JP5601127B2 - Control device - Google Patents

Description

  The present invention relates to a control device including a multi-core CPU.

  A multi-core CPU in which a plurality of cores are integrated in one package is known. According to this multi-core CPU, high processing capability can be obtained with a low operation clock, and power consumption and heat loss can be reduced.

  By the way, the multi-core CPU is generally designed based on the idea that when an abnormality occurs, the entire multi-core CPU is reset to recover from the abnormal state. For this reason, for example, when a multi-core CPU is used for control of a vehicle powertrain system and engine control is performed on one core and transmission control is performed on the other core, an abnormality occurs only in one of the cores. Even in this case, the entire multi-core CPU is reset. When the core abnormality is recovered by this reset, the system operation is resumed. However, when the abnormality is not recovered, the entire multi-core CPU is reset repeatedly, and the system becomes inoperable. End up.

  In view of such a problem, in the invention described in Patent Document 1, in a multi-core CPU including a master side core and a slave side core, the monitoring IC monitors the operation of the master side core, and the master side core uses the slave side core. Monitor activity. When the master-side core abnormality is detected by the monitoring IC, the entire multi-core CPU is reset. When the master-side core detects the slave-side core abnormality, the master-side core is used as fail-safe processing. Describes that the processing performed in the slave-side core is simplified.

JP 2009-27469 A

  According to the invention described in Patent Document 1, when an abnormality occurs only in the slave-side core, the system can be degenerated and the system can be prevented from being completely stopped. However, when an abnormality occurs only in the master-side core, the entire multi-core CPU is reset, and when the master-side core does not recover from the abnormality due to the reset, the entire multi-core CPU is reset repeatedly. For this reason, although the slave core does not have an abnormality, the entire system becomes inoperable.

  The present invention has been made in view of the above-described problems, and functions realized by these cores even when an abnormality occurs in one of these cores with respect to at least two cores in a multi-core CPU. An object of the present invention is to provide a control device that can continue to operate.

The invention according to claim 1 made in view of the above problem is a control device including a multi-core CPU having at least a first core and a second core for executing a pre-assigned process. The first core monitoring means for detecting an abnormality of the first core and the second core monitoring means for detecting an abnormality of the second core in the first core are provided. Then, when the first core detects an abnormality of the second core via the second core monitoring means, the first core executes a first proxy process that acts as a proxy for the process executed by the second core. When an abnormality of the first core is detected via the core monitoring means, a second proxy process is performed to proxy the process executed by the first core.
The first core periodically executes a first abnormality monitoring process, which is a process for notifying the first core monitoring means that the first core is operating normally, The core periodically executes a second abnormality monitoring process that is a process for notifying the second core monitoring means that the second core is operating normally. Further, the first core monitoring means indicates that an abnormality has occurred in the first core with respect to the second core when the first abnormality monitoring process executed by the first core is not executed for a predetermined period. This is realized by a monitoring circuit for notification. On the other hand, the second core monitoring means is a process executed by the first core, and monitors whether or not the second abnormality monitoring process executed by the second core is executed, and the second abnormality When the monitoring process is not executed for a predetermined period, the process is realized by assuming that an abnormality has occurred in the second core.
Furthermore, the multi-core CPU is configured as a microcontroller including a monitoring circuit, and the first core is a third abnormality that is a process for notifying the second core that the first core is operating normally. Execute the monitoring process periodically. In addition, the second core monitors whether or not the third abnormality monitoring process executed by the first core is executed, and when the third abnormality monitoring process is not executed over a predetermined period. The first core is detected by the monitoring process, the first core abnormality is detected by the monitoring process, and the first core abnormality is not detected via the first core monitoring means. In the case, the multi-core CPU is reset.

By doing so, even if an abnormality occurs in one of the first core or the second core, the processing of the core in which an abnormality has occurred is executed by the other core, so the first core and the second core The realized function can be operated continuously.
Moreover, the abnormality of the second core can be detected by the monitoring circuit, and the processing load of the first core can be suppressed.
In addition, it is assumed that an abnormality occurs in the monitoring circuit. However, when an abnormality occurs in the monitoring circuit, the monitoring circuit can be recovered from the abnormality.

  However, when an abnormality occurs in one core, if the process executed in the core in which an abnormality has occurred in the other core is executed as it is, the processing load on the other core becomes too large.

  Therefore, in the control device according to claim 2, the first core executes the process executed by the second core as the first proxy process in a method with a lower load than that executed by the second core. The second core executes a process executed by the first core as a second proxy process in a method that has a lower load than that executed by the first core.

By doing so, it is possible to suppress the processing load when executing the processing performed in the core where the abnormality has occurred .

FIG. 2 is a block diagram illustrating a configuration of a control device according to the first embodiment, and a block diagram illustrating a configuration of a multi-core CPU. It is a sequence diagram about the operation | movement at the time of abnormality detection of a 2nd core. It is a sequence diagram about the operation | movement at the time of abnormality detection of a 1st core. It is a block diagram which shows the structure of the control apparatus of 2nd embodiment. It is a sequence diagram about the operation | movement at the time of abnormality detection of a watchdog timer.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. The embodiments of the present invention are not limited to the following embodiments, and various forms can be adopted as long as they belong to the technical scope of the present invention.

[First embodiment]
[Description of configuration]
First, the structure of the control apparatus 1 of 1st embodiment is demonstrated. As illustrated in FIG. 1A, the control device 1 includes a first core 11 and a second core 12, and a watchdog timer (also referred to as WDT) 13 that monitors the operation of the first core 11. It has a multi-core CPU 10 that is a microcontroller. In addition to the first core 11, the second core 12, and the WDT 13, the multi-core CPU 10 includes an I / O unit 14 that controls various I / O ports, a RAM 15, a ROM 16, and the like. Are connected by an internal bus 17 (see FIG. 1B).

  The first core 11 and the second core 12 are operated by a program stored in the ROM 16, and each core is configured to execute a process assigned in advance in order to realize the function of the control device 1. . Specifically, for example, if the control device 1 is used for control of a powertrain system of a vehicle, the first core 11 performs processing for controlling the engine and the second core 12 performs transmission. You may perform the process for controlling. In addition to this, for example, the first core 11 performs overall control of the entire control device 1, and the second core 12 performs specific processing such as image processing in response to an instruction from the first core 11. May be.

  The operation of the first core 11 is monitored by the WDT 13, and the operation of the second core 12 is monitored by the first core 11. Specifically, the WDT 13 counts up a timer included in itself in a cycle of, for example, about several μs to several ms, and clears the timer according to an instruction from the first core 11. Then, when the timer reaches a predetermined value without an instruction from the first core 11 (that is, when a predetermined time elapses from the previous instruction), it is considered that an abnormality has occurred in the first core 11 and the second core 12 is notified. On the other hand, the first core 11 counts up the second core monitoring timer 11a provided in an area accessible from the first core 11 and the second core 12 in the RAM 15 in a cycle of, for example, several μs to several ms. The second core 12 clears the second core monitoring timer 11a at regular timing. When the second core monitoring timer 11a reaches a predetermined value (that is, when the second core monitoring timer 11a is not cleared by the second core 12 for a predetermined time), an abnormality has occurred in the second core 12. It is considered. Note that the predetermined time at which an abnormality has occurred in the first core 11 or the second core 12 is a time that is appropriately determined according to the program structure of the control device 1, for example, a time of about several tens of ms. It is possible to do.

  Although details will be described later, when the first core 11 detects an abnormality in the second core 12, the first core 11 performs the processing executed by the second core 12 on behalf of the second core 12. When an abnormality of the first core 11 is detected, the process executed by the first core 11 is performed on behalf of the subsequent processes. Thereby, even if one of the first core 11 or the second core 12 fails, the function realized by the control device 1 can be continuously operated.

[Description of operation]
Next, the operation at the time of abnormality detection of the second core 12 and the operation at the time of abnormality detection of the first core 11 in the control device 1 of the first embodiment will be described.
(1) About operation | movement at the time of abnormality detection of the 2nd core 12 First, operation | movement at the time of abnormality detection of the 2nd core 12 is demonstrated using the sequence diagram described in FIG. The process represented by the sequence diagram is a process started when the control device 1 is powered on.

  As described above, the first core 11 counts up the second core monitoring timer 11a in the above-described cycle (S210, S230, S245, S265), and the WDT 13 also counts its own timer in the above-described cycle. Up (S220, S240, S260, S280).

  In addition, the first core 11 instructs the WDT 13 to clear the timer by inverting the value of the signal output to the WDT 13 at regular timing (S215, S235, S255, S275), and the second The core 12 also clears the second core monitoring timer 11a at regular timing (S205, S225).

  If an abnormality occurs in the second core 12 (S250), the second core monitoring timer 11a is not cleared by the second core 12 thereafter. On the other hand, counting of the second core monitoring timer 11a by the first core 11 and clearing of the timer of the WDT 13 are continuously performed, and counting of the timer by the WDT 13 is continuously performed.

  When the second core monitoring timer 11a expires, the first core 11 detects an abnormality of the second core 12 (S270). Thereafter, the first core 11 performs the processing to be performed by the second core 12 on behalf of the second core 12 (S285).

  Specifically, for example, the first core 11 may execute the process executed by the second core 12 by a method with a lower load than that executed by the second core 12. In other words, the first core 11 may execute the process performed by the second core 12 on behalf of the process performed by the second core 12 by performing the process performed by the second core 12 using a fixed value (fail-safe value). good. Further, the processing performed by the second core 12 may be executed on behalf by performing the calculation performed by the second core 12 by a simpler method.

Further, for example, the control device 1 is used for controlling the powertrain system of the vehicle, and performs processing for controlling the engine with the first core 11 and processing for controlling the transmission with the second core 12. Suppose you do. In such a case, the first core 11 may execute the process for controlling the transmission in a low-load manner in place of the second core 12. At this time, the first core 11 may perform a process for controlling the transmission with the transmission gear stage as a fixed value, or calculate the gear stage by a simple method based on the vehicle speed and the engine speed. You may perform this process.
(2) About operation | movement at the time of abnormality detection of the 1st core 11 Next, operation | movement at the time of abnormality detection of the 1st core 11 is demonstrated using the sequence diagram described in FIG. The process represented by the sequence diagram is a process started when the control device 1 is powered on.

  As described above, the first core 11 counts up the second core monitoring timer 11a in the above-described cycle (S310, S330), and the WDT 13 also counts up a timer included in itself in the above-described cycle (S320). , S340).

  The first core 11 instructs the WDT 13 to clear the timer by inverting the value of the signal output to the WDT 13 at regular timing (S315, S335), and the second core 12 also The second core monitoring timer 11a is cleared at regular timing (S305, S325, S350).

  If an abnormality occurs in the first core 11 (S345), the WDT 13 timer is not cleared by the first core 11 thereafter. On the other hand, clearing of the second core monitoring timer 11a by the second core 12 and counting of the timer by the WDT 13 are continuously performed.

When the timer of the WDT 13 expires (S355), a watchdog timer interrupt is generated in the second core 12 by a signal from the WDT 13 (S360). Thereby, abnormality of the 1st core 11 is detected in the 2nd core 12, and after that, the 2nd core 12 performs on behalf of the process which should be performed in the 1st core 11 ( S365 ).

  Note that the second core 12 may execute, for example, the process executed by the first core 11 by a method with a lower load than that executed by the first core 11. That is, the second core 12 may execute the process performed by the first core 11 on behalf of the process performed by the first core 11 by using a fixed value (fail-safe value). good. Moreover, you may perform the process performed in the 1st core 11 on behalf by performing the calculation performed by the 1st core 11 by a simpler method.

  After that, the WDT 13 resumes the timer count-up to monitor the operation of the second core 12 (S370), and the second core 12 sends the WDT 13 to the WDT 13 at regular timing in the same manner as the first core 11. The timer is instructed to be cleared (S375). Then, the WDT 13 resets the entire multi-core CPU 10 when the timer expires.

[effect]
According to the control device 1 of the first embodiment, when an abnormality occurs in one of the first core 11 or the second core 12, the processing of the core in which an abnormality has occurred in the other core is performed by the core. It is executed in such a way that the load is lower than the execution. For this reason, even if abnormality occurs in one of the first core 11 or the second core 12, the function realized by the control device 1 can be continuously operated in a partially reduced state. .

[Second Embodiment]
[Description of configuration]
Next, the structure of the control apparatus 100 of 2nd embodiment is demonstrated. As illustrated in FIG. 4, the control device 100 includes a first core 111 and a WDT 113 similar to those in the first embodiment, an I / O unit, a RAM, a ROM, and the like (not shown), and a first core. A multi-core CPU 110 that is a microcontroller having a second core 112 that counts up a first core monitoring timer 112a for monitoring the operation of the controller 111 is provided.

  In the control device 100 of the second embodiment, the operation of the first core 111 by the WDT 113 and the operation of the second core 112 by the first core 111 are performed as in the first embodiment. In addition, the operation of the first core 111 by the second core 112 is monitored.

  Specifically, the second core 112 counts the first core monitoring timer 112a provided in an area accessible from the first core 111 and the second core 112 in the RAM, for example, in a cycle of about several μs to several ms. The first core 111 clears the first core monitoring timer 112a at a regular timing. When the first core monitoring timer 112a reaches a predetermined value (that is, when the first core 111 does not clear the first core monitoring timer 112a for a predetermined time), an abnormality has occurred in the first core 111. It is considered. Note that the predetermined time is a time that is appropriately determined according to the structure of the program of the control device 100, and is considered to be a time of about several tens of milliseconds, for example.

  Similarly to the first embodiment, when the first core 111 detects an abnormality in the second core 112, the first core 111 performs the processing executed by the second core 112 on behalf of the second core 112. When an abnormality of the first core 111 is detected by the WDT 113, the processing executed by the first core 111 is performed on behalf.

  Although details will be described later, if an abnormality of the first core 111 is detected by the first core monitoring timer 112a and an abnormality of the first core 111 is not detected by the WDT 113, the second core 112 Then, the entire multi-core CPU 110 is reset. As a result, when an abnormality occurs in the WDT 113, the WDT 113 can be recovered from the abnormality.

[Description of operation]
Next, operation | movement of the control apparatus 100 of 2nd embodiment is demonstrated. When the abnormality of the second core 112 is detected by the first core 111 or when the abnormality of the first core 111 is detected by the WDT 113, the control device 100 is the same as the control device 1 of the first embodiment. The other core executes the processing performed by the core in which the abnormality has occurred. In addition, when the abnormality of the first core 111 is detected by the second core 112 and the abnormality of the first core 111 is not detected by the WDT 113, the entire multi-core CPU 110 is reset. Here, the operation at this time will be described with reference to the sequence diagram shown in FIG. The process represented by the sequence diagram is a process started when the control device 100 is turned on.

  As described above, the first core 111 counts up the second core monitoring timer 111a in the above-described cycle (S415), and the second core 112 counts up the first core monitoring timer 112a in the above-described cycle ( S425, S445, S455). In addition, the WDT 113 also counts up its own timer in a predetermined cycle.

  The first core 111 instructs the WDT 113 to clear the timer at regular timing (S430), and clears the first core monitoring timer 112a at regular timing (S420). The second core 112 also clears the second core monitoring timer 111a at regular timing (S405, S440, S450).

  Here, when an abnormality occurs in the WDT 113 (S410), the timer is not counted up by the WDT 113 thereafter. Further, after that, when an abnormality occurs in the first core 111, the first core monitoring timer 112a is not cleared by the first core 111 thereafter (S435).

When the first core monitoring timer 112a expires, the second core 112 detects an abnormality of the first core 111 (S460).
When the second core 112 detects an abnormality of the first core 111 by the first core monitoring timer 112a, the second core 112 starts counting the WDT interrupt wait timer and waits for a signal to generate a watchdog timer interrupt from the WDT 113. (S465).

When the WDT interrupt wait timer expires, it is considered that an abnormality has occurred in the WDT 113 (S470), and the entire multi-core CPU 110 is reset (S475).
When a watchdog timer interrupt is generated by a signal from the WDT 113 before the expiration of the WDT interrupt waiting timer, the second core 112 performs processing performed by the first core 111 in the same manner as in the first embodiment. Execute on behalf of

[effect]
According to the control device 100 of the second embodiment, similar to the first embodiment, even if an abnormality occurs in one of the first core 111 or the second core 112, the function realized by the control device 100. Can be operated continuously in a partially reduced state.

Further, when an abnormality occurs in the WDT 113, the entire multi-core CPU 110 is reset, so that the WDT 113 can be recovered from the abnormality.
[Other Embodiments]
(1) Although the multi-core CPU of the first and second embodiments has two cores, the present invention is not limited to this, and may have three or more cores. Even in such a case, the first core and the second core monitor the operation of each other, and when an abnormality occurs in one core, the processing of the core in which the abnormality occurs in the other core Even if an abnormality occurs in the first core or the second core, the functions realized by these cores can be continuously operated in a partially reduced state.
(2) Further, in the control device of the first and second embodiments, when an abnormality occurs in one of the first core and the second core, the processing of the core in which the abnormality occurs in the other core is performed on behalf of However, instead of this, a process of safely stopping the controlled object of the core in which an abnormality has occurred may be performed. By doing so, it is possible to prevent the controlled object of the core from continuing to operate when an abnormality occurs in one of the cores.
(3) Moreover, in the control apparatus of 1st, 2nd embodiment, if abnormality of one core is detected, the substitution of the process of the core which abnormality occurred in the other core will be started immediately. However, resetting the core (or the entire multi-core CPU) in which an abnormality has occurred may cause the core to recover from the abnormality. When an abnormality occurs in one core, the core (or the entire multi-core CPU) is reset. Alternatively, after the number of occurrences of abnormality in the core reaches a predetermined number, the other core may start processing for the core in which the abnormality has occurred. By doing so, it is possible to restore the core in which an abnormality has occurred to a normal state.
(4) In the control devices of the first and second embodiments, the operation of the first core is monitored by the WDT, and the operation of the second core is monitored by the second core monitoring timer provided in the first core. However, the present invention is not limited to this, and the operation of the first core may be monitored by a monitoring timer provided in the second core, instead of WDT. Further, for example, two WDTs may be provided in the multi-core CPU, and the first core and the second core may be monitored by these WDTs. Even in such a case, the same effect can be obtained.

[Correspondence with Claims]
The correspondence between the terms used in the description of the above embodiment and the terms used in the description of the claims is shown.

WDT corresponds to the first core monitoring means and monitoring circuit, and the first core corresponds to the second core monitoring means.
Further, S285 in the operation at the time of detecting the abnormality of the second core corresponds to the first proxy process, and S365 in the operation at the time of detecting the abnormality of the first core corresponds to the second proxy process.

  Also, the instruction to clear the WDT timer corresponds to the first abnormality monitoring process, the clearing of the second core monitoring timer corresponds to the second abnormality monitoring process, and the clearing of the first core monitoring timer corresponds to the third abnormality monitoring process. To do.

  Further, processing such as counting of the first core monitoring timer (S425, S445, S455, and S460 in the operation when detecting an abnormality of the watchdog timer) corresponds to the monitoring processing.

DESCRIPTION OF SYMBOLS 1 ... Control apparatus, 10 ... Multi-core CPU, 11 ... 1st core, 11a ... 2nd core monitoring timer, 12 ... 2nd core, 13 ... WDT, 14 ... I / O part, 15 ... RAM, 16 ... ROM, 17 ... Internal bus, 100 ... Control device, 110 ... Multi-core CPU, 111 ... First core, 111a ... Second core monitoring timer, 112 ... Second core, 112a ... First core monitoring timer, 113 ... WDT.

Claims (2)

A control device comprising a multi-core CPU having at least a first core and a second core for executing a pre-assigned process,
First core monitoring means for causing the second core to detect an abnormality of the first core;
Second core monitoring means for causing the first core to detect abnormality of the second core;
With
When the first core detects an abnormality of the second core via the second core monitoring unit, the first core executes a first proxy process that performs the process executed by the second core;
When the second core detects an abnormality of the first core via the first core monitoring unit, the second core executes a second proxy process that performs the process executed by the first core;
Features
The first core periodically executes a first abnormality monitoring process that is a process for notifying the first core monitoring unit that the first core is operating normally.
The second core periodically executes a second abnormality monitoring process that is a process for notifying the second core monitoring unit that the second core is operating normally,
The first core monitoring means generates an abnormality in the first core relative to the second core when the first abnormality monitoring process executed by the first core is not executed over a predetermined period. Realized by a monitoring circuit that notifies
The second core monitoring means is a process executed by the first core, and monitors whether or not the second abnormality monitoring process executed by the second core is executed. When the second abnormality monitoring process is not executed over a predetermined period, it is realized by a process that assumes that an abnormality has occurred in the second core,
Features
The multi-core CPU is configured as a microcontroller including the monitoring circuit,
The first core periodically executes a third abnormality monitoring process that is a process for notifying the second core that the first core is operating normally;
The second core is
Monitoring whether or not the third abnormality monitoring process executed by the first core is executed, and when the third abnormality monitoring process is not executed over a predetermined period, Execute the monitoring process that assumes that an abnormality has occurred,
Detecting the abnormality of the first core by the monitoring process, and resetting the multi-core CPU when the abnormality of the first core is not detected via the first core monitoring means;
A control device characterized by. The control device according to claim 1,
The first core executes the process executed by the second core as the first agent process in a method having a lower load than that of the second core,
The second core executes, as the second agent process, a process executed by the first core in a method having a lower load than that of the first core,
A control device characterized by.

Images