JP4125178B2 - Vehicle function guarantee system using dynamic reconfigurable device - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a technique for ensuring the function of a vehicle by ensuring the continuity of processing related to the vehicle performed by the in-vehicle computer even if the vehicle collides.
[0002]
[Prior art]
2. Description of the Related Art Conventionally, many vehicles are equipped with an in-vehicle computer called ECU (Engine Control Unit or Electronic Control Unit) that executes processing related to the vehicle. The ECU performs, for example, vehicle state monitoring and / or control as processing related to the vehicle. Specifically, the processing by the ECU covers a variety of monitoring and control of the automatic transmission (AT), the drive system, the braking system, and the steering system in addition to the engine control such as ignition timing and fuel injection. Yes.
[0003]
Since the ECU functions as a control device for each system constituting the vehicle, if the ECU itself is damaged, the control target of the ECU cannot be controlled. Thereby, the function of the vehicle may be impaired. For this reason, even when the vehicle collides, it is desired that the operation (monitoring and / or control) performed by the ECU is secured.
[0004]
The following methods are available to meet this demand.
(A) The ECU mounting location is set to a location that is least affected by the collision.
(B) Protect the ECU by making the ECU firmly or by adding an ECU protection plate or the like on the vehicle structure.
(C) A plurality of ECUs having the same function are arranged, or functions of other ECUs are added to a certain ECU to make the ECU a redundant system configuration.
[0005]
However, in the method (A), the positions where the vehicle can be arranged are limited due to the design of the vehicle. Also, the indoor space may be reduced. Further, the method (B) may increase the weight of the vehicle and increase the cost due to an increase in the number of parts. In the method (C), there is a possibility that the cost increases due to the redundant configuration.
[0006]
By the way, a technology called “dynamic reconfigurable technology” capable of switching the circuit configuration inside the chip dynamically and at high speed has already been proposed (see, for example, Non-Patent Document 1). Several devices (referred to herein as “dynamically reconfigurable devices”) that can dynamically and rapidly perform circuit configuration inside a chip have been proposed by reconfigurable technology using software.
[0007]
The dynamic reconfigurable device can rewrite (switch) the circuit in several ns to several tens of ns, and the circuit can be switched from the application program on the API (Application Program) of the OS (Operating system). Interface) can be done in 1 clock. Therefore, the dynamic reconfigurable device can function as a different circuit for each clock, and apparently can exhibit a function equivalent to that provided with a plurality of circuits.
[0008]
Further, as a means for predicting a vehicle collision, for example, a pre-crash sensor that detects a distance from a vehicle to an object using ultrasonic waves or radio waves has already been proposed (see, for example, Patent Document 1 and Patent Document 2).
[0009]
[Non-Patent Document 1]
Toshinori Shindo, “The idea of software creates virtual circuits. The hardware changes seven times instantly. Dynamic reconfigurable technology is born,” Nikkei Electronics, November 18, 2002, p69-p76.
[Patent Document 1]
JP 2001-206176 A
[Patent Document 2]
JP 2001-225680 A
[Problems to be solved by the invention]
The objective of this invention is providing the technique which can ensure the operation | movement of the vehicle-mounted computer at the time of the collision of a vehicle using a dynamic reconfiguration | reconfiguration device.
[0010]
[Means for Solving the Problems]
The present invention adopts the following configuration in order to achieve the above-described object.
[0011]
The first aspect of the present invention includes a dynamic reconfiguration device capable of dynamically and rapidly switching the internal circuit configuration of the chip by software, and performs processing related to the vehicle using this dynamic reconfiguration device. A plurality of in-vehicle computers,
An in-vehicle network connecting the in-vehicle computers;
A collision prediction means for predicting a vehicle collision;
When a collision is predicted by the collision prediction means, it corresponds to a process related to a vehicle that is executed by the certain in-vehicle computer from the certain in-vehicle computer that is expected to be affected by the collision. Transfer control means for performing control for transferring the software for configuring the dynamic reconfiguration device via the in-vehicle network;
A vehicle function guarantee system including
[0012]
In the first aspect, the other in-vehicle computers include both the in-vehicle computer “not expected to be affected by the collision” and the in-vehicle computer “not expected to be affected by the collision”. Can do.
[0013]
Preferably, in the first aspect, the certain in-vehicle computer is an execution software for performing a process related to the vehicle including a software for configuring a dynamic reconfiguration device corresponding to a process related to the vehicle performed by itself. To the other in-vehicle computer,
The other vehicle-mounted computer takes over the processing related to the vehicle that has been performed by the certain vehicle-mounted computer by executing the transferred execution software.
[0014]
In this case, the other in-vehicle computer performs both the process related to the vehicle by the transferred execution software and the process related to another vehicle being executed by switching the circuit configuration of the dynamic reconfiguration device. It can be constituted as follows.
[0015]
However, another in-vehicle computer may be configured to hold a portion in which the configuration software is removed from the execution software in advance and receive only the configuration software from a certain in-vehicle computer and execute the execution software.
[0016]
Preferably, in the first aspect, the transfer control means specifies an in-vehicle computer that is expected to be affected by a collision from a direction in which there is a possibility of a vehicle collision. An instruction to transfer the software for configuring the dynamic reconfiguration device to the in-vehicle computer is given.
[0017]
Preferably, in the first aspect, the transfer control means specifies an in-vehicle computer that is expected to be affected by a collision from a direction in which there is a possibility of a vehicle collision, and an in-vehicle computer other than the specified in-vehicle computer. In response to this, an instruction to download the software for configuring the dynamic reconfiguration device is given from the specified in-vehicle computer.
[0018]
For example, a direction in which there is a possibility of collision is provided with a sensor that detects the distance between the vehicle and an object outside the vehicle in association with one or more directions of the vehicle, and predicts the collision of the vehicle from the output of the sensor. It can be predicted from the direction corresponding to the sensor.
[0019]
Moreover, the in-vehicle computer that is expected to be affected by the collision can be identified by, for example, associating the collision direction with the installation position of the in-vehicle computer in advance.
[0020]
Moreover, this invention can be specified as a vehicle function ensuring method which has the substantially the same characteristic as the vehicle function ensuring system as a 1st aspect as a 2nd aspect.
[0021]
Moreover, this invention can also be specified as a 3rd aspect as a computer program with the characteristic substantially the same as the vehicle function ensuring system as a 1st aspect.
[0022]
Moreover, this invention can also be specified as a vehicle function ensuring apparatus containing the collision prediction means and transfer control means in a 1st aspect as a 4th aspect.
[0023]
Furthermore, this invention can also specify as a vehicle by which the vehicle function ensuring system as a 1st aspect is mounted as a 5th aspect.
[0024]
Furthermore, the present invention provides, as a sixth aspect, an in-vehicle computer mounted on a vehicle and connected to another in-vehicle computer via an in-vehicle network,
A dynamic reconfiguration device capable of dynamically and rapidly switching the internal circuit configuration of the chip by software;
Control means for performing processing related to the vehicle using the dynamic reconfiguration device;
When a vehicle collision is expected to reach the other in-vehicle computer, the vehicle is transferred from the other in-vehicle computer via the in-vehicle network to the vehicle running on the other in-vehicle computer. Receiving means for receiving execution software for performing such processing,
When the execution software is received by the receiving means, the control means performs a process related to a vehicle different from a process related to the vehicle performed by the other in-vehicle computer by executing another execution software. When the dynamic reconfiguration device is used, the process related to the vehicle by the execution of the execution software received together with the process related to the other vehicle is performed using the dynamic reconfiguration device.
It can also be specified as an in-vehicle computer.
[0025]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings. The configuration in the embodiment is an exemplification, and the present invention is not limited to the scope of the configuration of the embodiment.
[0026]
FIG. 1 is a diagram showing a schematic configuration of a vehicle function guarantee system in an embodiment of the present invention. 1, the vehicle function guarantee system includes a plurality of ECUs 1-1, 1-2,..., 1-n (n is a natural number; hereinafter, a specific ECU is designated as a plurality of in-vehicle computers mounted on the vehicle. Otherwise, it is referred to as “ECU1”), an in-vehicle network 2 that connects the ECUs, and a collision direction predicting means 3 that predicts the collision direction of the vehicle.
[0027]
The plurality of ECUs 1-1, 1-2,..., 1-n are arranged at a distance from each other in the vehicle. This is to prevent the influence of the vehicle collision from affecting all the ECUs 1. In addition, each ECU 1 is not affected (influenced) by the collision even when the ECU 1 is affected (influenced) by a collision in a certain direction between the vehicle and an object outside the vehicle. It arrange | positions so that at least 1 other ECU1 may exist.
[0028]
In the example shown in FIG. 1, the ECU 1-1 is arranged on the front (front) side in the vehicle, the ECU 1-2 is arranged on the right side (left side) in the vehicle, and the ECU 1-3 is arranged on the left side (right side) in the vehicle. The ECU 1-n is disposed on the rear (rear) side of the vehicle. In this case, the ECU 1-1 is arranged at a position where it is expected that this influence will not be exerted even if the influence of the collision behind the vehicle reaches the ECU 1-n. Further, the ECU 1-n is arranged at a position where it is expected that the influence of the collision ahead of the vehicle will not affect the ECU 1-1. Further, the ECU 1-2 is disposed at a position where the influence of the left collision of the vehicle is expected not to affect the ECU 1-3. The ECU 1-3 is arranged at a position where it is expected that the influence of the collision on the right side of the vehicle will not affect the ECU 1-2.
[0029]
Each ECU 1 has different execution software 11 (11-1, 11-2,..., So that each ECU 1 performs processing related to different vehicles (for example, vehicle state monitoring and / or control). 11-n: n is a natural number; hereinafter, when specific execution software is not designated, “execution software 11” is installed). Each ECU 1 executes processing related to the vehicle by executing the execution software 11.
[0030]
Here, each ECU 1 has a dynamic reconfiguration device 12 (12-1, 12-2, ..., 12-n: n is a natural number; hereinafter, when a specific dynamic reconfiguration device is not designated, (Represented as “dynamic reconfiguration device 12”). The execution software 11 includes configuration software for switching (reconfiguring) the circuit configuration of the dynamic reconfiguration device 12 to a configuration corresponding to the process related to the vehicle executed by the ECU 1. When executed, the circuit configuration of the dynamic reconfiguration device 12 is configured to correspond to the processing related to the vehicle. Processing related to the vehicle is executed using such a dynamic reconfiguration device 12.
[0031]
The in-vehicle network 2 is configured by a LAN, for example. However, other contact type (wired communication) or non-contact communication such as wireless LAN or BlueTooth can also be applied. Each ECU 1 can transfer the execution software 11 and, if necessary, data (for example, data used when executing the execution software 11) to another ECU 1 via the in-vehicle network 2.
[0032]
The collision direction prediction unit 3 functions as a collision prediction unit that detects the distance between the vehicle and an object outside the vehicle by using ultrasonic waves or radio waves, determines whether or not there is a possibility of a collision, and specifies the collision direction. At the same time, it functions as transfer control means for performing control for transferring the execution software 11 executed in the ECU 1 that is expected to be affected by the collision to another ECU 1 that is expected not to be affected.
[0033]
FIG. 2 is a diagram illustrating a configuration example of each ECU 1 illustrated in FIG. 1. As shown in FIG. 2, each ECU 1 includes a CPU 1 as control means, a memory 22 (configured by ROM, RAM, etc.), a chip of the dynamic reconfiguration device 12, and a communication control device 23 as reception means. And input / output units and the like are connected via a bus or the like.
[0034]
The memory 22 is used as a storage area for the execution software 11 and various data and a work area for the CPU 21. The CPU 21 executes processing related to the vehicle by reconfiguring the circuit configuration of the dynamic reconfiguration device 12 by executing the execution software 11.
[0035]
The communication control device 23 is a network interface device such as a LAN interface device, and is connected to the in-vehicle network 2 and manages processing related to communication with other ECUs 1 and the collision direction prediction means 3.
[0036]
FIG. 3 is a diagram showing a configuration example of the collision direction predicting means 3. As shown in FIG. 3, the collision direction predicting means 3 includes an electronic control unit 31 and a plurality of pre-crash sensors 32F, 32B, 32R, 32L connected to the electronic control unit 31 (in the case where a specific pre-crash sensor is not designated). Is expressed as “pre-crash sensor 32”) and a communication control device 33 connected to the electronic control device 31.
[0037]
The electronic control unit 31 includes a CPU, a ROM, a RAM, an input / output port device, and the like, and can be configured by a microcomputer and a drive circuit having a known configuration in which these are connected to each other by a bidirectional common bus. The electronic control device 31 holds a transfer control table 34 of the execution software 11.
[0038]
The pre-crash sensor 32F is provided on the front surface of the vehicle, the pre-crash sensor 32B is provided on the rear surface of the vehicle, the pre-crash sensor 32R is provided on the right surface of the vehicle, and the pre-crash sensor 32L is provided on the left surface of the vehicle. Each pre-crash sensor 32 detects the distance to the object with respect to each surface of the vehicle using ultrasonic waves or radio waves. In this embodiment, the pre-crash sensor 32 is provided on each of the front, rear, right, and left surfaces of the vehicle, thereby associating the pre-crash sensor 32 with the direction in which the vehicle may collide.
[0039]
The pre-crash sensor 32 (a sensor for predicting a collision) can be prepared in consideration of the installation position of the ECU 1 and the continuity of processing related to the vehicle performed by the ECU 1. That is, in the above example, the ECU 1 is installed on each of the front, rear, left and right sides of the vehicle, and in order to guarantee (collateralize) the continuation of the processing related to the vehicle performed by each ECU 1 even at the time of the vehicle collision, Pre-crash sensors 32 corresponding to the front, rear, left and right directions are respectively provided in accordance with these ECUs 1. On the other hand, if it is desired to ensure the continuity of the process related to the vehicle (that is, the function of the vehicle based on the process related to the vehicle) by one or more specific ECUs 1 instead of all the ECUs 1, the process is continued Pre-crash sensor so that a collision in that direction can be predicted in accordance with the direction corresponding to the installation position of the ECU 1 that performs processing related to the vehicle for which security is desired (for example, forward in the case of the ECU 1-1). 32 is installed. In this sense, for an ECU 1 for which a corresponding sensor is not prepared (for example, an ECU 1 that performs processing related to a vehicle that is not important (the continuity of processing may not be ensured)), the ECU 1 is affected by a collision. Even in this case, there may not be another ECU 1 that is not expected to be affected by the collision.
[0040]
The communication control device 33 is composed of, for example, a LAN interface device, is connected to the in-vehicle computer 2 (LAN), and manages processing related to communication with each ECU 1.
[0041]
FIG. 4 is a flowchart showing an example of collision prediction / transfer control processing by the electronic control unit 31 of the collision direction predicting means 3 as the vehicle function guarantee device. The collision prediction / transfer control process shown in FIG. 4 is configured to always be executed.
[0042]
4, the electronic control unit 31 specifies one pre-crash sensor 32 (step S1), and the sensor output detected by the pre-crash sensor 32 (the distance between the vehicle and the object detected by the pre-crash sensor 32). : This distance) is obtained (step S2).
[0043]
Then, the electronic control unit 31 determines whether or not there is a possibility of collision based on the sensor output (step S3). The process of step S3 is performed as follows, for example. The electronic control unit 31 calculates the deviation between the current distance and the sensor output (previous distance) previously detected from the corresponding pre-crash sensor 32, and calculates the degree of collision tightness based on the current distance and the deviation. To do. In this case, the degree of tightness is calculated, for example, as a function of the current distance and deviation so that the smaller the current distance and the larger the deviation, the larger the value. And it is discriminate | determined whether there exists a possibility that a vehicle may collide by discrimination | determination of whether the degree of tightness exceeds a reference value (threshold value: positive constant). If it is not determined that there is a possibility of a collision (S3; NO), the process returns to step S1. If it is determined that there is a possibility of a collision (S3; YES), the process proceeds to step S4. move on.
[0044]
If it is determined that there is a possibility of a collision, the electronic control unit 31 performs processing related to transfer control using the table 34 in steps S4 and S5. Here, the table 34 stores one or more records including the collision direction, the respective identifiers of the execution software transfer source ECU 1 and the execution software transfer destination ECU 1.
[0045]
Here, the identifier of the ECU 1 that is expected to be affected by the collision from the collision direction of the vehicle is stored as the transfer source, and it is expected that the influence of the collision does not reach as the transfer destination (arranged in the safe direction). The identifier of the ECU 1 is stored. Here, the address of the ECU 1 is stored as the identifier of the ECU 1.
[0046]
The electronic control unit 31 specifies the collision direction of the vehicle from the pre-crash sensor 32 specified in step S1. That is, if the specified pre-crash sensor 32 is the pre-crash sensor 32F, the collision direction is the front (front), if the pre-crash sensor 32B, the collision direction is the rear (back), and if the pre-crash sensor 32R. The collision direction is right (left side), and if the pre-crash sensor 32L, the collision direction is determined to be left (right side).
[0047]
Subsequently, the electronic control unit 31 refers to the table 34 and reads the transfer source and transfer destination identifiers (addresses) corresponding to the pre-crash sensor 32 identified in step S1 from the table 34 (step S4).
[0048]
Subsequently, the electronic control device 31 sends a transfer instruction of the execution software including the transfer destination identifier (address) to the in-vehicle network 32 via the communication control device 33 with the transfer source as the destination (step S5). Thereafter, the process returns to step S1.
[0049]
In this way, when the collision direction predicting means 3 determines that there is a possibility of a collision, the execution software 11 including the address of the transfer destination ECU 1 is sent to the ECU 1 corresponding to the transfer source corresponding to the collision direction. Send transfer instructions.
[0050]
FIG. 5 is a flowchart showing an example of a transfer process of the execution software 11 performed by each ECU 1 (CPU 21) corresponding to the transfer source. In FIG. 5, the ECU 1 is always in a state of receiving the transfer instruction from the collision direction predicting means 3 (step S01). When the transfer instruction is received (S01; YES), the process proceeds to step S02.
[0051]
When the process proceeds to step S02, the ECU 1 reads out the execution software 11 that it is executing from the memory 22 and uses the address of the transfer destination included in the transfer instruction as a destination to be mounted on the vehicle via the communication control device 23. Send to network 2.
[0052]
At this time, when there is data to be transmitted to the transfer destination together with the execution software 11 (for example, data relating to vehicle processing) (step S03; YES), the ECU 1 reads the data from the memory 22 and stores the data at the transfer destination. It transfers to ECU1 (step S04).
[0053]
In this way, when each ECU 1 receives the transfer instruction from the collision direction predicting means 3, the execution software 11 for processing related to the vehicle being executed by itself and, if necessary, execution software at the transfer destination. 11 is transferred to the transfer destination ECU 1 via the in-vehicle network.
[0054]
The transfer source ECU 1 may hold the address of the transfer destination ECU 1 in advance. In this case, the transfer instruction need not include the address of the transfer destination ECU 1. In this case, the transfer destination identification information can be omitted from the table 34.
[0055]
FIG. 6 is a flowchart illustrating an example of execution software reception processing performed by each ECU 1 (CPU 21) corresponding to the transfer destination. In FIG. 6, the ECU 1 is ready to receive the execution software 11 transferred from the other ECU 1 (step S11), and receives the execution software 11 and stores it in a predetermined storage area. At this time, when data is transferred together with the execution software 11 (step S12; YES), the data is also stored in a predetermined storage area (step S13).
[0056]
When the ECU 1 finishes receiving the execution software 11 and data, the ECU 1 installs the execution software 11 (step S14).
[0057]
Then, the transferred execution software 11 is executed (step S15). At this time, when the transfer destination ECU 1 is executing different execution software 11 (denoted as “existing execution software”), this execution software and the transferred execution software 11 (denoted as “transfer execution software”). Both are executed.
[0058]
The CPU 21 of the ECU 1 executes the existing execution software and the transfer execution software by switching in a predetermined cycle according to the operation clock of the CPU 21, for example. Here, since the dynamic reconfigurable device 12 can dynamically and rapidly switch the circuit configuration of the chip, the circuit configuration of the dynamic reconfigurable device 12 matches the predetermined clock cycle. Can be reconfigured.
[0059]
For this reason, when the existing execution software is executed, the process related to the vehicle in which the circuit configuration of the dynamic reconfiguration device 12 is executed by the execution of the existing execution software by the circuit configuration software included in the existing execution software. Is reconfigured to a circuit configuration corresponding to the above, and processing related to the vehicle based on the existing execution software is performed. Similarly, when the transfer execution software is executed, a process related to the vehicle in which the circuit configuration of the dynamic reconfiguration device 12 is executed by the execution of the transfer execution software by the circuit configuration software included in the transfer execution software. Is reconfigured in accordance with the circuit configuration, and processing related to the vehicle based on the transfer execution software is performed.
[0060]
In addition, when the execution subject of the process related to the vehicle shifts from the transfer source ECU 1 to the transfer destination ECU 1, a process system (state monitoring / control system, etc.) switching process related to the vehicle is performed.
[0061]
In this way, the transfer-destination ECU 1 executes the execution software 11 (transfer execution software) received from the transfer-source ECU 1 to continuously perform the process related to the vehicle that has been executed by the transfer-source ECU 1. . At this time, if the transfer destination ECU 1 has received (takes over) the process data relating to the vehicle from the transfer destination ECU 1, the transfer destination ECU 1 takes over and executes the process performed by the transfer source ECU 1. Can do.
[0062]
FIG. 7 is an operation explanatory diagram of the vehicle function guarantee system. As shown in FIG. 7, the ECU 1-1 is executing the execution software 1-1 and the ECU 1-n is executing the execution software 11-n in a state where the vehicle does not collide (in a steady state). In the state, when the collision direction predicting means 3 predicts the collision of the front surface of the vehicle, the execution software 11-1 executed by the ECU 1-1 is another installed in the rear part of the vehicle via the in-vehicle network 2. Transferred to ECU-n.
[0063]
The ECU 1-n then transfers both the transferred execution software 11-1 (transfer execution software) and the execution software 11-n being executed (existing software) to the circuit of the dynamic reconfiguration device 12-n. By executing while switching the configuration, the processing related to the vehicle that has been performed by the ECU 1-1 is taken over.
[0064]
As a result, as shown in FIG. 7, even if the ECU 1-1 is damaged due to a frontal collision of the vehicle, the processing (such as target state monitoring and / or control) related to the vehicle executed by the ECU 1-1 is performed by the ECU 1. Since the operation is continuously performed at -n, the function of the vehicle by the execution of the execution software 11-1 is secured.
[0065]
In FIG. 7, when the collision direction predicting means 3 predicts a collision on the rear surface of the vehicle, the execution software 11-n executed by the ECU 1-n, which is expected to be affected by the collision, is executed. The software is transferred to the ECU 1-n, and the execution software 11-n is continuously executed by the ECU 1-1. Thereby, even if ECU1-n is damaged by a collision, the function of the vehicle by execution of execution software 11-n can be secured.
[0066]
Although not shown in FIG. 7, when the ECU 1-2 is expected to be damaged as shown in FIG. 1 due to a collision on the right side of the vehicle, the execution software 11-2 executed by the ECU 1-2 is executed. Is transferred to the ECU1-3 and is subsequently executed. Similarly, when the ECU 1-3 is predicted to be damaged due to a collision of the left surface of the vehicle, the execution software 11-3 executed by the ECU 1-3 is transferred to the ECU 1-2 and is subsequently executed.
[0067]
In this way, the execution software 11 executed in each ECU 1 is transferred to another ECU 1 and subsequently executed. Therefore, even if the vehicle collides, the function of the vehicle by the execution of the execution software in each ECU 1 is improved. Can be secured.
[0068]
Furthermore, the above-described embodiment has the following advantages.
[0069]
In other words, according to the embodiment, when there is a possibility of a collision, the process related to the vehicle executed by the ECU 1 that is expected to be affected by the collision is expected to be affected by the collision. ECU1 can take over.
[0070]
For this reason, it is not necessary to arrange a plurality of ECUs in a place having the least influence of the collision. Thereby, the reduction | decrease of indoor space can also be suppressed. However, it is preferable that the electronic control device 31 of the collision direction predicting means 3 is disposed at a place where the influence of the collision is the least.
[0071]
Further, it is not necessary to make the ECU itself firmly or add a configuration for protecting the ECU. For this reason, an increase in cost due to an increase in vehicle weight or an increase in the number of parts can be avoided.
[0072]
Furthermore, it is not necessary to adopt a redundant configuration with a spare ECU. As a result, an increase in cost due to the redundant configuration can be suppressed.
[0073]
The embodiment described above can be modified as follows.
[0074]
That is, in the embodiment, the collision direction predicting means 3 gives a transfer instruction to the transfer source ECU 1, and the transfer source ECU 1 transfers the execution software 11 to the transfer destination ECU 1. Instead of this configuration, the collision direction predicting means 3 gives an instruction to download the execution software including the address of the transfer source ECU 1 to the transfer destination ECU 1, and the transfer destination ECU 1 downloads the execution software from the transfer source ECU 1 (execution) The transfer request of the software 11 may be transmitted to the transfer source and the transferred execution software 11 (transfer response) may be received).
[0075]
In the embodiment, the ECU 1 that is expected to be affected by the collision of the vehicle and the ECU 1 that is expected not to be affected are specified. Instead of this configuration, the ECU 1 that is expected to be affected by the collision of the vehicle may be specified, and any other ECU other than this may be specified as the transfer destination.
[0076]
Further, in the embodiment, when a collision in a certain direction is predicted, the transfer source and the transfer destination ECU 1 corresponding to the direction are specified. Instead of this configuration, when the transfer source ECU 1 is specified from the collision direction, it is determined whether or not there is a possibility of a collision in another direction, and one or more ECUs 1 corresponding to the direction in which it is determined that there is no possibility of a collision ( The transfer destination ECU 1 may be arbitrarily selected from one or more ECUs 1) that are not expected to be affected by the collision.
[0077]
In addition to the method described in the embodiment, various existing well-known techniques can be applied to determine the possibility of collision and specify the collision direction.
[0078]
In the embodiment, execution software including configuration software (circuit configuration switching software) of the dynamic reconfiguration device 12 is a transfer target. Instead of this configuration, the execution software 11 is separated into the configuration software of the dynamic reconfiguration device 12 and the remaining software, and the remaining software is stored in advance in the transfer destination ECU 1 and only the configuration software is transferred. You may comprise so that it may become object. However, in order to effectively use the storage area of the transfer destination ECU 1, it is preferable that the execution software including the configuration software is transferred as in the execution mode.
[0079]
In the embodiment, each ECU is configured to be able to communicate with other ECUs. However, the in-vehicle network 2 allows the collision direction prediction unit 3 to communicate with each ECU 1 and What is necessary is just to be comprised so that communication is possible between ECU1 of a transfer destination.
[0080]
【The invention's effect】
ADVANTAGE OF THE INVENTION According to this invention, the technique which can ensure the operation | movement of the vehicle-mounted computer at the time of a vehicle collision using a dynamic reconfiguration | reconfiguration device can be provided.
[Brief description of the drawings]
FIG. 1 is a diagram showing a configuration example of a vehicle function guarantee system according to an embodiment of the present invention.
FIG. 2 is a block diagram illustrating a configuration example of each ECU.
FIG. 3 is a block diagram illustrating a configuration example of a collision direction predicting unit.
FIG. 4 is a flowchart showing a collision prediction / transfer control process by a collision direction predicting unit;
FIG. 5 is a flowchart showing transfer processing by each ECU.
FIG. 6 is a flowchart showing execution software reception processing by each ECU;
FIG. 7 is an operation explanatory diagram of the vehicle function guarantee system.
[Explanation of symbols]
1 ECU (in-vehicle computer)
2 In-vehicle network
3 Collision direction prediction means
11 execution software
12 Dynamic reconfiguration devices
21 CPU
22 memory
23,33 Communication control device
31 Electronic control device (computer, collision prediction means, transfer control means)
32 Pre-crash sensor
34 tables

Claims (15)

A plurality of in-vehicle computers each including a dynamic reconfigurable device capable of dynamically and rapidly switching the internal circuit configuration of the chip by software, and each performing processing related to the vehicle using the dynamic reconfigurable device;
An in-vehicle network connecting the in-vehicle computers;
A collision prediction means for predicting a vehicle collision;
When a collision is predicted by the collision prediction means, it corresponds to a process related to a vehicle that is executed by the certain in-vehicle computer from the certain in-vehicle computer that is expected to be affected by the collision. Transfer control means for performing control for transferring the software for configuring the dynamic reconfiguration device via the in-vehicle network;
Including vehicle function guarantee system. The certain in-vehicle computer transfers execution software for performing the process related to the vehicle including the software for configuring the dynamic reconfiguration device corresponding to the process related to the vehicle performed by itself to the other in-vehicle computer. ,
2. The vehicle function guarantee system according to claim 1, wherein the other in-vehicle computer takes over the processing related to the vehicle that has been performed by the certain in-vehicle computer by executing the transferred execution software. The transfer control unit identifies an in-vehicle computer that is expected to be affected by a collision from a direction in which there is a possibility of a vehicle collision, and the dynamic re-transmission to another in-vehicle computer is performed on the identified in-vehicle computer. The vehicle function guarantee system according to claim 1 or 2, which gives a transfer instruction of configuration software for a configuration device. The transfer control unit specifies an in-vehicle computer that is expected to be affected by a collision from a direction in which there is a possibility of a vehicle collision, and the specified in-vehicle computer for the in-vehicle computer other than the specified in-vehicle computer. The vehicle function ensuring system according to claim 1 or 2, wherein an instruction to download the software for configuring the dynamic reconfigurable device is provided from the vehicle. A plurality of in-vehicle computers each including a dynamic reconfigurable device capable of dynamically and rapidly switching the internal circuit configuration of the chip by software, and performing processing related to the vehicle using the dynamic reconfigurable device; An in-vehicle network connecting between in-vehicle computers, and a method for securing the function of a vehicle equipped with a system,
Computer
Predict vehicle collision as a collision prediction means,
When a vehicle collision is predicted, as a transfer control means, processing related to the vehicle executed by the certain in-vehicle computer from the certain in-vehicle computer expected to be affected by the collision to another in-vehicle computer Performing transfer control for transferring the configuration software of the dynamically reconfigurable device corresponding to the in-vehicle network,
A vehicle function guarantee method. The certain in-vehicle computer has execution software for performing processing related to the vehicle including configuration software of a dynamic reconfiguration device corresponding to processing related to the vehicle being performed by the transfer control. Transfer to in-vehicle computer,
The vehicle function guarantee method according to claim 5, wherein the other in-vehicle computer takes over the processing related to the vehicle that has been performed by the certain in-vehicle computer by executing the transferred execution software. The computer specifies, as the transfer control means, an in-vehicle computer that is expected to be affected by a collision from a direction in which there is a possibility of a vehicle collision, and sends the specified in-vehicle computer to another in-vehicle computer. The vehicle function guarantee method according to claim 5 or 6, wherein an instruction to transfer configuration software of the dynamic reconfiguration device is given. The computer specifies, as the transfer control means, an in-vehicle computer that is expected to be affected by a collision from a direction in which there is a possibility of a vehicle collision, and this identification is performed for an in-vehicle computer other than the specified in-vehicle computer. The vehicle function guarantee method according to claim 5 or 6, wherein an instruction to download the software for configuring the dynamic reconfigurable device is given from the in-vehicle computer. A plurality of in-vehicle computers each including a dynamic reconfigurable device capable of dynamically and rapidly switching the internal circuit configuration of the chip by software, and performing processing related to the vehicle using the dynamic reconfigurable device; A program for ensuring the functions of a vehicle equipped with a system including an in-vehicle network connecting in-vehicle computers,
Computer
Predicting a vehicle collision;
When a collision of a vehicle is predicted, a dynamic corresponding to a process related to the vehicle being executed by the certain in-vehicle computer from the certain in-vehicle computer that is expected to be affected by the collision. Performing transfer control for transferring reconfigurable device configuration software via the in-vehicle network; and
A program for running. The certain in-vehicle computer has execution software for performing processing related to the vehicle including configuration software of a dynamic reconfiguration device corresponding to processing related to the vehicle being performed by the transfer control. Transfer to in-vehicle computer,
The program according to claim 9, wherein the other vehicle-mounted computer takes over the processing related to the vehicle that has been performed by the certain vehicle-mounted computer by executing the transferred execution software. In the step of performing the transfer control, an in-vehicle computer that is expected to be affected by a collision from a direction in which there is a possibility of a vehicle collision is identified, and the movement of the identified in-vehicle computer to another in-vehicle computer is determined. The program according to claim 9 or 10, which gives an instruction to transfer the software for configuring the static reconfiguration device. In the step of performing the transfer control, an in-vehicle computer that is expected to be affected by a collision from a direction in which there is a possibility of collision of the vehicle is specified, and the specified in-vehicle computer other than the specified in-vehicle computer is specified. The program according to claim 9 or 10, wherein an instruction to download the software for configuring the dynamic reconfigurable device from an in-vehicle computer is given. A plurality of in-vehicle computers each including a dynamic reconfigurable device capable of dynamically and rapidly switching the internal circuit configuration of the chip by software, and performing processing related to the vehicle using the dynamic reconfigurable device; An in-vehicle network connecting between in-vehicle computers, and a device that secures the function of a vehicle equipped with a system including:
A collision prediction means for predicting a vehicle collision;
When a collision is predicted by the collision prediction means, it corresponds to a process related to a vehicle that is executed by the certain in-vehicle computer from the certain in-vehicle computer that is expected to be affected by the collision. Transfer control means for performing control for transferring the software for configuring the dynamic reconfiguration device via the in-vehicle network;
A vehicle function guarantee device. A plurality of in-vehicle computers each including a dynamic reconfigurable device capable of dynamically and rapidly switching the internal circuit configuration of the chip by software, and each performing processing related to the vehicle using the dynamic reconfigurable device;
An in-vehicle network connecting the in-vehicle computers;
A collision prediction means for predicting a vehicle collision;
When a collision is predicted by the collision prediction means, it corresponds to a process related to a vehicle that is executed by the certain in-vehicle computer from the certain in-vehicle computer that is expected to be affected by the collision. Transfer control means for performing control for transferring the software for configuring the dynamic reconfiguration device via the in-vehicle network;
Vehicle equipped with a vehicle function guarantee system. An in-vehicle computer mounted on a vehicle and connected to another in-vehicle computer via an in-vehicle network,
A dynamic reconfiguration device capable of dynamically and rapidly switching the internal circuit configuration of the chip by software;
Control means for performing processing related to the vehicle using the dynamic reconfiguration device;
When a vehicle collision is expected to reach the other in-vehicle computer, the vehicle is transferred from the other in-vehicle computer via the in-vehicle network to the vehicle running on the other in-vehicle computer. Receiving means for receiving execution software for performing such processing,
When the execution software is received by the receiving means, the control means performs a process related to a vehicle different from a process related to the vehicle performed by the other in-vehicle computer by executing another execution software. An in-vehicle computer that performs processing related to a vehicle by executing execution software received together with processing related to another vehicle when the dynamic reconfiguration device is used.

Images