JP2022053096A - Vehicle control device, vehicle control system, and access right management program - Google Patents

Abstract

To appropriately balance the execution of tasks each requiring regular access to a shared storage with the execution of other tasks.SOLUTION: A vehicle control device 4 includes: a shared storage 9 shared by multiple applications; and an access right management unit 14 configured to divide one time slot so as to include a static area corresponding to an application's access request by a time trigger method and a dynamic area corresponding to an application's access request by an event trigger method and allocate an access right to the shared storage from the application to either the static area or the dynamic area.SELECTED DRAWING: Figure 1

Description

The present invention relates to a vehicle control device, a vehicle control system, and an access right management program.

In the in-vehicle environment, there is an increasing need to store various data in the vehicle due to increasing legal requirements and image analysis needs. However, a configuration in which a dedicated storage is individually provided for an electronic control device mounted on a vehicle is not efficient from the viewpoints of cost, mounting space, centralized data management, and the like. Under these circumstances, it is envisioned that a shared storage will be provided that will be shared by multiple applications. A configuration with shared storage is superior in terms of cost, mounting space, centralized data management, etc., but when the app executes data write / read tasks to the shared storage, access rights from the app Need to be managed. For example, in Patent Document 1, priority is set for a task executed by an application, interrupt processing is performed according to the set priority to ensure real-time performance, and interrupt processing overwrites the same memory area. The configuration to avoid is disclosed.

Japanese Unexamined Patent Publication No. 2002-278779

However, in a configuration such as Patent Document 1 in which interrupt processing is performed according to priority, if there is a task that requires periodic data writing, such as a trace log of automatic operation, the priority is higher than that task. If a task with a high value is interrupted, there is a problem that the task that requires periodic data writing is interrupted. If the priority of a task that requires periodic data writing is set to the highest level, other tasks cannot be executed.

The present invention has been made in view of the above circumstances, and an object of the present invention is to appropriately balance the execution of a task that requires regular access to the shared storage and the execution of other tasks. It is an object of the present invention to provide a vehicle control device, a vehicle control system, and an access right management program which can be used.

According to the first aspect of the present invention, the shared storage (9) shared by a plurality of applications, one time slot, a static area corresponding to an access request by a time-triggered method from the application, and a static area from the application. With the access right management unit (14) that divides the area so as to include the dynamic area corresponding to the access request by the event trigger method and allocates the access right to the shared storage from the application to either the static area or the dynamic area. , Equipped with. By providing a static area and a dynamic area in one time slot, tasks that require regular access to the shared storage can be executed within the time of the static area, and other tasks such as, for example. Tasks that do not require regular access but have a higher priority than others, or tasks that require irregular access regardless of priority, can be executed within the time of the dynamic area. As a result, it is possible to appropriately balance the execution of tasks that require regular access to the shared storage with the execution of other tasks.

Functional block diagram showing an embodiment Diagram showing the time slot Diagram showing multiple consecutive time slots Diagram showing the time slot Diagram showing the processing flow Diagram showing the processing flow Diagram showing the processing flow Diagram showing the processing flow Diagram showing the processing flow Diagram showing the time slot Diagram showing the time slot Diagram showing the time slot Diagram showing the time slot Diagram showing the time slot Diagram showing the time slot Diagram showing the time slot Diagram showing the time slot Diagram showing the time slot Diagram showing multiple consecutive time slots Diagram showing multiple consecutive time slots Diagram showing multiple consecutive time slots

Hereinafter, one embodiment will be described with reference to the drawings. In the description described later, the application means software for causing an electronic control device or a vehicle control device to execute a predetermined operation, and broadly includes the concept of a thread or a module. As shown in FIG. 1, the vehicle control system 1 mounted on the vehicle integrates and manages two electronic control devices (hereinafter referred to as ECUs: Electronic Control Units) 2 and 3 and ECUs 2 and 3. It has an integrated ECU 4, and the ECUs 2 and 3 and the integrated ECU 4 are configured to enable data communication via the bus 5. The integrated ECU 4 corresponds to a vehicle control device. Bus 5 is, for example, CAN (Controller Area Network) (registered trademark), LIN (Local Interconnect Network) (registered trademark), CXPI (Clock Extension Peripheral Interface) (registered trademark), FlexRay (registered trademark), MOST (Media Oriented Systems). Transport) (registered trademark), etc. Although two ECUs are exemplified in this embodiment, the number of ECUs connected to the integrated ECU 4 and the bus 5 via the bus 5 may be one or three or more.

The integrated ECU 4 has a bus communication unit 6, a first control unit 7, a second control unit 8, and a shared storage 9. The bus communication unit 6 performs data communication with the bus 5. The first control unit 7 is composed of a microcomputer having a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), and an I / O (Input / Output).

The first control unit 7 executes a process corresponding to the control program by executing the control program stored in the non-transitional substantive storage medium, and cooperates with the second control unit 8 as necessary. It controls the overall operation of the integrated ECU 4. The first control unit 7 manages the operations of the applications 4a to 4c mounted on the integrated ECU 4, and executes the applications 4a to 4c when the activation request of the applications 4a to 4c is generated. The applications 4a to 4c whose operations are managed by the first control unit 7 correspond to the applications belonging to the first group, and in this embodiment, three applications 4a to 4c are exemplified, but two or less may be used. 4 or more may be used. The control program executed by the first control unit 7 includes an access right management program.

Like the first control unit 7, the second control unit 8 is composed of a microcomputer having a CPU, a ROM, a RAM, and an I / O. The second control unit 8 executes a process corresponding to the control program by executing the control program stored in the non-transitional substantive storage medium, and cooperates with the first control unit 7 as necessary. It controls the overall operation of the integrated ECU 4. The second control unit 8 manages the operation of the applications 4d to 4f mounted on the integrated ECU 4, and executes the applications 4d to 4f when the activation request of the applications 4d to 4f is generated. The applications 4d to 4f whose operation is managed by the second control unit 8 correspond to the applications belonging to the second group, and in this embodiment, three applications 4d to 4f are exemplified, but two or less may be used. It may be 4 or more.

The ECU 2 has a bus communication unit 10 and a control unit 11. The bus communication unit 10 performs data communication with the bus 5. The control unit 11 is composed of a microcomputer having a CPU, a ROM, a RAM, and an I / O. The control unit 11 executes a process corresponding to the control program by executing a control program stored in the non-transitional substantive storage medium, and controls the overall operation of the ECU 2. The control unit 11 manages the operation of the application 2a mounted on the ECU 2, and executes the application 2a when a start request for the application 2a is generated. In the present embodiment, one of the applications 2a is exemplified as the application whose operation is managed by the control unit 11, but two or more applications may be used.

The ECU 3 has a bus communication unit 12 and a control unit 13. The bus communication unit 12 performs data communication with the bus 5. The control unit 13 is composed of a microcomputer having a CPU, a ROM, a RAM, and an I / O. The control unit 13 executes a process corresponding to the control program by executing a control program stored in the non-transitional substantive storage medium, and controls the overall operation of the ECU 3. The control unit 13 manages the operation of the application 3a mounted on the ECU 3, and executes the application 3a when a start request for the application 3a occurs. In the present embodiment, one of the applications 3a is exemplified as the application whose operation is managed by the control unit 13, but two or more applications may be used.

The applications 2a, 3a, 4a to 4f are, for example, an application that controls a body system, an application that controls a power train system, an application that controls a gateway system, and the like, and are applications that perform various controls related to a vehicle. The shared storage 9 is a storage medium having a predetermined data capacity for storing various data. The shared storage 9 is not a volatile storage medium such as RAM, but a non-volatile storage medium such as an HDD (Hard Disk Drive), and is different from the storage medium in which the above-mentioned control program is stored.

The applications 4a to 4c mounted on the integrated ECU 4 access the shared storage 9 via the first control unit 7 inside the integrated ECU 4, and execute tasks of writing and reading data to the shared storage 9. In the applications 4d to 4f mounted on the integrated ECU 4, the first control unit 7 and the second control unit 8 communicate data inside the integrated ECU 4 via the second control unit 8 and the first control unit 7. Access the shared storage 9 and execute tasks of writing and reading data to the shared storage 9. The applications 2a and 3a mounted on the ECUs 2 and 3 access the shared storage 9 via the bus 5, respectively, and execute tasks of writing and reading data to the shared storage 9.

In the above configuration, the shared storage 9 is shared by the applications 2a, 3a, 4a to 4f without individually providing the dedicated storage in the ECUs 2 and 3, and the apps 2a, 3a, 4a to 4f each share the shared storage 9 of the integrated ECU 4. It is advantageous in terms of cost, mounting space, centralized data management, etc. That is, in the configuration in which the dedicated storages are individually provided in the ECUs 2 and 3, there is a problem that the ECUs 2 and 3 become expensive and the size becomes large, and data management is complicated when the data is shared by the ECUs 2 and 3 and the integrated ECU 4. There is a problem that the number of ECUs increases, and the influence of such a problem increases. In the present embodiment, it is possible to avoid the occurrence of such a problem by providing the shared storage 9.

The types of tasks executed by the applications 2a, 3a, 4a to 4f include tasks that require periodic access to the shared storage 9, that is, tasks that require periodic data writing and reading. It does not require regular access to the shared storage 9 but has a higher priority than others, that is, it does not require periodic data writing or reading but writes or reads data more than others when an event occurs. Tasks that should be prioritized and tasks that require irregular access to the shared storage 9 regardless of priority, that is, tasks that require irregular data writing and reading regardless of priority. There is.

Tasks that require periodic data writing and reading include, for example, a task of writing data such as an automatic operation trace log and a task of writing data such as a security detection monitoring log. Tasks that do not require periodic data writing and reading but should prioritize data writing and reading over others when an event occurs, and require irregular access to shared storage 9 regardless of priority. The tasks to be performed are, for example, a task of writing video data, vehicle speed data, etc. when detecting an obstacle and controlling collision avoidance, a task of writing abnormal data when an external electronic attack is detected, and the like. .. In this case, the amount of data to be written or read by accessing the shared storage 9 by each task may be large or small.

The first control unit 7 has an access right management unit 14 that allocates access rights to the shared storage 9 from a plurality of applications. As shown in FIG. 2, the access right management unit 14 divides one time slot into a plurality of time slots so as to include a static area (Static Segment), a dynamic area (Dynamic Segment), and a buffer area (Buffer). Allocate the access right to the shared storage 9 from the application to either the static area or the dynamic area (corresponding to the allocation procedure). The static area is an area corresponding to an access request by a time trigger method from an application, and is an area for securing an access right to the shared storage 9 from a specific application at a fixed cycle timing. The dynamic area is an area corresponding to an access request by the event trigger method from the application, and is an area for securing the access right to the shared storage 9 from the specific application at the timing of each request from the application. The buffer area is an area for adjustment, idling, and the like. Although the time width of one time slot is illustrated in 1 to 5 milliseconds in FIG. 2, a time width other than 1 to 5 milliseconds may be set in advance.

By dividing one time slot into a static area, a dynamic area, and a buffer area in this way, the access right management unit 14 is static in a plurality of consecutive time slots as shown in FIG. A target area, a dynamic area, and a buffer area are periodically secured. That is, the access right management unit 14 can periodically allow both access requests from the application for both the time-triggered access request and the event-triggered access request.

The access right management unit 14 can variably set the time width of the time slot, and can variably set the time width of each of the static area, the dynamic area, and the buffer area in the time slot. The time width of the time slot, the static area in the time slot, the dynamic area, and the buffer area are transmitted from the diagnostic tool, for example, when a diagnostic tool or the like is wiredly connected to the integrated ECU 4 via the bus 5. The change instruction signal may be changed by being received by the integrated ECU 4, or the server is wirelessly connected to the integrated ECU 4 via a communication network, and the change instruction signal transmitted from the server is received by the integrated ECU 4. May be changed.

Next, the operation of the above configuration will be described with reference to FIGS. 4 to 21. Here, apps A and B are apps that execute tasks that require constant writing and reading of data, and application C does not require writing and reading of data all the time, but has priority over others when an event occurs. Is an app that performs high-level tasks. The applications A to C may be any of the applications 2a mounted on the ECU 2, the applications 3a mounted on the ECU 3, and the applications 4a to 4f mounted on the integrated ECU 4. In this case, the access right management unit 14 allocates the access right to the shared storage 9 from the applications A to C so as to include the static areas of the applications A and B as shown in FIG.

As shown in FIG. 5 and the like, the access right management unit 14 transmits timing notifications indicating the timing of the static area to the applications A and B (S1, S2). When the application A receives the timing notification of the static area from the access right management unit 14, it sets the access timing to the shared storage 9 according to the timing notification of the received static area, and when the setting of the access timing is completed, the setting is made. The completion notification is transmitted to the access right management unit 14 (S3). Similarly to the application A, when the application B receives the timing notification of the static area from the access right management unit 14, the access timing to the shared storage 9 is set according to the timing notification of the received static area, and the access timing is set. When the setting is completed, the setting completion notification is transmitted to the access right management unit 14 (S4).

When the access timing set by the application A, that is, the timing at which the access right to the shared storage 9 is granted, the application A transmits an access request to the shared storage 9 to the access right management unit 14 (S5). The access right management unit 14 monitors the reception of the access request to the shared storage 9 from any application, and when it detects the reception of the access request to the shared storage 9 from the application A, it detects the reception of the access request. Since the timing is within the time allocated to the application A as the static area, the access request from the application A is permitted and the access permission notification is transmitted to the application A (S6).

Upon receiving the access permission notification from the access right management unit 14, the application A executes a task of writing or reading data to the shared storage 9 (S7). The access right management unit 14 monitors the progress of the task of writing and reading data, and when the task is completed, sends a task completion notification to the application A (S8). The access right management unit 14 forcibly terminates the writing and reading of data from the application A to the shared storage 9 when the time of the static area allocated to the application A has elapsed without completing the task. After that, the application A monitors the next access timing, and when the next access timing comes, repeats the above-mentioned process and periodically executes the task of writing and reading data to the shared storage 9.

In the above description, the access request to the shared storage 9 from the application A was generated within the time allocated to the application A as a static area, but the sharing from the application A is caused by factors such as synchronization deviation in the system. An access request to the storage 9 may occur within the time allocated to the application B as a static area. In that case, the access right management unit 14 prohibits the access request from the application A and sends an access prohibition notification to the application A.

When the access timing set by the application B, that is, the timing at which the access right to the shared storage 9 is granted, the application B transmits an access request to the shared storage 9 to the access right management unit 14 (S9). The access right management unit 14 monitors the reception of the access request to the shared storage 9 from any application, and when it detects the reception of the access request to the shared storage 9 from the application B, it detects the reception of the access request. Since the timing is within the time allocated to the application B as the static area, the access request from the application B is permitted and the access permission notification is transmitted to the application B (S10).

Upon receiving the access permission notification from the access right management unit 14, the application B executes a task of writing or reading data to the shared storage 9 (S11). The access right management unit 14 monitors the progress of the task of writing and reading data, and when the task is completed, sends a task completion notification to the application B (S12). Also in this case, the access right management unit 14 forcibly terminates the writing and reading of data from the application B to the shared storage 9 when the time of the static area allocated to the application B has elapsed without completing the task. After that, the application B also monitors the next access timing like the application A, and when the next access timing comes, repeats the above-mentioned process and periodically executes the task of writing and reading data to the shared storage 9. do.

In this case as well, an access request to the shared storage 9 from the application B may occur within the time allocated to the application A as a static area due to a factor such as a synchronization deviation in the system. In that case, the access right management unit 14 prohibits the access request from the application B and sends an access prohibition notification to the application B.

When the event occurs, the application C transmits an access request to the shared storage 9 to the access right management unit 14 (S13). The access right management unit 14 monitors the reception of the access request to the shared storage 9 from any of the applications, and when it detects the reception of the access request to the shared storage 9 from the application C, as shown in FIG. If the timing at which the reception of the access request is detected is in the dynamic region, the access request from the application C is permitted, and the access permission notification is transmitted to the application C (S14).

Upon receiving the access permission notification from the access right management unit 14, the application C executes a task of writing or reading data to the shared storage 9 (S15). The access right management unit 14 monitors the progress of the task of writing and reading data, and when the task is completed, sends a task completion notification to the application C (S16). Also in this case, the access right management unit 14 forcibly terminates the writing and reading of data from the application C to the shared storage 9 when the time in the dynamic area elapses without completing the task. After that, the application C monitors the occurrence of the next event, and when the next event occurs, repeats the above-mentioned process and sends an access request to the shared storage 9 to the access right management unit 14. Further, the access right management unit 14 performs the same processing for the access request to the shared storage 9 from the applications A to C in the cycle of the next time slot (S17, S18, S19, S20, ...).

On the other hand, as shown in FIG. 6, the access right management unit 14 makes an access request from the application C if the timing of detecting the reception of the access request to the shared storage 9 from the application C is not in the dynamic area. Prohibit and send an access prohibition notification to application C (S21).

Upon receiving the access prohibition notification from the access right management unit 14, the application C does not execute the task of writing or reading data to the shared storage 9. In this case, when the application C receives the access prohibition notification from the access right management unit 14, the occurrence of the event may be invalidated and the occurrence of the next event may be waited for. Further, the application C may continue to enable the occurrence of the event, and immediately after that, the access request may be transmitted again to the access right management unit 14, that is, the transmission of the access request may be retried.

Further, as shown in FIG. 7, the access right management unit 14 may prohibit the access request from the application C and notify the timing of the next dynamic area when transmitting the access prohibition notification to the application C. (S31). When the timing of the next dynamic area is notified from the access right management unit 14, the application C transmits an access request to the access right management unit 14 at the timing of the next notified dynamic area (S32). When the access right management unit 14 detects the reception of the access request to the shared storage 9 from the application C, the timing of detecting the reception of the access request is in the dynamic area, so that the access request from the application C is permitted. , Send the access permission notification to the application C (S33). After that, when the application C receives the access permission notification from the access right management unit 14, it executes a task of writing or reading data to the shared storage 9 (S34).

Further, for example, the application A transmits an allocation change request to the access right management unit 14 as shown in FIG. 8 and the like (S41). When the access right management unit 14 detects the reception of the allocation change request for the shared storage 9 from the application A, it determines whether or not the time width of the static area allocated to the application A can be changed.

When the access right management unit 14 determines that the time width of the static area allocated to the application A can be changed, the access right management unit 14 permits the allocation change request from the application A, and as shown in FIG. 8, the change permission notification. Is sent to the application A (S42), and the time width of the static area of the application A in the next time slot is changed. On the other hand, when the access right management unit 14 determines that the time width of the static area allocated to the application A cannot be changed, the access right management unit 14 prohibits the allocation change request from the application A and changes the time width as shown in FIG. A prohibition notification is sent to the application A (S43), and the time width of the static area of the application A in the next time slot is not changed and is equal to the current time width.

As a case of changing the time width of the static area allocated to the application A, there are cases where the time width is decreased and cases where the time width is increased. Specifically, if the application A requests a decrease in the time width of the static area, for example, the access right management unit 14 may reduce the time width of the static area of the application A to reduce the time width of the current application. Since the static area, the dynamic area, and the buffer area of B can be maintained, it is determined that the time width of the static area allocated to the application A can be changed. In that case, the access right management unit 14 may reduce the time width of one time slot according to the decrease in the time width of the static area of the application A, or maintain the time width of one time slot. As it is, the decrease in the time width of the static area of the application A may be allocated to any of the static area, the dynamic area, and the buffer area of the application B.

That is, as shown in FIG. 10, the access right management unit 14 reduces the time width of one time slot according to the decrease in the time width of the static area of the application A, and moves the static area of the application B. The time width of the target area and the buffer area may be maintained. As shown in FIG. 11, the access right management unit 14 may allocate a decrease in the time width of the static area of the application A to the static area of the application B while maintaining the time width of one time slot. As shown in FIGS. 12 and 13, the access right management unit 14 may allocate a decrease in the time width of the static area of the application A to the dynamic area while maintaining the time width of one time slot. In this case, one dynamic area may be divided and allocated within one time slot, or may be collectively allocated. As shown in FIG. 14, the access right management unit 14 may allocate a decrease in the time width of the static area of the application A to the buffer area while maintaining the time width of one time slot. When the access right management unit 14 changes the position of the static area of the application B in one time slot, the access right management unit 14 needs to send a timing notification indicating the timing of the static area to the application B again.

On the other hand, if the application A requests an increase in the time width of the static area, for example, the access right management unit 14 may affect other areas by increasing the time width of the static area of the application A. Since there is a possibility, if there is no possibility of affecting other areas, it is determined that the time width of the static area assigned to application A can be changed, and there is a possibility of affecting other areas. If so, it is determined that the time width of the static area allocated to the application A cannot be changed.

That is, as shown in FIG. 15, the access right management unit 14 increases the time width of one time slot according to the increase in the time width of the static area of the application A, and moves the static area of the application B. If the time width of the target area and the buffer area can be maintained, it may be determined that the time width of the static area assigned to the application A can be changed. As shown in FIG. 16, if the access right management unit 14 can supplement the increase in the time width of the static area of the application A with the buffer area while maintaining the time width of one time slot, the access right management unit 14 applies to the application A. It may be determined that the time width of the allocated static area can be changed. On the other hand, if the access right management unit 14 cannot supplement the increase in the time width of the static area of the application A with the buffer area while maintaining the time width of one time slot, the static allocation to the application A is static. It may be determined that the time width of the target area cannot be changed.

As shown in FIG. 17, if the access right management unit 14 can supplement the increase in the time width of the static area of the application A with the static area of the application B while maintaining the time width of one time slot. , It may be determined that the time width of the static area allocated to the application A can be changed. On the other hand, if the increase in the time width of the static area of the application A cannot be complemented by the static area of the application B while maintaining the time width of one time slot, the access right management unit 14 allocates it to the application A. It may be determined that the time width of the static area is immutable.

As shown in FIG. 18, if the access right management unit 14 can supplement the increase in the time width of the static area of the application A with the dynamic area while maintaining the time width of one time slot, the application A It may be determined that the time width of the static area allocated to is changeable. On the other hand, the access right management unit 14 is assigned to the application A if the increase in the time width of the static area of the application A cannot be complemented by the dynamic area while maintaining the time width of one time slot. It may be determined that the time width of the static area cannot be changed.

Further, although FIGS. 8 and 9 illustrate the case where the allocation change request for the shared storage 9 from the application A is received in the buffer area, the allocation change request may be received in the static area of the application A. .. If the period for changing the time of the static area and the number of accesses are limited, at least one of the access right management unit 14 and the application A manages the period for changing the time width of the static area and the number of accesses. However, the period during which the allocation change request is valid and the number of accesses may be managed.

It should be noted that any of the applications A to C may send the allocation change request to the access right management unit 14. That is, the application C that executes the task having a higher priority than the others may send the allocation change request to the access right management unit 14. In that case, by reducing the time width of the dynamic area, the reduced amount may be allocated to either the static area or the buffer area of the application A or the application B, and the time width of the dynamic area may be increased. Then, the increase may be supplemented by either the static area or the buffer area of the application A or the application B.

Further, in the above configuration, when executing the task of writing or reading data to the shared storage 9 via the bus 5 as in the applications 2a and 3a mounted on the ECUs 2 and 3, the access to the shared storage 9 is performed. Even at the timing when the right is granted, if the communication band of bus 5 is used for other data communication, there are problems such as the task of writing and reading data becoming unexecutable or delayed. Occurrence is expected. In order to avoid the occurrence of such a problem, an application that executes a task of writing or reading data to the shared storage 9 via the bus 5 requires regular access to the shared storage 9. In the case of an application, it is desirable to secure the communication band of the bus 5 in the vehicle control system 1 according to the data capacity thereof. Further, for example, if the bus 5 is a bus that employs a time-triggered protocol such as FlexRay, the data communication timing between the application and the bus 5 and the data communication between the shared storage 9 and the bus 5 It is desirable to synchronize with the timing.

The above has described the case where the areas to be allocated are the same in a plurality of consecutive time slots, but the areas to be allocated may be different. As shown in FIG. 19, the access right management unit 14 allocates the access right from the application A to the static area of the first time slot in a plurality of consecutive time slots, and assigns the access right from the application B to the second time. It may be allocated to the static area of the slot, and the first time slot and the second time slot may be periodically repeated.

Further, the access right management unit 14 may, for example, in a situation where it is assumed that the data capacity in one access is irregularly large for the application C, in a plurality of consecutive time slots as shown in FIG. The access rights from app A and app B are assigned to the static area of the first time slot, the access rights from app A and app B are assigned to the static area of the second time slot, and the static area is assigned to the third time slot. A large number of dynamic areas may be secured without allocating, and the first to third time slots may be repeated periodically. Further, as shown in FIG. 21, the access right management unit 14 allocates the access right from the application A to the static area of the first time slot in a plurality of consecutive time slots, and assigns the access right from the application B to the static area. It may be allocated to the static area of the two time slots, a large number of dynamic areas may be secured without allocating the static area to the third time slot, and the first to third time slots may be repeated periodically.

As described above, according to the present embodiment, the following effects can be obtained. In the integrated ECU 4, one time slot is divided into a static area and a dynamic area, and the access right from the application to the shared storage 9 shared by a plurality of applications is set to either the static area or the dynamic area. I tried to assign it to crab. By executing tasks that require periodic access to the shared storage 9 within the time of the static area and executing other tasks within the time of the dynamic area, the tasks that require periodic access to the shared storage 9 are executed periodically to the shared storage 9. It is possible to appropriately balance the execution of tasks that require specific access with the execution of other tasks. That is, in the vehicle control system 1, the execution of a task that requires periodic access to the shared storage 9 and the execution of other tasks can appropriately coexist.

Further, in the integrated ECU 4, the time width of the time slot and the time width of the static region and the dynamic region in the time slot can be set variably. It is possible to appropriately respond to the frequency of access requests from the application, data transfer speed, and increase / decrease in data capacity. For example, if the cycle of the access request from the application that requires periodic access to the shared storage 9 is relatively short, the time width of the time slot is set to be relatively short, while the cycle of the access request is relatively short. If it is relatively long, it can be appropriately dealt with by setting the time width of the time slot to be relatively long. For example, if the access request from the application that requires regular access to the shared storage 9 increases or is expected to increase, the time width of the static area is increased, while the access request decreases or is expected to increase. If it is expected to decrease, it can be appropriately dealt with by reducing the time width of the static area. For example, if the access request from an app with a higher priority than others is expected to increase or increase, the time width of the dynamic area is increased, while if the access request is expected to decrease or decrease, the access request is expected to decrease or decrease. It can be appropriately dealt with by reducing the time width of the dynamic area.

Further, in the integrated ECU 4, one time slot is added to the static area and the dynamic area, and is divided so as to include the buffer area. By changing the time width of the buffer area without changing the time width of the time slot, the time width of the static area or the dynamic area can be flexibly changed. If a part or the whole of the buffer area is provided to the static area, the time width of the static area can be increased without changing the time width of the dynamic area. If a part or the whole of the buffer area is provided to the dynamic area, the time width of the dynamic area can be increased without changing the time width of the static area.

Further, in the integrated ECU 4, the time width of the buffer area can be set variably. It is possible to increase the degree of freedom when changing the time width of the static area or the dynamic area while ensuring the time width provided to the static area or the dynamic area. If the time width of the buffer area is set relatively short, the time width of the static area or the dynamic area can be secured relatively long in normal times, while the time width of the buffer area is relatively long. If set, the time width of the static area or the dynamic area can be appropriately secured in an emergency when it becomes necessary to increase the time width of the static area or the dynamic area.

Further, in the integrated ECU 4, when the application accesses the shared storage 8 via the bus 5, the data communication timing between the application and the bus 5 and the data between the shared storage 9 and the bus 5 Changed to synchronize with communication timing. When the application executes the task of writing or reading data to the shared storage 9 via the bus 5, it avoids the occurrence of problems such as the task of writing or reading data becoming unexecutable or delayed. And can perform the task properly.

The present disclosure has been described in accordance with the examples, but it is understood that the present disclosure is not limited to the examples and structures. The present disclosure also includes various variations and variations within a uniform range. In addition, various combinations and forms, as well as other combinations and forms containing only one element, more, or less, are within the scope and scope of the present disclosure.

The controls and methods thereof described in the present disclosure are realized by a dedicated computer provided by configuring a processor and memory programmed to perform one or more functions embodied by a control program. May be. Alternatively, the control unit and its method described in the present disclosure may be realized by a dedicated computer provided by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the control unit and method thereof described in the present disclosure may be a combination of a processor and memory programmed to perform one or more functions and a processor composed of one or more hardware logic circuits. It may be realized by one or more dedicated computers configured. Further, the control program may be stored in a computer-readable non-transitional tangible recording medium as an instruction executed by the computer.

In the drawings, 1 is a vehicle control system, 2 and 3 are electronic control devices, 4 is an integrated ECU (vehicle control device), 7 is a first control unit, 8 is a second control unit, 9 is a shared storage, and 14 is. Access right management department.

Claims (15)

Shared storage (9) shared by multiple apps and
One time slot is divided so as to include a static area corresponding to an access request by the time-triggered method from the application and a dynamic area corresponding to an access request by the event-triggered method from the application. A vehicle control device (4) including an access right management unit (14) that allocates access rights to the shared storage from the above to either the static area or the dynamic area. The access right management unit targets at least one of a plurality of consecutive time slots, classifies the targeted time slots so as to include the static area and the dynamic area, and the above-mentioned The vehicle control device according to claim 1, wherein the access right to the shared storage from the application is assigned to either the static area or the dynamic area. The access right management unit according to claim 1 or 2 allocates an access right from a first application that executes a first task that requires periodic access to the shared storage to the static area. Vehicle control device. The access right management unit does not require periodic access to the shared storage, but has a higher priority than the first task, or requires irregular access regardless of the priority. The vehicle control device according to any one of claims 1 to 3, wherein an access right from a second application for executing a task is assigned to the dynamic area. It includes a first control unit (7) that manages the operation of the application belonging to the first group and a second control unit (8) that manages the operation of the application belonging to the second group.
The access right management unit is provided in the first control unit, and the access right to the shared storage from the application belonging to the first group is assigned to either the static area or the dynamic area, and the access right management unit is assigned to either the static area or the dynamic area. A claim for allocating an access right to the shared storage from an application belonging to the second group to either the static area or the dynamic area by performing data communication between the first control unit and the second control unit. The vehicle control device according to any one of Items 1 to 4. The vehicle control device according to any one of claims 1 to 5, wherein the access right management unit can variably set the time width of the time slot. The vehicle control device according to any one of claims 1 to 6, wherein the access right management unit can variably set at least one of the static area and the dynamic area. The vehicle control device according to any one of claims 1 to 7, wherein the access right management unit divides one time slot into a buffer area in addition to the static area and the dynamic area. .. The vehicle control device according to claim 8, wherein the access right management unit can variably set the time width of the buffer area. The access right management unit notifies the application of the timing of the next dynamic area when the application to be accessed at the timing of the dynamic area accesses at the timing of the static area. The vehicle control device according to any one of the above. When the application accesses the shared storage via the bus, the access right management unit determines the data communication timing between the application and the bus and the space between the shared storage and the bus. The vehicle control device according to any one of claims 1 to 10, which synchronizes with the data communication timing. The vehicle control device (4) on which the application is mounted and the electronic control device (2, 3) on which the application is mounted are provided, and the vehicle control device and the electronic control device can perform data communication. In the vehicle control system (1)
The vehicle control device is
Shared storage (9) shared by multiple apps and
One time slot is divided so as to include a static area corresponding to an access request by the time-triggered method from the application and a dynamic area corresponding to an access request by the event-triggered method from the application. A vehicle control system including an access right management unit (14) that allocates access rights to the shared storage from the above to either the static area or the dynamic area. The electronic control device manages the operation of the first application that executes the first task that requires periodic access to the shared storage.
The vehicle control system according to claim 12, wherein the access sword management unit allocates an access right to the shared storage from the first application to the static area. The electronic control device manages the operation of a second application that executes a second task that does not require periodic access to the shared storage but has a higher priority than the first task.
The vehicle control system according to claim 12, wherein the access sword management unit allocates an access right to the shared storage from the second application to the dynamic area. In the control unit (7) of the vehicle control device (4) provided with the shared storage (9) shared by a plurality of applications,
One time slot is divided so as to include a static area corresponding to an access request by the time-triggered method from the application and a dynamic area corresponding to an access request by the event-triggered method from the application. An access right management program that executes an allocation procedure for allocating access rights to the shared storage from the static area to either the static area or the dynamic area.

Images