JP2021047513A - Electronic control device - Google Patents

Abstract

To provide an electronic control device capable of improving control performance when an abnormality occurs.SOLUTION: An ECU 1 comprises CPU cores 11-14, a ROM 15, a request control register, an interruption controller 19, and an error management device 18. The ROM 15 stores a vector table to specify a program executed by the CPU cores 11-14 for each of multiple interruption factors. The request control register stores core designated information to specify the CPU core which generates the interruption for each of the multiple interruption factors. The interruption controller 19 generates the interruption based on the core designated information when the interruption factor occurs. The error management device 18 determines an abnormality occurrence of the CPU core 11. The ROM 15 stores the multiple selection tables to specify a vicarious execution core for each interruption factor when the abnormality of the CPU core 11 occurs. The CPU core 12 changes the core designated information based on the multiple selection tables when the abnormality of the CPU core 11 occurs.SELECTED DRAWING: Figure 1

Description

The present disclosure relates to an electronic control device including a plurality of CPU cores.

In recent years, for example, in electronic control devices such as engine control devices, the adoption of multi-core microcomputers is advancing as a countermeasure against an increasing processing load.
According to Patent Document 1, in an electronic control device including a master-side core and a slave-side core, when the master-side core detects an abnormality in the slave-side core, the processing to be executed by the slave-side core is performed on behalf of the master-side core. Is described.

Japanese Unexamined Patent Publication No. 2009-274569

However, in the technique described in Patent Document 1, when the master side core simply substitutes the processing of the slave side core, the master side core must execute the processing of other cores in addition to the original processing. However, there is a risk that the processing capacity of the master core will be exceeded.

Regarding this point, Patent Document 1 describes that the master-side core executes the processing to be executed by the slave-side core in a manner that reduces the load. However, the load status of the electronic control system can be either high or low depending on the operating status of the system. Therefore, in a situation where the master core cannot execute all the processing of the slave core, the master core can perform all the processing of the slave core, or conversely, the master core can execute all the processing of the slave core. In the above, the master side core dares to substitute the processing of the slave side core with a low load, and there is a possibility that the control performance deteriorates.

An object of the present disclosure is to improve the control performance when an abnormality occurs.

One aspect of the present disclosure includes a plurality of CPU cores (11, 12, 13, 14), a program designated storage unit (15), a core designated storage unit (40), an interrupt control unit (19), and an abnormality. It is an electronic control device (1) including a determination unit (18, 33), a proxy storage unit (15), and a change unit (S210-S260, S310-S360, S510-S580, S610-S680).

The program designation storage unit is configured to store program designation information (VT1, VT2) for designating a program to be executed by each of the plurality of CPU cores for each of the plurality of interrupt factors.

The core designation storage unit is configured to store core designation information for designating a CPU core that generates an interrupt due to the interrupt factor for each of a plurality of interrupt factors.
When an interrupt factor occurs, the interrupt control unit is configured to generate an interrupt to the CPU core corresponding to the generated interrupt factor based on the core designation information stored in the core designation storage unit. To.

The abnormality determination unit is configured to determine whether or not an abnormality has occurred in the abnormality determination target core, using at least one preset CPU core among the plurality of CPU cores as the abnormality determination target core (11). To.

The proxy storage unit specifies a plurality of proxy information (ST1, ST2, ST2) that specifies a proxy core, which is a CPU core that executes a program instead of the error judgment target core when an error occurs in the error judgment target core, for each interrupt factor. It is configured to store ST11, ST12, ST13).

The change unit is configured to change the core designation information based on the substitute information stored in the substitute storage unit when the abnormality judgment unit determines that an abnormality has occurred in the abnormality judgment target core. ..

In the electronic control device of the present disclosure configured in this way, when an interrupt factor occurs, the interrupt control unit generates an interrupt to the CPU core corresponding to the generated interrupt factor based on the core designation information. Let me. As a result, in the electronic control device of the present disclosure, the CPU core corresponding to the interrupt factor executes the program corresponding to the interrupt factor based on the program designation information.

Then, in the electronic control device of the present disclosure, the changing unit changes the core designation information based on the proxy information when an abnormality occurs in the abnormality determination target core. As a result, when an abnormality occurs in the abnormality judgment target core, the electronic control device of the present disclosure causes the substitute core to execute the program executed by the abnormality judgment target core when the interrupt factor occurs. it can. Therefore, the electronic control device of the present disclosure can execute the program on behalf of the substitute core when an abnormality occurs in the abnormality determination target core.

Then, the electronic control device of the present disclosure stores a plurality of substitute information for designating the substitute core for each interrupt factor when an abnormality occurs in the abnormality determination target core. Therefore, in the electronic control device of the present disclosure, by setting a plurality of proxy information according to the operation status of the electronic control device in advance, the proxy core can appropriately execute the proxy according to the operation status of the electronic control device. be able to. As a result, the electronic control device of the present disclosure can improve the control performance when an abnormality occurs.

It is a block diagram which shows the structure of the ECU. It is a figure which shows the structure of the 1st CPU core and the interrupt controller. It is a figure which shows the structure of the vector table of 1st Embodiment. It is a figure which shows the structure of the low load selection table and the high load selection table. It is a flowchart which shows an idle task. It is a flowchart which shows the 10ms task. It is a flowchart which shows the error processing of 1st Embodiment. It is a flowchart which shows the table switching process of 1st Embodiment. It is a figure which shows the structure of the vector table of 2nd Embodiment. It is a figure which shows the structure of the low load selection table and the 1st and 2nd high load selection tables. It is a flowchart which shows the error processing of 2nd Embodiment. It is a flowchart which shows the table switching process of 2nd Embodiment.

[First Embodiment]
The first embodiment of the present disclosure will be described below together with the drawings.
The electronic control device 1 (hereinafter, ECU 1) of the present embodiment is mounted on a vehicle and includes a microcomputer 2 (hereinafter, microcomputer 2), an input circuit 3, and an output circuit 4, as shown in FIG. ECU is an abbreviation for Electronic Control Unit.

The crank angle signal from the crank angle sensor 51, the cam angle signal from the cam angle sensor 52, and the throttle opening signal from the throttle opening sensor 53 are input to the microcomputer 2 via the input circuit 3. ..

The crank angle sensor 51 outputs a crank angle signal according to the rotation of the crankshaft of the engine. The cam angle sensor 52 outputs a cam angle signal according to the rotation of the cam shaft of the engine. The throttle opening sensor 53 detects the opening degree of the throttle valve (hereinafter referred to as the throttle opening degree) for adjusting the amount of air supplied to the engine, and outputs a throttle opening degree signal indicating the detection result.

The microcomputer 2 detects the state of the engine based on each of the above signals input via the input circuit 3. Then, the microcomputer 2 controls various actuators such as a spark plug 61 in each cylinder of the engine, an injector 62 in each cylinder, and a throttle motor 63 for changing the throttle opening degree based on the state of the engine. Is output via the output circuit 4.

The throttle valve is configured to be rotatable around the rotation shaft, and the rotation torque from the throttle motor 63 is transmitted to the rotation shaft via the reduction gear to open and close in the intake pipe to increase the throttle opening. Change.

A return spring is attached to the rotating shaft. This return spring urges the rotating shaft so that the throttle opening (hereinafter referred to as the opener opening) is set in advance so that an engine output capable of limp home running can be obtained. That is, even when the power supply to the throttle motor 63 is stopped and the rotational torque is no longer transmitted to the rotary shaft, the throttle valve is held at the opener opening degree, whereby the intake amount required for limp home driving is maintained. Is secured.

The microcomputer 2 includes a first CPU core 11, a second CPU core 12, a third CPU core 13, a fourth CPU core 14, a ROM 15, a RAM 16, an input / output unit 17, an error management device 18, and an interrupt controller 19. And a bus 20. Hereinafter, the first CPU core 11, the second CPU core 12, the third CPU core 13, and the fourth CPU core 14 are collectively referred to as CPU cores 11 to 14.

Various functions of the microcomputer are realized by executing a program in which CPU cores 11 to 14 are stored in a non-transitional substantive recording medium. In this example, ROM 15 corresponds to a non-transitional substantive recording medium in which a program is stored. In addition, by executing this program, the method corresponding to the program is executed. In addition, a part or all of the functions executed by the CPU cores 11 to 14 may be configured in hardware by one or a plurality of ICs or the like. Further, the number of microcomputers constituting the ECU 1 may be one or a plurality.

The first CPU core 11, the second CPU core 12, the third CPU core 13, and the fourth CPU core 14 distribute and execute various control processes for controlling the engine mounted on the vehicle.

The ROM 15 is a non-volatile memory and stores a program for executing various control processes for controlling the engine.
The RAM 16 is a volatile memory, and temporarily stores the calculation results of the CPU cores 11 to 14.

The input / output unit 17 is a circuit for inputting / outputting data between the outside of the microcomputer 2 and the CPU cores 11-14.
The error management device 18 is a device that detects an abnormality in the first CPU core 11.

The interrupt controller 19 inputs interrupt request signals indicating the occurrence of various interrupt factors, and the priority is set based on the priority set in advance for each interrupt factor corresponding to the input interrupt request signal. The interrupt signal corresponding to the highest interrupt factor is output to the CPU cores 11-14.

The bus 20 connects the CPU cores 11 to 14, the ROM 15, the RAM 16, the input / output unit 17, the error management device 18, and the interrupt controller 19 to each other so that data can be input and output.
As shown in FIG. 2, the first CPU core 11 includes a master core 31, a checker core 32, and a lock step comparator 33.

The master core 31 and the checker core 32 include arithmetic units and registers for executing a program. Then, the master core 31 and the checker core 32 execute the same calculation in parallel, and output the calculation result to the lock step comparator 33.

The lock step comparator 33 compares the calculation result from the master core 31 with the calculation result from the checker core 32, and outputs comparison result information indicating whether or not the calculation results match to the error management device 18.

When the error management device 18 acquires the comparison result information from the lock step comparator 33, the error management device 18 determines whether or not the calculation results match based on the comparison result information. Then, when the calculation results do not match, the error management device 18 determines that an abnormality has occurred in the first CPU core 11 and outputs the lock step error information to the interrupt controller 19.

The interrupt controller 19 includes a request control register 40. The request control register 40 includes n interrupt factor fields 40_1, 40_2, 40_3, 40_4, 40_5, ..., 40_n. n is a positive integer.

Different interrupt factors are set in each of the plurality of interrupt factor fields 40_i. In the present embodiment, the interrupt factor field 40_1 corresponds to the lock step error of the first CPU core 11. The interrupt factor field 40_2 corresponds to the input of the crank angle signal. The interrupt factor field 40_3 corresponds to the input of the cam angle signal. The interrupt factor field 40_4 corresponds to timer interrupt. The interrupt factor field 40_5 corresponds to an external request interrupt.

The interrupt factor field 40_i is composed of 3 bits, and 1 or 0 is stored in each bit. i is an integer from 1 to n. The value stored in the interrupt factor field 40_i specifies the CPU core that executes processing according to the occurrence of the interrupt factor. In the present embodiment, when the value stored in the interrupt factor field 40_i is 0x000, the first CPU core 11 is specified. Similarly, when the values stored in the interrupt factor field 40_i are 0x001, 0x010, 0x011, the second CPU core 12, the third CPU core 13, and the fourth CPU core 14 are designated, respectively.

FIG. 2 shows the value stored in the interrupt factor field 40_i in the normal time when the lock step error does not occur.
In FIG. 2, 0x001 is stored in the interrupt factor field 40_1. Therefore, when a lock step error of the first CPU core 11 occurs, the second CPU core 12 executes a process corresponding to the lock step error.

Further, 0x000 is stored in the interrupt factor field 40_2. Therefore, when the crank angle signal is input in the normal state, the first CPU core 11 executes the process corresponding to the input of the crank angle signal. Further, 0x000 is stored in the interrupt factor field 40_3. Therefore, when the cam angle signal is input in the normal state, the first CPU core 11 executes the process corresponding to the input of the cam angle signal. Specifically, the first CPU core 11 specifies a crank position by a crank interruption and a cam interruption, drives an injector 62 at a predetermined crank position to inject fuel, or an ignition plug 61 at a predetermined crank position. Is energized and ignited.

Further, 0x001 is stored in the interrupt factor field 40_4. Therefore, when a timer interrupt occurs in a normal time, the second CPU core 12 executes a process corresponding to the timer interrupt. Specifically, the second CPU core 12 controls energization of the throttle motor 63 so that the throttle valve has a desired opening degree by, for example, a timer interrupt generated every 2 ms.

Further, 0x000 is stored in the interrupt factor field 40_5. Therefore, when an external request interrupt occurs in a normal time, the first CPU core 11 executes a process corresponding to the external request interrupt.

As shown in FIG. 3, the vector table VT1 is stored in the ROM 15. The vector table VT1 specifies a control program executed by the CPU cores 11 to 14 for each of a plurality of interrupt factors.

In the present embodiment, when the interrupt factor is the input of the crank angle signal, the ignition / injection control program is specified for the first CPU core 11 and the second CPU core 12. Further, when the interrupt factor is the input of the cam angle signal, the ignition / injection control program is specified for the first CPU core 11 and the second CPU core 12. Further, when the interrupt factor is the timer interrupt, the electronic throttle control program is specified for the second CPU core 12.

In the normal state where the lock step error does not occur, the program surrounded by the broken line rectangles RC1, RC2, and RC3 is executed. That is, normally, the first CPU core 11 executes the ignition / injection control program, and the second CPU core 12 executes the electronic throttle control program.

As shown in FIG. 4, the ROM 15 stores the low load selection table ST1 and the high load selection table ST2.
The low load selection table ST1 and the high load selection table ST2 specify a CPU core for executing a program for each of a plurality of interrupt factors.

In the low load selection table ST1 of the present embodiment, when the interrupt factor is the input of the crank angle signal, the second CPU core 12 is selected. Further, when the interrupt factor is the input of the cam angle signal, the second CPU core 12 is selected. If the interrupt factor is a timer interrupt, the second CPU core 12 is selected.

In the high load selection table ST2 of the present embodiment, when the interrupt factor is the input of the crank angle signal, the second CPU core 12 is selected. Further, when the interrupt factor is the input of the cam angle signal, the second CPU core 12 is selected. Further, when the interrupt factor is timer interrupt, the CPU core to be selected does not exist.

Next, the procedure of the idle task executed by the CPU cores 12 to 14 will be described. The idle task is a process executed when the CPU cores 12 to 14 are not executing the interrupt process. That is, when the processing load of the CPU cores 12 to 14 is 100%, the idle task is not executed. In the following, the procedure of the idle task will be described on behalf of the second CPU core 12.

When the idle task is executed, as shown in FIG. 5, the second CPU core 12 first idles the added value obtained by adding 1 to the value stored in the idle counter Counter provided in the RAM 16 in S10. Store in the counter Counter.

Then, the second CPU core 12 determines in S20 whether or not the value stored in the idle counter Counter exceeds the preset reset determination value J1. The reset determination value J1 is set to a value reached by the idle counter Counter when the idle state continues for 1 ms.

Here, when the value stored in the idle counter Counter is equal to or less than the reset determination value J1, the second CPU core 12 shifts to S10. On the other hand, when the value stored in the idle counter Counter exceeds the reset determination value J1, the second CPU core 12 stores 0 in the idle counter Counter in S30.

Further, in S40, the second CPU core 12 stores the added value obtained by adding 1 to the value stored in the 1-millisecond counter 1ms_Counter provided in the RAM 16 in the 1-millisecond counter 1ms_Counter, and ends the idle task. ..

Next, the procedure of the 10 ms task executed by the CPU cores 12 to 14 will be described. The 10ms task is a process that is executed every time 10ms elapses. In the following, the procedure of the 10 ms task will be described on behalf of the second CPU core 12.

When the 10 ms task is executed, the second CPU core 12 first acquires the value stored in the 1 ms counter 1 ms_Counter in S110 as shown in FIG. Then, the second CPU core 12 stores the value calculated on the right side of the following equation (1) in the processing load CPU_Load provided in the RAM 16 in S120.

CPU_Load = (1-1ms_Counter / 10) x 100 ... (1)
Further, the second CPU core 12 stores 0 in the 1 millisecond counter 1ms_Counter in S130, and ends the 10ms task.

Next, the error handling procedure executed by the second CPU core 12 will be described. The error processing is processing that is started when an interrupt signal corresponding to the lock step error is input from the interrupt controller 19 to the second CPU core 12.

When the error processing is executed, as shown in FIG. 7, the second CPU core 12 first confirms the value stored in the processing load CPU_Load of the second CPU core 12 in S210.
Then, the second CPU core 12 determines in S220 whether or not the value stored in the processing load CPU_Load of the second CPU core 12 is less than the preset high load determination value J2.

Here, when the value stored in the processing load CPU_Load of the second CPU core 12 is less than the high load determination value J2, the second CPU core 12 refers to the low load selection table ST1 in S230 and refers to the low load selection table ST1. Move to S250. On the other hand, when the value stored in the processing load CPU_Load of the second CPU core 12 is the high load determination value J2 or more, the second CPU core 12 refers to the high load selection table ST2 in S240 and S250. Move to.

Then, upon shifting to S250, the second CPU core 12 changes the request control register 40 of the interrupt controller 19 in S250.
Specifically, when the low load selection table ST1 is referred to, the second CPU core 12 sets at least the value of the interrupt factor field 40_2, 40_3, 40_4 to 0x001. As a result, the ignition / injection control program and the electronic throttle control program are executed by the second CPU core 12. On the other hand, when the high load selection table ST2 is referred to, the second CPU core 12 sets at least the value of the interrupt factor field 40_2, 40_3 to 0x001 and the value of the interrupt factor field 40_4 to 0x100. As a result, the ignition / injection control program is executed by the second CPU core 12, and the electronic throttle control program is not executed by any of the CPU cores 11 to 14.

Then, the second CPU core 12 sets the core abnormality flag F1 provided in the RAM 16 in S260, and ends the error processing. In the following description, setting a flag indicates that the value of the flag is set to 1, and clearing the flag indicates that the value of the flag is set to 0.

Next, the procedure of the table switching process executed by the second CPU core 12 will be described. The table switching process is a process executed every time 10 ms elapses during the operation of the second CPU core 12.

When the table switching process is executed, the second CPU core 12 first determines in S310 whether or not the core abnormality flag F1 is set, as shown in FIG. Here, when the core abnormality flag F1 is cleared, the second CPU core 12 ends the table switching process.

On the other hand, when the core abnormality flag F1 is set, the second CPU core 12 confirms the value stored in the processing load CPU_Load of the second CPU core 12 in S320 in the same manner as in S210.

Then, in S330, the second CPU core 12 determines whether or not the value stored in the processing load CPU_Load of the second CPU core 12 is less than the high load determination value J2 in the same manner as in S220.

Here, when the value stored in the processing load CPU_Load of the second CPU core 12 is less than the high load determination value J2, the second CPU core 12 sets the low load selection table in S340 in the same manner as in S230. With reference to ST1, the process proceeds to S360. On the other hand, when the value stored in the processing load CPU_Load of the second CPU core 12 is the high load determination value J2 or more, the second CPU core 12 sets the high load selection table ST2 in S350 in the same manner as in S240. Refer to, and move to S360.

Then, upon shifting to S360, the second CPU core 12 changes the request control register 40 of the interrupt controller 19 in the same manner as in S250, and ends the table switching process.
The ECU 1 configured in this way includes CPU cores 11 to 14, ROM 15, a request control register 40, an interrupt controller 19, an error management device 18, and a lock step comparator 33.

The ROM 15 stores a vector table VT1 that specifies a program to be executed by each of the CPU cores 11 to 14 for each of a plurality of interrupt factors.
The request control register 40 provides core designation information (that is, 0x000, 0x001, 0x010, 0x011, 0x100) that specifies CPU cores 11 to 14 that generate interrupts due to the interrupt factor for each of the plurality of interrupt factors. It is stored in the interrupt factor fields 40_1, 40_2, 40_3, 40_4, 40_5, ..., 40_n.

When an interrupt factor occurs, the interrupt controller 19 generates an interrupt to the CPU cores 11 to 14 corresponding to the generated interrupt factor based on the core designation information stored in the request control register 40.

The error management device 18 and the lock step comparator 33 determine whether or not an abnormality has occurred in the abnormality determination target core, using the first CPU core 11 of the CPU cores 11 to 14 as the abnormality determination target core.

The ROM 15 is a low load selection table ST1 and a high load selection table that specify a core (hereinafter referred to as a substitute core) that executes a program instead of the abnormality judgment target core for each interrupt factor when an abnormality occurs in the abnormality judgment target core. Store ST2.

When the error management device 18 determines that an error has occurred in the core subject to abnormality determination, the second CPU core 12 requests based on the low load selection table ST1 and the high load selection table ST2 stored in the ROM 15. The core designation information stored in the control register 40 is changed.

As described above, in the ECU 1, when an interrupt factor occurs, the interrupt controller 19 generates an interrupt to the CPU cores 11 to 14 corresponding to the generated interrupt factor based on the core designation information. As a result, in the ECU 1, the CPU cores 11 to 14 corresponding to the interrupt factor execute the program corresponding to the interrupt factor based on the vector table VT1.

Then, in the ECU 1, the second CPU core 12 changes the core designation information based on the low load selection table ST1 and the high load selection table ST2 when an abnormality occurs in the abnormality determination target core. As a result, when an abnormality occurs in the abnormality determination target core, the ECU 1 can cause the substitute core to execute the program executed by the abnormality determination target core when the interrupt factor occurs. Therefore, when an abnormality occurs in the abnormality determination target core, the ECU 1 can execute the program on behalf of the substitute core.

Then, the ECU 1 stores a low load selection table ST1 and a high load selection table ST2 that specify a substitute core for each interrupt factor when an abnormality occurs in the abnormality determination target core. Therefore, the ECU 1 can appropriately execute the substitution by the substitute core according to the operation status of the ECU 1 by setting the low load selection table ST1 and the high load selection table ST2 according to the operation status of the ECU 1 in advance. it can. As a result, the ECU 1 can improve the control performance when an abnormality occurs.

Further, the CPU cores 12 to 14 measure the processing load of the CPU cores 12 to 14, respectively. Then, the ROM 15 stores the low load selection table ST1 corresponding to the case where the processing load of the second CPU core 12 is low and the high load selection table ST2 corresponding to the case where the processing load of the second CPU core 12 is high. The second CPU core 12 selects the low load selection table ST1 or the high load selection table ST2 corresponding to the measured processing load of the second CPU core 12, and is based on the selected low load selection table ST1 or high load selection table ST2. , Change the core specification information. As a result, the ECU 1 can change the substitute core according to the processing load of the second CPU core 12, and can improve the control performance when an abnormality occurs.

Further, the ECU 1 is mounted on the vehicle. Then, the vector table VT1 and the core designation information are such that the abnormality determination target core controls the spark plug 61 and the injector 62 when the error management device 18 determines that an abnormality has not occurred in the abnormality determination target core. It is set. As a result, the ECU 1 can continue to control the spark plug 61 and the injector 62 by the substitute core even when an abnormality occurs in the abnormality determination target core.

Further, the throttle valve that adjusts the amount of air supplied to the engine of the vehicle allows the vehicle to run on the limp home with the opening degree of the throttle valve when the energization of the throttle motor 63 that drives the throttle valve is stopped. It is configured to have a certain preset opener opening degree.

The vector table VT1 and the low load selection table ST1 or the high load selection table ST2 are the second CPU core 12 when the preset high load condition indicating that the processing load of the CPU core 12 is high is not satisfied. Executes the control of the throttle motor 63, and when the high load condition is satisfied, the second CPU core 12 is set not to execute the control of the throttle motor 63. The high load condition of the present embodiment is that the processing load of the second CPU core 12 is the high load determination value J2 or more.

Therefore, when an abnormality occurs in the first CPU core 11, the processing load of the second CPU core 12 is performed when the second CPU core 12 takes over the control of the spark plug 61 and the injector 62 and controls the throttle motor 63. When is equal to or higher than the high load determination value J2, the second CPU core 12 does not execute the control of the throttle motor 63.

When the second CPU core 12 stops controlling the throttle motor 63, the energization of the throttle motor 63 is stopped. As a result, the opening degree of the throttle valve becomes a preset opener opening degree that enables the vehicle to run on the limp home. Therefore, the ECU 1 can secure the minimum necessary engine output when the vehicle runs when an abnormality occurs in the first CPU core 11. After that, when the processing load of the second CPU core 12 becomes less than the high load determination value J2, the ECU 1 restarts the control of the throttle motor 63 by the second CPU core 12, so that the vehicle can be returned to the normal operating state. ..

In the embodiment described above, the ECU 1 corresponds to the electronic control device, the ROM 15 corresponds to the program designated storage unit, the request control register 40 corresponds to the core designated storage unit, and the interrupt controller 19 corresponds to the interrupt control unit. To do.

Further, the error management device 18 and the lock step comparator 33 correspond to the abnormality determination unit, the ROM 15 corresponds to the proxy storage unit, and S210 to S260 and S310 to S360 correspond to the processing as the change unit.

Further, the vector table VT1 corresponds to the program designation information, the low load selection table ST1 and the high load selection table ST2 correspond to a plurality of proxy information, and S10 to S40 and S110 to S130 correspond to the processing as the load measurement unit. ..

[Second Embodiment]
The second embodiment of the present disclosure will be described below together with the drawings. In the second embodiment, a part different from the first embodiment will be described. The same reference numerals are given to common configurations.

In the ECU 1 of the second embodiment, the fourth CPU core 14 is omitted, the vector table is changed, the low load selection table and the high load selection table are changed, and error processing and table switching processing are performed. Is different from the first embodiment in that is changed.

Specifically, the ECU 1 of the second embodiment is different from the first embodiment in that it includes a vector table VT2 instead of the vector table VT1.
As shown in FIG. 9, the vector table VT2 specifies a control program executed by the CPU cores 11 to 13 for each of a plurality of interrupt factors.

In the present embodiment, when the interrupt factor is the input of the crank angle signal, the ignition / injection control program is specified for the first CPU core 11 and the second CPU core 12. Further, when the interrupt factor is the input of the cam angle signal, the ignition / injection control program is specified for the first CPU core 11 and the second CPU core 12. When the interrupt factor is timer interrupt, an electronic throttle control program is specified for the second CPU core 12 and the third CPU core 13. When the interrupt factor is an external request interrupt, a program for executing synchronous processing with an external device for the first CPU core 11, the second CPU core 12, and the third CPU core 13 (hereinafter, External synchronization program) is specified.

In the normal time when the lock step error does not occur, the program surrounded by the broken line rectangles RC11, RC12, RC13, and RC14 is executed. That is, normally, the first CPU core 11 executes the ignition / injection control program and the external synchronization program, and the second CPU core 12 executes the electronic throttle control program.

Further, the ECU 1 of the second embodiment is provided with a low load selection table ST11, a first high load selection table ST12, and a second high load selection table ST13 instead of the low load selection table ST1 and the high load selection table ST2. 1 Different from the embodiment.

As shown in FIG. 10, the low load selection table ST11, the first high load selection table ST12, and the second high load selection table ST13 specify a CPU core for executing a program for each of a plurality of interrupt factors.

In the low load selection table ST11 of the present embodiment, when the interrupt factor is the input of the crank angle signal, the second CPU core 12 is selected. Further, when the interrupt factor is the input of the cam angle signal, the second CPU core 12 is selected. If the interrupt factor is a timer interrupt, the second CPU core 12 is selected. If the interrupt factor is an external request interrupt, the second CPU core 12 is selected.

In the first high load selection table ST12 of the present embodiment, when the interrupt factor is the input of the crank angle signal, the second CPU core 12 is selected. Further, when the interrupt factor is the input of the cam angle signal, the second CPU core 12 is selected. If the interrupt factor is a timer interrupt, the third CPU core 13 is selected. If the interrupt factor is an external request interrupt, the third CPU core 13 is selected.

In the second high load selection table ST13 of the present embodiment, when the interrupt factor is the input of the crank angle signal, the second CPU core 12 is selected. Further, when the interrupt factor is the input of the cam angle signal, the second CPU core 12 is selected. If the interrupt factor is a timer interrupt, the third CPU core 13 is selected. Further, when the interrupt factor is an external request interrupt, the CPU core to be selected does not exist.

Next, the error handling procedure of the second embodiment will be described.
When the error processing of the second embodiment is executed, as shown in FIG. 11, the second CPU core 12 first has the value stored in the processing load CPU_Load of the second CPU core 12 in S510 and the third CPU core. Check with the value stored in the processing load CPU_Load of 13.

Then, the second CPU core 12 determines in S520 whether or not the value stored in the processing load CPU_Load of the second CPU core 12 is less than the high load determination value J2.
Here, when the value stored in the processing load CPU_Load of the second CPU core 12 is less than the high load determination value J2, the second CPU core 12 refers to the low load selection table ST11 in S530 and refers to the low load selection table ST11. Move to S570. On the other hand, when the value stored in the processing load CPU_Load of the second CPU core 12 is the high load determination value J2 or more, the second CPU core 12 is stored in the processing load CPU_Load of the third CPU core 13 in S540. It is determined whether or not the value is less than the high load determination value J2.

Here, when the value stored in the processing load CPU_Load of the third CPU core 13 is less than the high load determination value J2, the second CPU core 12 refers to the first high load selection table ST12 in S550. Then, it shifts to S570. On the other hand, when the value stored in the processing load CPU_Load of the third CPU core 13 is the high load determination value J2 or more, the second CPU core 12 refers to the second high load selection table ST13 in S560. , S570.

Then, upon shifting to S570, the second CPU core 12 changes the request control register 40 of the interrupt controller 19.
Specifically, when the low load selection table ST11 is referred to, the second CPU core 12 sets at least the value of the interrupt factor field 40_2,40_3,40_4,40_5 to 0x001. As a result, the ignition / injection control program, the electronic throttle control program, and the external synchronization program are executed by the second CPU core 12.

Further, when referring to the first high load selection table ST12, the second CPU core 12 sets at least the value of the interrupt factor field 40_2,40_3 to 0x001, and sets the value of the interrupt factor field 40_4, 40_5 to 0x010. Set to. As a result, the ignition / injection control program is executed by the second CPU core 12, and the electronic throttle control program and the external synchronization program are executed by the third CPU core 13.

Further, when referring to the second high load selection table ST13, the third CPU core 13 sets at least the value of the interrupt factor field 40_2, 40_3 to 0x001 and the value of the interrupt factor field 40_4 to 0x010. Then, the value of the interrupt factor field 40_5 is set to 0x100. As a result, the ignition / injection control program is executed by the second CPU core 12, the electronic throttle control program is executed by the third CPU core 13, and the external synchronization program is not executed by any of the CPU cores 11 to 13.

Then, the second CPU core 12 sets the core abnormality flag F1 in S580 and ends the error processing.
Next, the procedure of the table switching process of the second embodiment will be described.

When the table switching process of the second embodiment is executed, the second CPU core 12 first determines in S610 whether or not the core abnormality flag F1 is set, as shown in FIG. Here, when the core abnormality flag F1 is cleared, the second CPU core 12 ends the table switching process.

On the other hand, when the core abnormality flag F1 is set, the value of the second CPU core 12 is stored in the processing load CPU_Load of the second CPU core 12 and the third CPU core 13 in S620 in the same manner as in S510. To confirm.

Then, in S630, the second CPU core 12 determines whether or not the value stored in the processing load CPU_Load of the second CPU core 12 is less than the high load determination value J2 in the same manner as in S520.

Here, when the value stored in the processing load CPU_Load of the second CPU core 12 is less than the high load determination value J2, the second CPU core 12 sets the low load selection table in S640 in the same manner as in S530. With reference to ST11, the process proceeds to S680. On the other hand, when the value stored in the processing load CPU_Load of the second CPU core 12 is the high load determination value J2 or more, the second CPU core 12 is set in S650 in the same manner as in S540, in the same manner as in S540. It is determined whether or not the value stored in the processing load CPU_Load is less than the high load determination value J2.

Here, when the value stored in the processing load CPU_Load of the third CPU core 13 is less than the high load determination value J2, the second CPU core 12 has the first high load in S660 in the same manner as in S550. With reference to the selection table ST12, the process proceeds to S680. On the other hand, when the value stored in the processing load CPU_Load of the third CPU core 13 is the high load determination value J2 or more, the second CPU core 12 selects the second high load in S670 in the same manner as in S560. With reference to the table ST13, the process proceeds to S680.

Then, upon shifting to S680, the second CPU core 12 changes the request control register 40 of the interrupt controller 19 in the same manner as in S570, and ends the table switching process.
The ECU 1 configured in this way includes CPU cores 11 to 13, ROM 15, a request control register 40, an interrupt controller 19, an error management device 18, and a lock step comparator 33.

The ROM 15 stores a vector table VT2 that specifies a program to be executed by each of the CPU cores 11 to 13 for each of a plurality of interrupt factors.
The request control register 40 inputs core specification information that specifies CPU cores 11 to 13 that generate an interrupt due to the interrupt factor for each of a plurality of interrupt factors. Interrupt factor fields 40_1, 40_2, 40_3, 40_4, 40_5. , ..., It is configured to be stored in 40_n.

When an interrupt factor occurs, the interrupt controller 19 generates an interrupt to the CPU cores 11 to 13 corresponding to the generated interrupt factor based on the core designation information stored in the request control register 40.

The error management device 18 and the lock step comparator 33 determine whether or not an abnormality has occurred in the abnormality determination target core, using the first CPU core 11 of the CPU cores 11 to 13 as the abnormality determination target core.

The ROM 15 stores a low load selection table ST11, a first high load selection table ST12, and a second high load selection table ST13 that specify a substitute core for each interrupt factor.
When the error management device 18 determines that an error has occurred in the core subject to abnormality determination, the second CPU core 12 has a low load selection table ST11, a first high load selection table ST12, and a second high load selection table ST12 stored in the ROM 15. The core designation information stored in the request control register 40 is changed based on the high load selection table ST13.

As described above, in the ECU 1, when an interrupt factor occurs, the interrupt controller 19 generates an interrupt to the CPU cores 11 to 13 corresponding to the generated interrupt factor based on the core designation information. As a result, in the ECU 1, the CPU cores 11 to 13 corresponding to the interrupt factor execute the program corresponding to the interrupt factor based on the vector table VT2.

Then, in the ECU 1, when an abnormality occurs in the abnormality determination target core, the second CPU core 12 core designation information based on the low load selection table ST11, the first high load selection table ST12, and the second high load selection table ST13. To change. As a result, when an abnormality occurs in the abnormality determination target core, the ECU 1 can cause the substitute core to execute the program executed by the abnormality determination target core when the interrupt factor occurs. Therefore, when an abnormality occurs in the abnormality determination target core, the ECU 1 can execute the program on behalf of the substitute core.

Then, the ECU 1 stores the low load selection table ST11, the first high load selection table ST12, and the second high load selection table ST13 that specify the substitute core for each interrupt factor when an abnormality occurs in the abnormality determination target core. There is. Therefore, the ECU 1 substitutes the low load selection table ST11, the first high load selection table ST12, and the second high load selection table ST13 according to the operation status of the ECU 1 according to the operation status of the ECU 1 by setting in advance. It is possible to properly execute the agency by the core. As a result, the ECU 1 can improve the control performance when an abnormality occurs.

Further, the CPU cores 12 and 13 measure the processing load of the CPU cores 12 and 13, respectively. The ROM 15 has a low load selection table ST11 corresponding to a case where the processing load of the second CPU core 12 is low, and a first high corresponding to a case where the processing load of the second CPU core 12 is high and the processing load of the third CPU core 13 is low. The load selection table ST12 and the second high load selection table ST13 corresponding to the case where the processing load of the second CPU core 12 is high and the processing load of the third CPU core 13 is high are stored. The second CPU core 12 selects and selects the low load selection table ST11, the first high load selection table ST12, or the second high load selection table ST13 corresponding to the measured processing loads of the second CPU core 12 and the third CPU core 13. The core designation information is changed based on the low load selection table ST11, the first high load selection table ST12, or the second high load selection table ST13. As a result, the ECU 1 can change the substitute core according to the processing load of the second CPU core 12 and the third CPU core 13, and can improve the control performance when an abnormality occurs.

In the embodiment described above, S510 to S580 and S610 to S680 correspond to the processing as a change unit, the vector table VT2 corresponds to the program designation information, and the low load selection table ST11, the first high load selection table ST12, or the first high load selection table ST12 or the first. 2 The high load selection table ST13 corresponds to a plurality of proxy information.

Although one embodiment of the present disclosure has been described above, the present disclosure is not limited to the above embodiment, and can be implemented in various modifications.
[Modification 1]
For example, in the above embodiment, the mode in which the abnormality determination target core is the first CPU core 11 is shown, but the number of abnormality determination target cores may be a plurality.

The ECU 1 and its method described in the present disclosure are realized by a dedicated computer provided by configuring a processor and memory programmed to perform one or more functions embodied by a computer program. You may. Alternatively, the ECU 1 and its method described in the present disclosure may be realized by a dedicated computer provided by configuring the processor with one or more dedicated hardware logic circuits. Alternatively, the ECU 1 and its method described in the present disclosure are configured by a combination of a processor and memory programmed to perform one or more functions and a processor composed of one or more hardware logic circuits. It may be realized by one or more dedicated computers. The computer program may also be stored on a computer-readable non-transitional tangible recording medium as an instruction executed by the computer. The method for realizing the functions of each part included in the ECU 1 does not necessarily include software, and all the functions may be realized by using one or a plurality of hardware.

A plurality of functions possessed by one component in the above embodiment may be realized by a plurality of components, or one function possessed by one component may be realized by a plurality of components. Further, a plurality of functions possessed by the plurality of components may be realized by one component, or one function realized by the plurality of components may be realized by one component. Further, a part of the configuration of the above embodiment may be omitted. In addition, at least a part of the configuration of the above embodiment may be added or replaced with the configuration of the other above embodiment.

In addition to the above-mentioned ECU 1, various systems such as a system having the ECU 1 as a component, a program for operating a computer as the ECU 1, a non-transitional substantive recording medium such as a semiconductor memory in which this program is recorded, and a device control method are used. The present disclosure can also be realized in the form.

1 ... ECU, 11 ... 1st CPU core, 12 ... 2nd CPU core, 13 ... 3rd CPU core, 14 ... 4th CPU core, 15 ... ROM, 18 ... error management device, 19 ... interrupt controller, 33 ... lock step comparator, 40 ... Request control register

Claims (4)

With multiple CPU cores (11, 12, 13, 14),
A program designation storage unit (15) configured to store program designation information (VT1, VT2) that specifies a program to be executed by each of the plurality of CPU cores for each of the plurality of interrupt factors.
A core designation storage unit (40) configured to store core designation information for designating the CPU core that generates an interrupt due to the interrupt factor for each of the plurality of interrupt factors.
When the interrupt factor occurs, the interrupt is generated for the CPU core corresponding to the generated interrupt factor based on the core designation information stored in the core designation storage unit. Interrupt control unit (19) and
An abnormality configured to determine whether or not an abnormality has occurred in the abnormality determination target core, with at least one preset CPU core among the plurality of CPU cores as the abnormality determination target core (11). Judgment unit (18, 33) and
A plurality of proxy information (ST1, ST2, ST2) that specifies a proxy core that is the CPU core that executes the program in place of the error judgment target core when an error occurs in the abnormality judgment target core for each interrupt factor. A surrogate storage unit (15) configured to store ST11, ST12, ST13) and
When the abnormality determination unit determines that an abnormality has occurred in the abnormality determination target core, the core designation information is changed based on the agency information stored in the agency storage unit. An electronic control device (1) including a change unit (S210 to S260, S310 to S360, S510 to S580, S610 to S680). The electronic control device according to claim 1.
A load measuring unit (S10 to S40, S110 to S130) configured to measure the processing load of the substitute core is provided.
The proxy storage unit stores a plurality of proxy information that are different from each other according to the processing load of the proxy core.
The changing unit is an electronic control device that selects the surrogate information corresponding to the processing load measured by the load measuring unit and changes the core designation information based on the selected surrogate information. The electronic control device according to claim 1 or 2.
The electronic control device is mounted on the vehicle and
The program designation information and the core designation information are used so that the abnormality determination target core controls the engine of the vehicle when the abnormality determination unit determines that an abnormality has not occurred in the abnormality determination target core. Electronic control device that is set. The electronic control device according to any one of claims 1 to 3.
The electronic control device is mounted on the vehicle and
The throttle valve that adjusts the amount of air supplied to the engine of the vehicle has an opening degree of the throttle valve that is the limp home of the vehicle when the power supply to the throttle motor (63) that drives the throttle valve is stopped. It is configured to have a preset opener opening that allows driving.
A load measuring unit configured to measure the processing load of the surrogate core is provided.
The proxy storage unit stores a plurality of proxy information that are different from each other according to the processing load of the proxy core.
The change unit (S210 to S260, S310 to S360) selects the substitute information corresponding to the processing load measured by the load measurement unit, and changes the core designation information based on the selected substitute information. And
The program designation information (VT1) and the proxy information (ST1, ST2) are used by the proxy core when the preset high load condition indicating that the processing load of the proxy core is high is not satisfied. An electronic control device that executes control of the throttle motor and is set so that the proxy core does not execute control of the throttle motor when the high load condition is satisfied.

Images