JP5978873B2 - Electronic control unit - Google Patents

Description

  The present invention relates to an electronic control unit that switches execution modes of a plurality of processor cores alternately between a lock step mode and a non-lock step mode.

  If the electronic control unit has a plurality of processor cores, the plurality of processor cores can execute the same program and compare execution results to determine whether the plurality of processor cores are normally executing the same program. It is known to employ a lock step mode for determination (see, for example, Patent Document 1).

  For example, in the automobile field, there is a high demand for ensuring the safety of vehicle control. Therefore, the operation of an electronic control device that performs vehicle control is monitored, and when a failure of the electronic control device is detected, fail-safe processing is executed immediately. Is required. For this reason, the lockstep mode is adopted for an electronic control device having a plurality of processor cores.

  When executing a program that requires less safety than the lock step mode, it is possible to switch the execution mode to the non-lock step mode in which each processor core executes a different program and execute a different program in each processor core. It is done.

JP 2006-302289 A

  In addition to determining whether or not a plurality of processor cores are normally executing the same program, it is also important to execute a memory check that detects an abnormality in a memory such as a ROM and a RAM. Conventionally, the memory check has been executed when the processing load is low so as not to disturb normal processing, for example.

  However, in the method of executing the memory check when the processing load is low, if the processing load remains high, the execution opportunity of the memory check decreases, and the memory check may not be completed within a predetermined time.

  The present invention has been made to solve the above-described problems, and provides an electronic control device that determines whether or not a plurality of processor cores are normally executing the same program, and ensures an opportunity to execute a memory check. The purpose is to do.

  According to the electronic control device of the present invention, since the memory check is executed not in the lock step mode but in the non-lock step mode, the processing load in the lock step mode can be reduced.

  Further, since the lock step mode and the non-lock step mode are alternately switched and executed, the memory check is executed in the non-lock step mode regardless of the processing load. As a result, an opportunity to execute a memory check can be secured.

  The functions of the plurality of means provided in the present invention are realized by hardware resources whose functions are specified by the configuration itself, hardware resources whose functions are specified by a program, or a combination thereof. The functions of the plurality of means are not limited to those realized by hardware resources that are physically independent of each other.

The block diagram which shows the electronic control apparatus by 1st Embodiment of this invention. The data structure figure of memory. The figure which shows transition of the execution mode by a dual core. The flowchart which shows the process at the time of lock step mode. The flowchart which shows the process at the time of non-locking step mode. The block diagram which shows the electronic control apparatus by 2nd Embodiment of this invention.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
[First Embodiment]
A microcomputer (hereinafter also referred to as “microcomputer”) 2 illustrated in FIG. 1 is an electronic control device that is mounted on, for example, a vehicle and executes engine control. The microcomputer 2 is a dual-core microcomputer including two processor cores (hereinafter also simply referred to as “cores”) 10 and 12. The microcomputer 2 includes cores 10 and 12, a RAM 20, a ROM 22, a switching device 30 and a comparison circuit 40.

  The cores 10 and 12 execute engine control based on a control program stored in the ROM 22. In addition, the core 12 performs a memory check on the RAM 20 and the ROM 22 based on a check program stored in the ROM 22.

  The switching device 30 instructs the cores 10 and 12 to switch the execution mode by a switching notification from the cores 10 and 12 in the lock step mode and by a switching notification from the core 10 in the non-lock step mode. . The lock step mode and the non-lock step mode will be described later.

  The comparison circuit 40 includes a RAM output comparison unit 42, a RAM input comparison unit 44, and a ROM input comparison unit 46. In the lock step mode, the RAM output comparison unit 42 compares the data that the cores 10 and 12 write to the RAM 20, the RAM input comparison unit 44 compares the data that the cores 10 and 12 read from the RAM 20, and the ROM input comparison unit. 46 compares data read from the ROM 22 by the cores 10 and 12. The comparison circuit 40 outputs a comparison result of each data.

  The comparison result signal output from the comparison circuit 40 is validated in the lock step mode and invalid in the non-lock step mode by the control signal from the core 10. When the comparison result signal of the comparison circuit 40 is validated and turned on, it becomes an interrupt signal for the cores 10 and 12.

(data structure)
In this embodiment, the data structures of the RAM 20 and ROM 22 are set as shown in FIG. The data in the RAM 20 and ROM 22 is used in the safety function data used in the lock step mode with high safety requirement, the mirror data of the safety function data, and the non-lock step mode in which the safety requirement is lower than the lock step mode. The storage area is divided into non-safety function data to be stored. The boundary address of the storage area shown in FIG. 2 is shown as an example, and is appropriately set in the RAM 20 and the ROM 22.

  The mirror data is data obtained by inverting the bits of the safety function data. When the safety function data is written in the RAM 20, the bit of the data to be written is inverted and the data is written in the mirror data area.

  Note that non-safety function data has a lower safety requirement than safety function data, and does not mean that safety is not required. Similarly, the non-safety function program executed in the non-lock step mode has a lower safety requirement than the safety function program executed in the lock step mode, and does not mean that safety is not required.

(Execution mode)
The execution mode of the cores 10 and 12 is switched to the lock step mode or the non-lock step mode by the switching device 30 as described above.

  The lock step mode is selected when executing a safety function program with high safety requirements such as injector injection control, throttle opening control, and transmission control, and the non-lock step mode is executed in the lock step mode. This is selected when executing a non-safety function program having a lower safety requirement than the safety function program. That is, the execution modes of the cores 10 and 12 are switched according to the flow of engine control.

In FIG. 3, the lock step mode is selected in the processes (1), (2), (4), (5), and (7), and the non-lock step mode is selected in the processes (3) and (6). .
In the lockstep mode, the cores 10 and 12 execute the same safety function program synchronously. On the other hand, in the non-lock step mode, the core 10 executes a non-safety function program, and the core 12 performs a memory check on the RAM 20 and the ROM 22.

  When the core 10 finishes executing the non-safety function program in the non-lock step mode, the core 10 notifies the switching device 30 of the end of the non-safety function program. Then, the switching device 30 instructs the core 12 to finish executing the memory check. At this time, if the core 12 is executing the memory check, the core 12 stores the address at which the memory check is resumed in the RAM 20 in the next non-lock step mode. As a result, the core 12 can resume from the state where the memory check is interrupted if the resume address is read at the start of execution of the next memory check.

  For example, for the data structure shown in FIG. 2, when the memory check by the core 12 is completed up to 0x4320 in the process (3) in the non-lock step mode shown in FIG. Then, the core 12 stores 0x4321 in the RAM 20 as an address for restarting the memory check next time.

When the switching device 30 is notified from the core 12 that the memory check restart address has been stored in the RAM 20, the switching device 30 instructs the cores 10 and 12 to execute the lockstep mode.
When both the cores 10 and 12 are notified that the execution of the safety function program has been completed in the lock step mode process (5), the switching device 30 switches from the lock step mode to the non-lock step mode. Commands the cores 10 and 12.

  The core 12 reads 0x4321 as the memory check restart address from the RAM 20 at the start of the non-lock step mode process (6), thereby restarting from the state where the memory check is suspended in the non-lock step mode process (3). Can do.

Next, processing in the lock step mode and the non-lock step mode will be described. 4 and 5, “S” represents a step.
(Lockstep mode processing)
In S400 of FIG. 4, when the switching device 30 instructs execution of the lock step mode, the core 10 validates the comparison result signal of the comparison circuit 40. Then, the cores 10 and 12 synchronously execute the same safety function program for the control with high safety demand such as the above-described injection control, throttle opening control, and transmission control as the lock step mode processing (S402). .

  The comparison circuit 40 compares the input data from the RAM 20 to the cores 10 and 12, the output data from the cores 10 and 12 to the RAM 20, and the input data from the ROM 22 to the cores 10 and 12 (S500). If any comparison result does not match (S502: Yes), the comparison circuit 40 outputs an interrupt signal indicating the comparison result mismatch to the cores 10 and 12 (S504).

When the comparison circuit 40 outputs an interrupt signal indicating that the comparison results do not match, the cores 10 and 12 execute fail-safe processing such as stopping the microcomputer 2 (S404).
(Non-lock step mode processing)
In S410 of FIG. 5, when the switching device 30 instructs execution of the non-lock step mode, the core 10 invalidates the comparison result signal of the comparison circuit 40. Then, the core 10 executes a non-safety function program that requires less safety than that in the lock step mode as the non-lock step mode process, and the core 12 performs a memory check on the RAM 20 and the ROM 22 (S412). .

  The memory check for the RAM 20 and the ROM 22 is performed by calculating an exclusive OR of the safety function data and the mirror data obtained by bit-inversion of the safety function data. If all the bits of the operation result data are 1, normal or even 1 bit is 0. Is determined to be abnormal.

If an abnormality occurs during the memory check by the core 12 (S414: Yes), the core 12 executes fail-safe processing such as stopping the microcomputer 2 (S416).
If there is no abnormality in all the memory checks (S414: No), the core 12 repeats the memory check from the beginning if the non-lock step mode process by the core 10 is being executed. As described above, the latest state of the RAM 20 and the ROM 22 can be checked by repeating the memory check.

  On the other hand, when the execution of the non-safety function program of the core 10 is finished in a state where there is no abnormality in the memory check result by the core 12 and there is a request for execution of the next non-safety function program, the core 10 Run.

  When the core 12 starts the memory check from the beginning, it is desirable to execute the memory check from the area of the RAM 20 that stores the memory check restart address. Thus, when the execution mode is switched from the non-lock step mode to the lock step mode during the memory check, the memory check resume address can be stored in the normal storage area of the RAM 20.

[Second Embodiment]
The microcomputer 4 of the second embodiment shown in FIG. 6 has a ROM 24 storing a memory check program executed by the core 12 separately from the ROM 22 storing other programs. The microcomputer 2 shown in FIG. Other configurations of the microcomputer 4 are substantially the same as those of the microcomputer 2.

  In the non-lock step mode, the core 12 does not set the ROM 24 as a memory check target, and executes the memory check of the RAM 20 and the ROM 22 by a program stored in the ROM 24. Thereby, if the ROM 24 is normal, the memory check for the RAM 20 and the ROM 22 can be executed normally.

  In the above-described embodiment, in the lock step mode, the cores 10 and 12 execute the same safety function program synchronously, and the comparison circuit 40 compares the input / output data of the cores 10 and 12, thereby providing two It can be determined whether or not the cores 10 and 12 are operating normally.

  On the other hand, in the non-lock step mode, the core 10 executes a non-safety function program, and the core 12 executes a memory check. Since the lock step mode and the non-lock step mode are executed alternately, an opportunity to execute a memory check can be ensured regardless of the processing load.

[Other Embodiments]
In the above embodiment, the dual core microcomputer has been described as an example, but the number of processor cores provided in the electronic control device may be three or more. In this case, it is conceivable that the determination of processing abnormality in the lockstep mode takes the majority of the output results of three or more processor cores and determines that the processor core that has become a minority is abnormal.

  When three or more processor cores are provided, the memory check may be executed in parallel by dividing the target area of the memory check by a plurality of processor cores in the non-lock step mode. By executing the memory check in parallel, the time required to complete the memory check can be shortened.

  In the above embodiment, the memory check is performed using mirror data obtained by bit-inversion of the safety function data as check data. In addition to this, data obtained by copying the safety function data may be used as check data, or memory check may be performed on the safety function data using CRC data and checksum. If CRC data and checksum are used, the memory capacity can be reduced as compared with the use of check data that is the same as the safety function data or bit-inverted.

  The electronic control device of the present invention is not limited to an electronic control device mounted on a vehicle, and includes a plurality of processor cores, and switches between a lock step mode and a non-lock step mode according to the safety required for the program. For example, the present invention may be applied to an electronic control device used for any purpose.

  As described above, the present invention is not limited to the above-described embodiment, and can be applied to various embodiments without departing from the gist thereof.

2, 4: ECU (electronic control device, switching means, determination means) 10, 12: processor core, 20: RAM (memory), 22, 24: ROM (memory), 30: switching device (switching means), 40 : Comparison circuit (determination means)

Claims (7)

A plurality of processor cores (10, 12);
A memory (20, 22) in which a program executed by the plurality of processor cores and data used by the program are stored;
A lock step mode in which the plurality of processor cores execute the same program; a part (10) of the plurality of processor cores executes a program having a lower requirement for safety than in the lock step mode ; Switching means (30) for alternately switching between a non-locking step mode in which the remaining processor cores (12) execute a memory check for at least a part of the memory commonly used by the processor cores ;
Determination means (40) for determining whether or not the plurality of processor cores are normally executing the same program in the lockstep mode;
An electronic control device comprising: The check data that is the same as the data used in the lock step mode or bit-inverted is stored in the memory,
In the non-lock step mode, the remaining processor cores execute the memory check using the check data.
The electronic control device according to claim 1. CRC data is generated and stored in the memory as an error detection code for data used in the lockstep mode,
In the non-lock step mode, the remaining processor cores perform the memory check using the CRC data.
The electronic control device according to claim 1. Of the memories (20, 22, 24), a program for executing the memory check is stored in a nonvolatile memory (24) different from the nonvolatile memory (22) to be subjected to the memory check. The electronic control device according to any one of claims 1 to 3 . 5. The electronic control device according to claim 1 , wherein the remaining processor core repeatedly executes the memory check in the non-lock step mode. 6. In the non-lock step mode, when the program executed by some of the processor cores ends before the memory check executed by the remaining processor cores in the non-lock step mode, 6. The switch according to claim 1 , wherein after the remaining processor core stores the resumption information for resuming the memory check in the memory, the lock step mode is switched. Electronic control device. The electronic control device according to claim 6 , wherein the remaining processor cores first execute the memory check on a storage area of the memory in which the resume information is stored.

Images