JP2020126353A - Vehicle control device and operation clock switching method - Google Patents

Abstract

To reliably allow duplicate processing of a task by using a plurality of CPUs mounted in a vehicle control device.SOLUTION: It is monitored whether a plurality of CPUs mounted in a vehicle control device are executing tasks or not, and it is determined that an operation clock can be switched to a slow operation clock in each CPU of the CPUs if the CPU is not executing any task. It is determined whether it has been determined that the operation clock can be switched to the slow operation clock in another CPU or not. If it is determined that the operation clock can be switched to the slow operation clock in another CPU, the operation clock is switched to the slow operation clock there. Thus, partial CPUs of the plurality of CPUs are prevented from falling into a sleep mode. As a result, the plurality of CPUs can be used to reliably perform duplicate processing in response to the occurrence of a task to be subjected to duplicate processing.SELECTED DRAWING: Figure 1

Description

The present invention relates to a technique for operating a vehicle control device equipped with a plurality of CPUs (so-called central processing unit).

Today's vehicles are controlled by a vehicle controller equipped with a CPU (so-called central processing unit). Among these vehicle control devices, there is also proposed a vehicle control device in which a plurality of CPUs are mounted and processing is shared so that complicated and sophisticated control can be executed (Patent Document 1). ..
Here, among the components mounted in the vehicle control device, the CPU consumes relatively large amount of power, and therefore, when there are no tasks to be processed, the CPU shifts to a slow operating state (so-called sleep state) in which the operation is slow. Therefore, it is usual to suppress the power consumption.

Further, in a vehicle control device equipped with a plurality of CPUs, it has been proposed that the safety is ensured by performing redundant processings by a plurality of CPUs for processing considered important for safety.

JP, 2007-327348, A

However, there is a problem that even if an attempt is made to ensure safety by utilizing the fact that a plurality of CPUs are mounted, a situation may occur in which sufficient safety cannot be ensured. The reason for this is that some CPUs may have been switched to the sleep state when a task to be duplicated occurs. In such a case, the remaining CPUs except the CPU in the low-speed operating state process This is because there is a possibility that duplicate processing cannot be performed.

The present invention has been made in order to solve the above-mentioned problems in the prior art, and ensures safety by duplicating tasks using a plurality of CPUs mounted in a vehicle control device. The purpose is to provide the technology that can be done.

In order to solve the above-mentioned problems, in the vehicle control device and the operation clock switching method of the present invention, a plurality of CPUs mounted in the vehicle control device monitor whether or not there is a task to be executed, and the task to be executed is If not, it is determined that the operation clock can be slowed down. Then, it is determined whether or not it is possible to reduce the speed of the other CPU, and if it is determined that the speed of the other CPU can also be reduced, the operation clock is changed from the standard operation clock of the standard speed to the standard speed. Also switches to a low-speed low-speed operation clock. On the other hand, if the other CPU does not determine that the speed can be reduced, the operation clock is held as the standard operation clock of the standard speed.

With this arrangement, the operation clocks of some of the plurality of CPUs mounted on the vehicle control device do not switch to the low-speed operation clocks, and the so-called sleep state does not occur. As a result, when a task to be duplicated occurs, it is possible to reliably perform duplicated processing using a plurality of CPUs.

It is a block diagram showing a rough internal structure of vehicle control device 100 of this example which mounts a plurality of CPUs. In the conventional vehicle control device 900 equipped with a plurality of CPUs, it is an explanatory diagram showing the reason why safety may not be ensured due to duplicate processing. 6 is a flowchart of a process in which CPUs 110 and 120 mounted on the vehicle control device 100 according to the present embodiment switch an operation clock to a low speed operation clock. In the vehicle control device 100 of the present embodiment, it is an explanatory diagram showing the reason why safety can be ensured by the overlapping process.

Hereinafter, in order to clarify the content of the present invention described above, examples of the present invention will be described.
A. Device configuration :
FIG. 1 shows a rough internal structure of a vehicle control device 100 of this embodiment. As shown in the figure, the vehicle control device 100 according to the present embodiment includes a plurality (two in the illustrated example) of CPUs 110 and 120, and an external clock generation unit 130 that supplies an operation clock to these CPUs 110 and 120. It is installed. Further, the vehicle control device 100 is also equipped with an interface unit (not shown), and the CPUs 110 and 120 connect to an in-vehicle network (so-called CAN) via the interface unit so as to exchange data and external devices. It is possible to send and receive commands. Further, the states of the various switches SW1 to SW3 are also input to the CPUs 110 and 120 via the interface unit, and conversely, the drive signals OUT1 and OUT2 output from the CPUs 110 and 120 to the external device are also transmitted via the interface unit. Is output.

Further, the CPU 110 includes an input/output unit 111, a task execution unit 112, a clock switching unit 113, a built-in clock generation unit 114, and a determination unit 115. Similarly, the CPU 120 also includes an input/output unit 121, a task execution unit 122, a clock switching unit 123, a built-in clock generation unit 124, and a determination unit 125.
It should be noted that these "sections" are abstract concepts in which the functions of the CPUs 110 and 120 for switching operation clocks are classified for convenience, and the insides of the CPUs 110 and 120 are physically referred to as "sections". It does not mean that it is divided into. These “units” can be realized as hardware built into the CPUs 110 and 120, can be realized as firmware executed on the hardware, and are also realized as a combination thereof. You can also

The input/output units 111 and 121 perform input/output of data, commands and the like with the interface unit (not shown) described above.
The task execution units 112 and 122 execute the tasks corresponding to the commands based on the commands received by the input/output units 111 and 112. A task is executed by performing an arithmetic operation or a logical operation on a special memory called a register in a predetermined order. The arithmetic operation or the logical operation is executed according to an operation clock.

The clock switching units 113 and 123 are connected to the built-in clock generation units 114 and 124 and the external clock generation unit 130, and the operation clocks generated by the built-in clock generation units 114 and 124 or generated by the external clock generation unit 130. One of the selected operation clocks is selected and supplied to the task execution units 112 and 122. The external clock generation unit 130 generates a standard operation clock for operating the task execution units 112 and 122 at a standard speed.
Further, the built-in clock generation units 114 and 124 generate a low speed operation clock for operating the task execution units 112 and 122 at a speed lower than the standard speed.

The determination units 115 and 125 monitor the presence/absence of tasks (and tasks waiting to be executed) in the task execution units 112 and 125, and when there are no tasks (and tasks waiting to be executed) that are being executed. , It is determined that the operation clock can be switched to the low speed operation clock. Then, the clock switching units 113 and 123 switch the operation clocks supplied to the task execution units 112 and 122 from the standard operation clocks to the low speed operation clocks based on the determination results of the determination units 115 and 125.

Here, the determination unit 115 and the determination unit 125 of this embodiment can communicate with each other and share the determination results of each other. That is, the determination unit 115 holds information regarding whether or not the determination unit 125 has determined that the low speed operation clock can be switched, and the determination unit 125 determines whether the determination unit 115 has determined that the low speed operation clock can be switched. Holds information about whether or not.
The clock switching unit 113 maintains the standard operation clock when the determination unit 115 determines that the low speed operation clock can be switched to, but the determination unit 125 does not determine that the low speed operation clock can be switched to. If both the determination unit 115 and the determination unit 125 have determined that the low speed operation clock can be switched, the operation clock is switched to the low speed operation clock. Similarly, with respect to the clock switching unit 123, if the determination unit 125 determines that the low speed operation clock can be switched, but the determination unit 115 does not determine that the low speed operation clock can be switched, the standard operation clock is maintained. Therefore, when both the determination unit 115 and the determination unit 125 have determined that the low speed operation clock can be switched, the operation clock is switched to the low speed operation clock.
By doing so, it becomes possible for the plurality of CPUs 110 and 120 mounted in the vehicle control device 100 to reliably perform the overlapping processing, and it is possible to control the vehicle sufficiently safely. Hereinafter, this point will be described in detail.

FIG. 2 shows the reason why there is a case where a task to be duplicated by a plurality of CPUs cannot be duplicated when the decision units 115 and 125 do not share their decision results. ..
The vehicle control device 900 shown in FIG. 2 is equipped with two CPUs a910 and b920. Similar to the CPUs 110 and 120 described above with reference to FIG. 1, these CPUa910 and CPUb920 also include an input/output unit, a task execution unit, a clock switching unit, a built-in clock generation unit, and a switching determination unit. There is. In FIG. 2, these “sections” are omitted for the purpose of avoiding complication. However, the switching judgment unit built in the CPU a910 and the switching judgment unit built in the CPUb920 do not share the judgment result with each other, and in this respect, the judgment unit 115 and the judgment unit shown in FIG. It is different from 125.
Further, the vehicle control device 900 is also equipped with an external clock generation unit that supplies a standard operation clock to the CPUa 910 and the CPUb 920, but this external clock generation unit is not shown in FIG.

In FIG. 2A, the processing of a plurality of tasks a1, b1, b2, a2, and s1 is requested to the CPU a910 and the CPUb920, and processing of new tasks a3 to a5 is requested after a short time. Is illustrated. The vehicle control device 900 can execute these tasks quickly by sharing the tasks executed by the CPU a 910 and the CPU b 920.

The tasks assigned to the CPU a910 and the tasks assigned to the CPUb920 are predetermined. In the illustrated example, the tasks a1 to a5 are assigned to the CPUa910, and the tasks b1 and b2 are assigned to the CPUb920. Further, the task s1 that is important from the viewpoint of ensuring the safety of control is processed by the CPU a910 and the CPUb920 in duplicate. Therefore, when processing of a plurality of tasks is requested as illustrated in FIG. 2A, the CPU a910 processes the tasks a1, a2, s1, and a3 to a5, and the CPU b920 processes the tasks b1 and b2. , S1 will be processed.

After that, it is assumed that the CPU a 910 and the CPU b 920 have respectively finished processing three tasks. Since the CPUb 920 has three tasks shared, the CPUb 920 is in a state in which there is no task to be processed unless a new task to be shared by the CPUb 920 occurs. As a result, the CPU b920 shifts to a state in which power consumption is suppressed (so-called sleep state) by switching the operation clock to the low-speed operation clock. In FIG. 2B, the CPUb 920 indicated by a broken line means that the CPUb 920 is in a sleep state.
On the other hand, the CPU a 910 continues to process the task without transitioning to the sleep state, because the task to be processed still remains.

In such a state (that is, one CPU a 910 has not yet transitioned to the sleep state, but the other CPU b 920 has transitioned to the sleep state), a new task s2 that should be duplicated occurs from a safety point of view. I shall. In this case, since the CPUb 920 is in the sleep state, it is necessary to return the CPUb 920 to the normal operation state by switching the operation clock supplied to the CPUb 920 to the standard operation clock in order for the CPUa 910 and the CPUb 920 to perform redundant processing. There is. However, since it takes time to return the CPUb 920 from the sleep state to the normal operation state, the task s2 cannot be processed quickly. For this reason, the task s2, which is supposed to be redundantly processed, must be independently processed by the CPU a910.
For this reason, even in a vehicle control device equipped with a plurality of CPUs, if the CPUs do not share the determination result of whether or not the CPUs can be switched to the low-speed operation clock, the tasks to be duplicated are processed. There may occur a case where duplicate processing cannot be performed. As a result, a situation may occur in which the safety of control cannot be ensured.

On the other hand, as described above with reference to FIG. 1, the CPUs 110 and 120 mounted on the vehicle control device 100 of the present embodiment share the determination result of whether or not the low-speed operation clock can be switched, The operation clock is switched to the low speed operation clock by the following method. For this reason, it becomes possible to surely perform the duplicated processing of the tasks to be duplicated, and it is possible to secure the control safety.

B. Operation clock switching process:
FIG. 3 shows a flowchart of the operation clock switching process executed by the CPUs 110 and 120 mounted on the vehicle control device 100 of the present embodiment to switch the operation clock from the standard operation clock to the low speed operation clock. This processing is executed by each of the CPU 110 and the CPU 120.

As shown in FIG. 3, in the operation clock switching process, first, it is determined whether there is a task to be executed (S100). When there is a task to be executed (S100: yes), it is determined whether or not the speed-down enabling state is set (S101). Here, the speed-reducible state is an internal state of the CPU 110 and the CPU 120, and when the speed-reducible state is set, it means that the operation clock can be switched to the low-speed operation clock. As will be described later in detail, the CPU 110 and the CPU 120 of the present embodiment are configured to set the internal state of the CPU 110 or the CPU 120 to the speed-reducible state when there are no tasks to be executed.

Therefore, if there is a task to be executed (S100: yes), the setting of the internal state is confirmed, and if the internal state is set to the speed-reducible state (S101: yes), the speed-reducible state is set. After releasing (S102), the standard operation clock is selected as the operation clock (S103).
On the other hand, when the internal state is not set to the speed-reducible state (S101:no), it is not necessary to cancel the setting of the speed-reducible state, and therefore the standard operation clock is selected as the operation clock as it is. (S103).
As a result, the CPU 110 or the CPU 120 executes a task according to the standard operation clock (S104), and then determines again whether there is a task to be executed (S100).

On the other hand, when it is determined that there is no task to be executed (S100: no), it is considered that the operation clock can be switched from the standard operation clock to the low speed operation clock. Therefore, in such a case (S100: no), the CPU 110 or the CPU 120 sets its internal state to the speed-reducible state (S105).

When the CPU 110 and the CPU 120 of the present embodiment set their internal states to the speed-reducible state (S105), this time, the other CPUs also determine whether or not the internal state is set to the speed-reducible state (S105). S106). That is, when the CPU 110 sets itself in the speed-reducible state, the CPU 110 determines whether the CPU 120 is also set in the speed-reducible state. Similarly, when the CPU 120 sets itself in the speed-reducible state, it also determines whether the CPU 110 is also set in the speed-reducible state.
It should be noted that the CPU 110 and the CPU 120 send their internal states to other CPUs every time the setting of the speed-reducible state of the CPU 110 is changed (or at a constant cycle). The determination in S106 may be made by referring to the internal state transmitted from another CPU. Alternatively, the determination in S106 may be made by inquiring another CPU about the internal state in the determination in S106.
As a result, even if the internal state of the CPU itself is set to the speed-reducible state (S105), if it is determined that the other CPU is not set to the speed-reducible state (S106: no), the operation clock is set to the standard operation. While holding the clock, the process returns to the beginning to determine whether there is a task to be executed (S100).

On the other hand, when the internal state of the CPU itself is set to the speed-reducible state (S105) and it is determined that the other CPUs are also set to the speed-reducible state (S106: yes), the operation clock is set. The standard operation clock is switched to the low speed operation clock (S107).
After that, it is determined whether or not there is a task to be executed (S108), and when there is no task to be executed (S108: no), the operation clock is kept switched to the low-speed operation clock, and the determination in S108 is repeated to enter the standby state. Becomes
If it is determined that there is a task to be executed while waiting (S108: yes), the process returns to S102 to cancel the setting of the speed-reducible state (S102). Then, the operation clock is switched from the low-speed operation clock to the standard operation clock (S103), and the task is executed according to the standard operation clock (S104).

As described above, the CPU 110 and the CPU 120 of the present embodiment monitor the presence or absence of the task to be executed, and when the task is exhausted, determine that their own operation clock can be switched to the low speed operation clock. However, before actually switching the operating clock, check whether or not other CPUs have determined that the operating clock can be switched to the low-speed operating clock, and determine that the other CPU can switch to the low-speed operating clock. If not, the operation clock is held at the standard operation clock. Then, after confirming that the other CPU can also switch to the low speed operation clock, the operation clock is switched to the low speed operation clock. As a result, the operation clocks of the CPU 110 and the CPU 120 are switched to the low speed operation clock at the same timing.
In this way, even though a plurality of CPUs (CPU 110 and CPU 120 in this embodiment) have tasks to be processed redundantly, one CPU is in a so-called sleeve state, so that the remaining CPUs perform independent processing. Since it is possible to avoid a situation that must be performed, it is possible to ensure the safety of control.

FIG. 4 shows the reason why the vehicle control device 100 according to the present embodiment can surely perform the duplicate processing for the tasks to be duplicated. Similar to the case illustrated in FIG. 2, in the case of FIG. 4 as well, processing of a plurality of tasks a1, b1, b2, a2, and s1 is requested to the CPU 110 and the CPU 120, and a new task a3 to The case where the processing of a5 is requested is illustrated. Among the plurality of tasks, the tasks a1 to a5 are shared by the CPU 110, the tasks b1 and b2 are shared by the CPU 120, and the task s1 important from the viewpoint of ensuring control safety is duplicated by the CPU 110 and the CPU 120. It is supposed to be processed. Therefore, as shown in FIG. 4A, the CPU 110 processes the tasks a1, a2, s1, a3 to a5, and the CPU 120 processes the tasks b1, b2, s1.

After that, when the CPU 110 and the CPU 120 finish processing the three tasks, respectively, the CPU 120 has no tasks to execute, so the CPU 120 sets the internal state to the speed-reducible state (see S105 in FIG. 3). However, at this stage, since the CPU 110 is still processing the task, the internal state is not set to the speed-reducible state (see S102 in FIG. 3). Therefore, the CPU 120 determines that the internal state of the CPU 110 is not in the speed-reducible state (S106: no) and does not switch the operation clock to the low-speed operation clock.
Therefore, as illustrated in FIG. 4B, even if a new task s2 that should be duplicated occurs from the viewpoint of safety, the standard operating clock is supplied to the CPU 120, so that the CPU 110 and the CPU 120 are It becomes possible to process the task s2 redundantly by using the task s2.

Further, when there is no task to be executed by either the CPU 110 or the CPU 120 and the internal state of each is set to the speed-reducible state, it is determined as “yes” in S106 of FIG. 3, and either the CPU 110 or the CPU 120 is determined. Also changes the operation clock to the low-speed operation clock (see S107).
In this way, when a new task to be duplicated occurs in a state where all the CPUs 110 and 120 are in the sleep state, the CPU 110 and the CPU 120 switch the operation clock to the standard operation clock (see FIG. 3 (S103), the sleep state is restored to the normal state. By doing so, it becomes possible to start the duplicate processing of a new task.

As described above, in the vehicle control device 100 according to the present embodiment, the tasks that should be duplicated by the plurality of CPUs 110 and 120 can be reliably duplicated, so that the safety of control can be ensured. Becomes

Although the embodiments of the present invention have been described above, the present invention is not limited to the above embodiments and can be implemented in various modes without departing from the scope of the invention.

100... Vehicle control device, 110... CPU, 111... Input/output unit,
112... Task execution unit, 113... Clock switching unit,
114... Built-in clock generation unit, 115... Judgment unit, 120... CPU,
121... I/O unit, 122... Task execution unit, 123... Clock switching unit,
124... Built-in clock generation unit, 125... Judgment unit,
130... External clock generation unit, 900... Vehicle control device.

Claims (2)

A vehicle control device (100) which mounts a plurality of CPUs (110, 120) to control a vehicle, and at the same time performs at least a part of tasks using the plurality of CPUs in an overlapping manner.
The CPU is
A task execution unit (112, 122) that receives the operation clock and executes the task;
A determination unit (115, 125) that monitors the presence or absence of the task to be executed, and determines that the operation clock can be slowed down if there is no task to be executed;
When it is determined that the speed can be reduced, the operation clock supplied to the task execution unit is switched from the standard operation clock of standard speed to the low speed operation clock of speed lower than the standard speed (114, 124) and
The determination unit shares the determination result of whether or not the speed can be reduced with the other CPU mounted on the vehicle control device,
The clock switching unit switches the operation clock to the low speed operation clock when it is determined that the speed can be decreased by any of the plurality of CPUs, but the speed can be decreased by any of the plurality of CPUs. A vehicle control device equipped with a CPU, characterized in that the operation clock is held at the standard operation clock if not determined. It is used in a vehicle control device (100) that controls a vehicle by mounting a plurality of CPUs (110, 120), and is applied to the plurality of CPUs that perform overlapping processing for at least some tasks. An operation clock switching method for switching the operation clock of the CPU, comprising:
A task execution step (S102) of executing the task according to the operation clock;
A determination step of monitoring the presence or absence of the task to be executed, and determining that the operation clock can be slowed down if there is no task to be executed (S103),
When it is determined that the speed can be reduced, a switching step (S105) of switching the operation clock for executing the task from the standard operation clock of standard speed to a low speed operation clock lower than the standard speed. Equipped with
In the determination step, the determination result of whether or not the speed can be reduced is shared with another CPU mounted on the vehicle control device,
The switching step switches the operation clock to the low-speed operation clock when it is determined that the speed can be reduced by any of the plurality of CPUs, but it is determined that the speed can be reduced by any of the plurality of CPUs. If not, the operation clock is retained at the standard operation clock.

Images