnormal core before the reset to a normal core, and can suppress the process that cannot be executed after the reset to the minimum necessary.

  In addition, the microcomputer 3 executes a pre-reset process that is set in advance so that the cores 21, 22, and 23 are executed before the cores 21, 22, and 23 are reset. Let Thereby, the microcomputer 3 can put the microcomputer 3 in an appropriate state during the reset waiting period, and can suppress the occurrence of an abnormality caused by the reset.

  In the embodiment described above, the core abnormality detection unit 31 corresponds to the abnormality identification unit, the operation mode determination unit 33 corresponds to the mode determination unit, the activation core control unit 35 corresponds to the activation unit, and the execution process determination function 45. Corresponds to a process setting unit.

Further, processes A1 to A6, B1 to B4, and C1 to C5 correspond to arithmetic processes, and S70 and S80 correspond to processes as a preprocessing execution unit.
As mentioned above, although one embodiment of this indication was described, this indication is not limited to the above-mentioned embodiment, and can carry out various modifications.

[Modification 1]
For example, in the above-described embodiment, the abnormality-occurring core is not activated after being reset. However, the abnormality-occurring core may be invalidated by putting processing in an infinite loop. In a microcomputer having an appropriate core operation mode, the operation mode (for example, Sleep, Safe, Run, etc.) of the abnormal core may be changed.

[Modification 2]
In the above embodiment, the operation mode is determined based on the abnormality occurrence core. However, in addition to the abnormality occurrence core, the operation mode is determined based on at least one of the abnormality type and the current software status. You may make it do. The types of abnormalities are, for example, WDT interrupts and exception interrupts. The current software status is, for example, during Init, Shutdown, or during base processing.

[Modification 3]
In the above-described embodiment, the operation mode is determined as one of the three fail-safe modes when there is one abnormality occurrence core. However, assuming that there are two or more abnormality occurrence cores, the failure is assumed. You may make it set safe mode. Moreover, you may make it determine in any of 4 or more fail safe modes according to the combination of the core which operate | moves normally.

[Modification 4]
In the above-described embodiment, when an abnormal core is present, the normal core is used to execute less processing than in the normal mode. However, in a situation where the processing load of the microcomputer is low (for example, a situation where the engine speed is low), all processes executed by the abnormal core are assigned to normal cores, so that even in fail-safe mode, normal mode You may make it perform all the processes similarly to time.

[Modification 5]
In the above embodiment, the operation mode is switched to the fail-safe mode when an abnormality occurs in the core. However, when the abnormality continues in the same core even if the preset number of times of switching determination is repeated, the operation mode May be switched to fail-safe mode. Further, the number of switching determinations may be changed according to the vehicle state or the microcomputer state. For example, when the vehicle speed is 0 km / h, or while the microcomputer is initializing, the reset can be safely performed, so the number of switching determinations may be increased.

[Modification 6]
In the above embodiment, the microcomputer has three cores. In the future, as the number of cores mounted on microcomputers increases, the probability of core failures also increases. However, since the processing ratio per core is lowered, for example, one core may be used as a spare core, and another core may be replaced with a spare core when the other core fails.

[Modification 7]
In the above-described embodiment, the operation mode is determined based on the abnormality occurrence core. However, the operation mode may be determined by confirming a plurality of past information in the abnormality occurrence core. The operation mode may be determined by confirming the previous one-time information.

[Modification 8]
In the above embodiment, the microcomputer has three cores. However, when a relationship is established in which one core is a master core and the remaining cores are slave cores, and the master core monitors the slave core, if an abnormality occurs in the master core, the function of the master core is You may make it move to a slave core. If a double failure does not occur, evacuation travel is possible.

[Modification 9]
In the above-described embodiment, the case where the abnormal core is not activated after resetting when an abnormality occurs is shown, but a part of the normal core may not be activated after resetting.

[Modification 10]
In the said embodiment, the core which detected abnormality sets what sets the core started after resetting an operation mode. However, if priorities are set in advance in the core and an abnormality occurs in the core, the core with the highest priority among the cores in which no abnormality has occurred determines the operation mode and starts after resetting. A core may be set. Here, a specific example of the operation of the cores 21 to 23 when the core having the highest priority is configured to determine the operation mode will be described.

  As shown in FIG. 9, first, it is assumed that an abnormality occurs in the core 23 and the core 22 detects an abnormality in the core 23. In this case, the core 22 determines the core 21 having the highest priority among the cores in which no abnormality has occurred as the control core. Then, the core 22 transmits an abnormality occurrence notification to the core 21 that is the control core. Thereby, the core 21 determines the operation mode and sets the core to be activated after reset. Further, the core 21 transmits a reset request to the reset circuit 6. As a result, the reset circuit 6 resets the entire microcomputer 3. Thereafter, the cores 21 and 22 are activated. Each of the activated cores 21 and 22 sets a process to be executed based on the operation mode determined by the core 22 and starts executing the set process.

[Modification 11]
In the above-described embodiment, the reset circuit 6 is reset after the abnormal core is detected. However, the operation of the abnormal core may be stopped before the reset circuit 6 performs the reset. . In order to stop the operation of the abnormal core, for example, the clock supply to the abnormal core may be stopped. Thereby, it can suppress that an abnormal core performs abnormal operation | movement before resetting.

[Modification 12]
In the above modification 11, the operation of the abnormal core is stopped before resetting, but the processing of the abnormal core may be put in an infinite loop.

[Modification 13]
In the above embodiment, a normal core that does not have an abnormality has been shown to perform pre-reset processing before resetting.However, before a reset is performed, a normal core is detected before an abnormal core is reset. You may make it also perform the process which should be performed. Thereby, the microcomputer can be brought into an appropriate state before resetting, and occurrence of an abnormality caused by the reset can be suppressed.

  In addition, the function of one component in the above embodiment may be shared by a plurality of components, or the function of a plurality of components may be exhibited by one component. Moreover, you may abbreviate | omit a part of structure of the said embodiment. In addition, at least a part of the configuration of the above embodiment may be added to or replaced with the configuration of the other embodiment. In addition, all the aspects included in the technical idea specified from the wording described in the claims are embodiments of the present disclosure.

  In addition to the microcomputer 3 described above, the present disclosure is disclosed in various forms such as a system including the microcomputer 3 as a constituent element, a program for causing a computer to function as the microcomputer 3, a medium storing the program, and a method for executing an abnormal process. It can also be realized.

DESCRIPTION OF SYMBOLS 3 ... Microcomputer, 21, 22, 23 ... Core, 31 ... Core abnormality detection part, 33 ... Operation mode determination part, 34 ... Reset part, 35 ... Activation core control part, 45 ... Execution process determination function,

Claims (3)

A microcomputer (3) comprising a plurality of cores (21, 22, 23) for executing one or more arithmetic processes,
Among the plurality of cores, an abnormality identification unit (31) configured to be able to identify an abnormality occurrence core that is the core in which an abnormality has occurred;
A mode determination unit (33) configured to determine an operation mode for the cores other than the abnormality occurrence core to execute the arithmetic processing based on the abnormality occurrence core identified by the abnormality identification unit; ,
A reset unit (34) configured to reset a plurality of the cores when the abnormality identification unit identifies the abnormal core;
An activation unit (35) configured to activate the core other than the abnormality-occurring core identified by the abnormality identification unit among the plurality of cores after the plurality of cores are reset;
Based on the operation mode determined by the mode determination unit, for each activated core, one or more arithmetic processes to be executed by the core after the core other than the abnormal core is activated are set. And a processing setting unit (45) configured as described above. The microcomputer according to claim 1,
The abnormality-occurring core is a microcomputer whose operation is stopped before a plurality of the cores are reset. A microcomputer according to claim 1 or 2,
Before the plurality of cores are reset, before the resetting process, which is set in advance to be executed before the cores are reset, is configured to cause at least the cores other than the abnormal core to execute A microcomputer provided with a process execution unit (S70, S80).

Images