JP2018151717A - Automobile electronic control device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an automobile electronic control device capable of performing initialization in an equivalent time period with a normal condition regardless of the number of faulty cores.SOLUTION: A core 1110 transmits question data to a core 1120. On the basis of the received question data, answer data is calculated with a predetermined calculation formula, and it is returned to the core 1110. The core 1110 receives the answer data from the core 1120. The core 1110 uses correct answer data preliminarily embedded in a program, and is compared with the data returned from the core 1120. When the data calculated by the core 1120 and the correct answer data match, it is determined to be normal and the core 1120 performs normal control. If the answer data calculated by the core 1120 and the correct answer data do not match, the core 1120 is stopped. In the logic, the diagnosis of the core 1120 is conducted by replacing the core 1110 with the core 1120.SELECTED DRAWING: Figure 5

Description

The present invention relates to an initialization technology for an electronic control device for an automobile.

  2. Description of the Related Art In recent years, automotive electronic control devices including a single CPU (hereinafter referred to as a multi-core CPU) having a plurality of arithmetic units (hereinafter referred to as cores) have become widespread. One of the purposes of a multi-core CPU is a robust system against a certain core failure. That is, when a certain core fails and this is detected by another core, the processing of the failed core is replaced with a normal core. In many cases, the reduced amount of processing is performed to perform degenerate operation. Rather than stopping the device completely, it is safer to perform degenerate operation with limited functions. Even during degenerate operation, safety equivalent to normal control during normal operation is ensured. For this purpose, simple processing is performed while avoiding a prolonged processing time.

In Japanese Patent Application Laid-Open No. 2013-200462, in a multi-core CPU, an independent core A and a certain core B perform initialization processing, thereby enabling a reduction in startup time.

  Even when the core A of the multi-core CPU is faulty at the time of initialization, the electronic control unit is initialized and started in order to perform the degenerate operation by the core B. At this time, there is a problem that the function initialized by the core A is not initialized.

  Also, there is a problem that initialization cannot always be performed in parallel. For example, after starting up, while core A is setting the CPU clock, core B cannot initialize other functions. Alternatively, depending on the function, the amount of initialization may be large and the core B may wait while the core A is being initialized. As described above, there is a case where the core B waits while the core A is initializing.

  In addition, there is a problem that the initialization completion time at the time of abnormality is slower than normal. Assume that a failure is detected for core A when the normality of the core is determined after initialization is completed. In this case, with respect to the function initialized by the failed core A, the core B needs to perform initialization again. All functions are initialized by Core B, and the difference between the initialization processing time of Core A and the initialization processing time of Core B, that is, the waiting time of Core B, is more abnormal than normal. The initialization time is longer.

  The present invention is a means for solving these problems.

  In order to solve the above-described problem, the electronic control apparatus for an automobile of the present invention starts the initialization process simultaneously with a plurality of cores, and performs the initialization process for the same function redundantly with the plurality of cores.

  According to the present invention, it is possible to perform initialization in a time equivalent to that in the normal time regardless of the number of cores that have failed. As a result, the driver does not feel uncomfortable. Also, the software control start time is constant with respect to the hardware startup time, and it is not necessary to switch the control logic of the hardware control between normal and abnormal.

It is the schematic of the electronic controller for motor vehicles. It is a figure which shows the initialization process by two normal cores. It is a figure which shows the failure determination method by mutual monitoring of a core. It is a figure which shows the initialization process containing the individual part for control initialization. It is a figure which shows the initialization process at the time of core abnormality. It is a figure which performs RAM setting and failure determination at the time of initialization. It is a figure which shows the process sequence which performs the setting of RAM and failure determination at the time of initialization. It is a figure which determines whether initialization of the other core is implemented correctly. It is a figure which shows normal control implementation after the initialization process by three or more cores.

  Embodiments of the present invention will be described below with reference to the drawings.

  A first embodiment of the present invention will be described with reference to FIGS.

  As shown in FIG. 1, power is supplied to an automobile electronic control device 10 (hereinafter referred to as ECU) from an external battery and is controlled by a power supply IC. When the user turns on the ignition switch, the power supply IC supplies power to the microcomputer 100 from the external connection port and inputs a reset signal to the microcomputer 100. In response to the reset signal, the cores 1110, 1120, 1130, and 1140 in the CPU (Central Processing Unit) 1100 built in the microcomputer 100 simultaneously start operation.

  FIG. 2 shows an initialization procedure in the case where the number N of cores is 2 as the first embodiment.

  In the first embodiment, the initialization program used in each core is stored in the ROM 1300, and the CPU 1110 reads the program from the ROM 1300 and executes it.

  The initialization procedure is shown in FIG.

  The timing at which the calculation is started by the reset signal is t1000. At timing t1000, the core 1110 starts to initialize each function of the microcomputer 100 according to the initialization program 1500. For example, a clock, a timer, an external output, and a shared memory are functions commonly used by the core 1110 and the core 1120.

  On the other hand, the core 1120 also starts initialization of each function of the microcomputer 100 according to the initialization program 1500. That is, the core 1110 and the core 1120 use the same program. This facilitates program creation and management.

  When the core 1110 and the core 1120 execute a program at the same time, the calculation can be executed at the same time in time because each core is independent. However, when accessing the shared function, for example, the shared register 1101 of FIG. 1, resource contention occurs. The CPU has an arbitration function in the bus 1190 to arbitrate such contention. That is, even if the core 1110 and the core 1120 start executing simultaneously, when setting the shared function, the core arbitration function, for example, the core 1110 is prioritized and the core 1120 is waited, without causing a conflict. Initialization is successful. As a side effect, the execution times of the core 1110 and the core 1120 are shifted. This time is the resource sharing waiting time t212 and is not the time that the behavior of the automobile is affected or the driver notices. In any case, at time t1001 when the core 1110 completes the initialization process 10011, the initialization process 10021 of the core 1120 is being executed. For this reason, if the core 1110 makes a failure determination of the core 1120 at this time, the core 1120 may not be able to respond and a determination error may occur. Therefore, an explicit wait process is performed between the initialization process and the failure determination. These waiting processes are 10012 and 10028.

  Thereafter, the cores are determined to fail each other. FIG. 3 shows a failure determination method based on mutual monitoring of cores.

  In S3400, the core 1110 transmits the problem data to the core 1120. The core 1120 receives the problem data transmitted from the core 1110 in S3500. Based on the problem data received in S3501, answer data is calculated using a predetermined calculation formula, and is returned to the core 1110 in S3502. The core 1110 receives the response data from the core 1120 in S3401.

  In S3402, the core 1110 uses the correct data embedded in the program in advance, and collates with the data returned from the core 1120. If the data calculated by the core 1120 matches the correct answer data, it is determined as normal and the core 1120 performs normal control S3043. On the other hand, if the answer data calculated by the core 1120 does not match the correct answer data, the core 1120 is stopped in S3404.

  In the logic, the core 1110 and the core 1120 are exchanged to diagnose the core 1120.

  If the normality of both cores is confirmed by the failure determination, control 2015 and 2025 are performed. The normal control is an optimal control in which functions are distributed among the cores.

  On the other hand, when the core 1110 detects an abnormality of the core 1120, the core 1110 switches to the degenerate operation mode. In this case, since the operation is performed only with the core 1110, the control 2015 is for the degenerate operation.

  Even in this case, since the initialization of the function is completed, there is no need to start over. In other words, the initialization of the function is completed in the same time as normal, and the transition to the degenerate operation mode can be started.

  In the present embodiment, since the same initialization program is used for the core 1110 and the core 1120, the creation and management of the program become easy.

  A second embodiment of the present invention will be described with reference to FIGS. Note that the description of the same configuration as that of the first embodiment is omitted.

  In the second embodiment, as shown in FIG. 4, initialization is divided into common part initialization, which is the minimum initialization for performing failure determination, and individual part initialization, which is initialization for control. To implement.

  Similar to the first embodiment, the common unit initialization 11011 and the common unit initialization 11021 are the same program. Alternatively, in order to avoid resource contention while the register 1101 is being initialized by the common unit initialization 11011, the common unit initialization 11021 initializes the shared RAM 1200, and then the common unit initialization 11011 is initializing the shared RAM 1200. In addition, the common unit initialization 11021 may initialize the register 1101. As a result, it is possible to increase the speed without waiting for resource competition.

  The failure determination is the same as in the first embodiment.

  If the result of the failure determination is normal, the core 1110 performs individual unit initialization 11014 in accordance with the control 11015. For example, initialization of the local RAM 1150. In addition, the core 1120 performs individual unit initialization 11024 in accordance with the control 11025.

  On the other hand, when a failure of the core 1120 is detected in the failure determination 11013, as shown in FIG.

  The individual unit initialization 12014 is initialization for degenerate operation. For example, the value of the local RAM 1150 is different from the individual unit initialization 11014. The stop process 12024 is, for example, an infinite loop process or a core 1120 clock stop process by the core 1110, and prevents the failed core 1120 from accessing the shared function.

  In the second embodiment, the time from the start to the failure determination can be made equal between the normal time and the core failure time.

  The third embodiment of the present invention will be described with reference to FIGS. 6 to 8. Note that the description of the same configuration as the previous embodiment is omitted.

  In the third embodiment, RAM setting and failure determination are performed during initialization. The initialization process is shown in FIG.

  The timing for starting the operation by the reset signal is t210. At timing t <b> 210, the core 1110 starts to initialize the shared memory 1200 of the microcomputer 100 in accordance with the common unit initialization program 2111.

  On the other hand, the core 1120 also starts initialization of each function of the microcomputer 100 according to the common unit initialization program 2122.

  The processing of the common initialization program 2111 at this time is shown in FIG.

  That is, initialization S3000 of variable a stored in global RAM 1200, initialization S3001 of variable b, and initialization S3002 of variable c are performed.

  During this time, the core 1120 executes the common unit initialization program 2121. This process is shown in FIG. That is, in S3100, the core 1120 confirms the accuracy by checking whether the initialization performed by the core 11110 is correctly performed by reading the initialization variable a and checking the data to be written S3100.

  If it is determined that the initialization has not been performed normally, the core normal flag of the core 1110 is turned OFF S3101. Incidentally, the core normal flag is set to ON before S3100. In this case, since initialization could not be normally performed in the core 1110, the core 1120 performs initialization of the variable a in S3102. This procedure is also performed for variables b and c.

  By this processing, it is possible to determine the failure of the core 1110. At this point, the diagnosis of the core 1120 has not been completed. Next, in order to diagnose the core 1120, the execution order is changed. In the processing 2111 and the processing 2121, since the processing 2121 includes the determination processing, the processing time becomes long. Therefore, the core 1110 performs a waiting process 2112 and waits until the core 1120 starts the common unit initialization 2123. The common part initialization 2123 process is shown in FIG. Further, the common part initialization 2113 process is shown in FIG. When the core 1110 reads and diagnoses the RAM initialization of the preceding core 1120, when the core 1120 is abnormal, the diagnosis is performed using the core 1120 normal flag.

  The core 1120 performs a waiting process 2122 to adjust the processing time difference.

  Finally, in the failure determination 2114 and the failure determination 2124, the core normal flag is determined and the core failure is detected mutually.

  For example, when the core 1120 is stopped, the core 1120 normal flag is OFF. Since the processing of the core 1110 does not change between when the core 1120 is normal and when it fails, the time for the start completion t215 is the same.

  According to this embodiment, it is possible to detect a core failure when the initialization of the core is completed.

  A fourth embodiment of the present invention will be described with reference to FIG. The description of the same configuration as in the previous embodiment is omitted.

  In this embodiment, an initialization procedure in the case of a CPU having a core number N of 3 or more is shown using FIG.

  The timing for starting the operation by the reset signal is t220. At timing t <b> 220, the core 1110 starts to initialize each function of the microcomputer 100 according to the common unit initialization program 2211.

  On the other hand, the core 1120, the core 1130, and the core 1140 also start initialization of each function of the microcomputer 100 in accordance with each common unit initialization program.

  When the number of cores is 3 or more, a core to be paired is determined in advance, and failure determination is performed based on the pair. For example, a core 1110 and a core 1120, and a core 1130 and a core 1140 are used.

  In this way, using the cores that are paired in advance, the common part initialization, the failure determination, and the individual part initialization described in the first embodiment are performed between the paired cores. In other words, the core 1110 does not need to wait for the common part initialization process of the core 1130 or the core 1140 that is not a pair, but only waits for the common part initialization process 2221 of the paired core 1120 to be completed.

  However, since the normal control start t226 that is the timing for starting the normal control needs to be aligned for all the cores, the waiting process 2215 of the core 1110, the waiting process 2225 of the core 1120 after completion of the individual unit initialization process in each core, the core A waiting process 2235 of 1130 and a waiting process 2245 of the core 1140 are executed.

  In this embodiment, no matter which core fails, the start-up time is equivalent to that at normal time.

Claims (3)

A CPU for controlling vehicle functions;
Having a plurality of cores that are arithmetic units inside the CPU,
An automotive electronic control device that initializes a common part with the plurality of cores,
An electronic control device for an automobile, wherein the same initialization program is executed by a plurality of cores after the ECU is started and before the core failure is determined. Having three or more cores,
The automotive electronic control device according to claim 1, wherein cores to be paired are determined in advance before initialization processing, and the same function is initialized for each pair.   A certain core A starts the initialization program in preference to a certain core B, the order of the initialization is changed in the middle, and the core B performs initialization in preference to the core A The automobile electronic control device according to claim 1.

Images