JP7011983B2 - Arithmetic system, arithmetic unit - Google Patents

Description

The present invention relates to an arithmetic system and an arithmetic unit.

The automobile is equipped with a plurality of arithmetic units that control the vehicle. According to Patent Document 1, in a vehicle control system including a plurality of in-vehicle devices connected via a communication path, the plurality of in-vehicle devices each diagnose the state of other in-vehicle devices other than the self, and the self themselves. The state of other in-vehicle devices diagnosed is exchanged with other in-vehicle devices, and based on the state of other in-vehicle devices diagnosed by oneself and the state of other in-vehicle devices acquired from other in-vehicle devices. , A vehicle control system for determining the state of other in-vehicle devices is disclosed.

Japanese Unexamined Patent Publication No. 2007-126127

In the invention described in Patent Document 1, a predetermined operation cannot be performed alternately by a plurality of arithmetic units.

The in-vehicle network system according to the first aspect of the present invention is an arithmetic system including a plurality of arithmetic units that alternately execute predetermined operations, and each of the arithmetic units communicates with other arithmetic units. When the communication unit, the arithmetic unit that performs the predetermined arithmetic, and the arithmetic unit satisfy the predetermined conditions when the arithmetic unit is performing the predetermined arithmetic unit, the predetermined arithmetic unit is stopped, and the other arithmetic unit is subjected to the predetermined arithmetic unit. The execution control unit includes an execution control unit that transmits a delegation signal for taking over the calculation of the above, and when the execution control unit receives the delegation signal, the calculation unit causes the calculation unit to start the predetermined calculation, and the calculation unit is used between the arithmetic units. A monitoring unit that receives the communication, a storage unit that stores order information indicating the normal order of the communication, and a verification unit that collates the order of the communication received by the monitoring unit with the order information. The storage unit further stores order information indicating the order of the arithmetic units that execute the predetermined processing, and the execution control unit has the next device that executes the predetermined processing next to the arithmetic unit, and the said. The next device to execute the predetermined process next to the next device is determined with reference to the order information, and the execution control unit transmits the delegated signal to the next device for a second predetermined time. If the delegation signal from the next device to the next device is not detected by the time elapses, the delegation signal is output to the next device.
The arithmetic unit according to the second aspect of the present invention is an arithmetic unit capable of alternately executing a predetermined arithmetic unit, and includes a communication unit that communicates with the other arithmetic unit and an arithmetic unit that performs the predetermined arithmetic unit. , When the predetermined condition is satisfied when the arithmetic unit is performing the predetermined arithmetic, the execution control unit that stops the predetermined arithmetic and transmits a delegation signal to another arithmetic unit to take over the predetermined arithmetic. When the execution control unit receives the delegated signal, the arithmetic unit causes the arithmetic unit to start the predetermined calculation, and the arithmetic unit has a monitoring unit that receives communication between the arithmetic units and the normal communication. A storage unit that stores order information indicating the order of the above, a verification unit that collates the order of communication received by the monitoring unit with the order information, and the storage unit executes the predetermined process. The order information indicating the order of the arithmetic units is further stored, and the execution control unit executes the next device that executes the predetermined process next to the arithmetic unit, and the next device that executes the predetermined process one after another. The device is determined with reference to the order information, and the execution control unit transfers the device from the next device to the device one after another by the time when the second predetermined time elapses after transmitting the delegation signal to the next device. If the delegation signal is not detected, the delegation signal is output to the devices one after another.

According to the present invention, a predetermined operation can be executed by a plurality of arithmetic units in turn.

Schematic diagram of arithmetic system 2000 Configuration diagram of the first ECU 101 Schematic diagram showing how the ECU 100 takes turns monitoring the communication of the vehicle 1000. FIG. 4A is a diagram showing an example of the transition table 18b, and FIG. 4B is a diagram visualizing the transition table 18b. A diagram schematically showing the rotation of status monitoring and communication monitoring A flowchart showing the operation of the communication monitoring block 14 in the first embodiment. A flowchart showing the operation of the communication monitoring block 14 in the first embodiment. A flowchart showing the operation of the communication monitoring block 14 in the first embodiment. A flowchart showing the operation of the communication monitoring block 14 in the first embodiment. A flowchart showing the operation of the communication monitoring block 14 in the second embodiment.

-First embodiment-
Hereinafter, the first embodiment of the arithmetic system will be described with reference to FIGS. 1 to 9.

(overall structure)
FIG. 1 is a schematic diagram of an arithmetic system 2000 according to the present invention. The arithmetic system 2000 is stored in the vehicle 1000. The arithmetic system 2000 includes a gateway 200, a first ECU 101, a second ECU 102, a third ECU 103, a fourth ECU 104, a first communication bus 21, a second communication bus 22, and a communication device 110. Hereinafter, the first ECU 101, the second ECU 102, the third ECU 103, and the fourth ECU 104 are referred to as “ECU 100” when not particularly distinguished. The communication device 110 can communicate with the communication network 201, for example, the Internet by wireless communication. Although there are only four ECUs in FIG. 1 from the first to the fourth, the number of ECUs provided in the vehicle 1000 may be 2 or more, and there is no upper limit. Further, the vehicle 1000 may have only one communication bus or three or more communication buses.

The communication method of the device mounted on the vehicle 1000 is not particularly limited, and for example, CAN (registered trademark) or IEEE802.3 can be used. The names of data transmitted on the network depending on the communication method and communication protocol are various, such as frames, datagrams, and packets, but in the present embodiment, they are called "packets". The gateway 200 operates as a so-called repeater, and transmits information received on one port from the other port. That is, all the received packets are forwarded without looking at the destination and determining whether or not the packets need to be forwarded to the other communication bus.

The communication device 110, the first ECU 101, and the gateway 200 are connected to the first communication bus 21. The gateway 200, the second ECU 102, the third ECU 103, and the fourth ECU 104 are connected to the second communication bus 22. The communication device 110 is responsible for providing update information to the ECU 100. That is, this means that, as shown by the alternate long and short dash line in FIG. 1, there is a possibility of intrusion from the outside with the communication device 110 as an entrance. Therefore, in the present embodiment, an abnormality caused by an intrusion from the outside is detected.

(ECU configuration)
FIG. 2 is a diagram showing the configuration of the first ECU 101. However, the second ECU 102 to the fourth ECU 104 also have substantially the same configuration as the first ECU 101. The first ECU 101 includes an application 12, basic software 13, a communication monitoring block 14, and a communication unit 11. Each ECU 100 has different functions realized by the application 12, but has the same other configurations.

The first ECU 101 includes a CPU, ROM, and RAM (not shown), and can realize the application 12, the basic software 13, and the communication monitoring block 14 by expanding the program stored in the ROM into the RAM and executing the CPU. can. However, it may be realized by a hardware circuit or a rewritable logic circuit.

The application 12 is an application that realizes the function that the first ECU 101 mainly aims at. The basic software 13 is an operating system for operating the application 12. The communication monitoring block 14 alternately monitors the communication in the vehicle 1000 with other ECUs. The details of the communication monitoring block 14 will be described in detail below. The first ECU 101 monitors the communication in the vehicle 1000 by using the communication monitoring block 14 for a certain time while exerting the original function by the application 12. It will be described in detail with reference to FIG.

FIG. 3 is a schematic view showing how the ECU 100 takes turns, that is, rotates to monitor the communication of the vehicle 1000. 3 (a) to 3 (d) are arranged in chronological order, and after FIG. 3 (d), the process returns to FIG. 3 (a). As shown in FIG. 3A, the first ECU 101 first monitors the communication, and when a predetermined condition is satisfied, the delegated packet 32, which is a signal for taking over the monitoring of the communication, is transmitted to the second ECU 102. The "delegation packet" can also be called a "delegation signal".

The first ECU 101 that has transmitted the delegated packet 32 ends the communication monitoring. The second ECU 102 that has received the delegated packet 32 monitors the communication as shown in FIG. 3 (b). Then, when the predetermined condition is satisfied, the second ECU 102 transmits the delegated packet 32 to the third ECU 103 to end the monitoring. In this way, the ECU 100 transmits the delegated packet 32 and switches the monitoring of communication one after another. The explanation will be continued by returning to FIG.

The communication unit 11 includes a reception buffer 11a, a transmission buffer 11b, and a controller (not shown). The receive buffer 11a is a buffer in which all packets flowing through the communication bus 20 are input by the controller. The basic software 13 processes the packet to be handled by the first ECU 101, and ignores the other packets. However, when the monitoring unit 16 described later is operating, the monitoring unit 16 monitors all the packets input to the reception buffer 11a. The packet to be supported by the first ECU 101 is a packet having a CAN-ID of a specific value in CAN or a packet in which the destination IP address is the first ECU 101 in IEEE802.3.

The transmission buffer 11b is a buffer into which a packet transmitted by the first ECU 101 is input. The packet input to the transmission buffer 11b is output to the communication bus 20 by the controller according to the availability of the communication bus 20 and a predetermined communication cycle.

The communication monitoring block 14 includes an execution control unit 15, a monitoring unit 16, a verification unit 17, and a storage unit 18. In the following, the monitoring unit and the verification unit 17 are collectively referred to as a calculation unit 30. In the storage unit 18, a monitoring order 18a indicating the order of the ECU 100 for monitoring communication and a transition table 18b indicating a transition of a normal state regarding communication in the vehicle are stored. In the following, the state related to communication in the vehicle is referred to as "communication state". That is, the normal transition of the communication state is stored in the transition table 18b. For example, the monitoring order 18a corresponding to the example shown in FIG. 3 is {1st ECU 101, 2nd ECU 102, 3rd ECU 103, 4th ECU 104}. Specific examples of the transition table 18b will be described later.

When the execution control unit 15 receives the delegated packet 32 addressed to the first ECU 101, the execution control unit 15 causes the monitoring unit 16 and the verification unit 17 to start the operation. When a predetermined condition is satisfied while the monitoring unit 16 and the verification unit 17 are operating, the execution control unit 15 stops the operation of the monitoring unit 16 and the verification unit 17 and transmits a delegated packet 32. The predetermined condition is the passage of a predetermined time or an increase in the processing load. The destination of the delegated packet 32 is determined according to the monitoring order 18a. The delegated packet 32 is transmitted with the current communication state added as described later. Details will be described later.

The execution control unit 15 always grasps which ECU 100 is monitoring the communication. Hereinafter, the ECU 100 that monitors communication is referred to as a “monitoring ECU”, and the information recorded by the execution control unit 15 indicating the monitoring ECU is referred to as “monitoring ECU information”. Since the delegated packet 32 is transmitted to all the ECUs 100 via the communication bus 20, the monitoring ECU can be grasped even if the delegated packet 32 is transmitted and received between the other ECUs 100.

The monitoring unit 16 monitors the identifier of the packet input to the reception buffer 11a, for example, CAN-ID, and outputs it to the verification unit 17. The verification unit 17 determines whether or not the communication state has transitioned normally using the current communication state, the identifier of the packet output by the monitoring unit 16, and the three pieces of information in the transition table 18b.

(Transition table 18b)
FIG. 4A is a diagram showing an example of the transition table 18b, and FIG. 4B is a diagram showing the transition table 18b. The transition table 18b is composed of a plurality of records, and each record is composed of a communication state, a transition trigger condition, a transition destination communication state, a timeout time, and a trigger setting field. The communication status number is stored in the communication status field. In the trigger condition field, the condition for transitioning to the next communication state is stored. In the communication status field of the transition destination, the communication status number to be transitioned when the trigger condition is satisfied is stored. In the timeout field, the time from the transition to that state to the timeout is stored. However, if there is no timeout, "None" is stored.

For example, the example in the first line of FIG. 4A shows that when a packet having a CAN-ID of 6 is detected in the communication state 1, the communication state is changed to 2. Further, in the example of the second line of FIG. 4A, when a packet having a CAN-ID of 7 is detected in the communication state 2, the communication state is changed to 3, and the CAN-ID is changed within 1 ms after the transition to the communication state 2. Indicates that if 7 packets are not detected, a timeout will occur. When the time-out occurs, the state transitions to the abnormal state described later.

FIG. 4B is a visualization diagram of the transition table 18b created by supplementing the description omitted in FIG. 4A. The circled numbers shown in FIG. 4B indicate the communication state, and the numbers near the arrows connecting the communication states indicate the CAN-ID that is the trigger condition. A part of the operation of the verification unit 17 will be described with reference to FIG. 4 (b). According to FIG. 4B, since the normal transition destination from the communication state 1 is only the communication state 2, when a packet other than the CAN-ID 6 is received in the communication state 1, the verification unit 17 makes a transition to the abnormal state. In the communication state 2, when the CAN-ID receives a packet other than 7, 11 and 13, the verification unit 17 shifts to the abnormal state. Further, when the verification unit 17 receives a packet having a CAN-ID of 8 in the communication state 3, the verification unit 17 keeps the communication state 3 as it is.

(Schematic diagram of monitoring)
FIG. 5 is a diagram schematically showing the rotation of condition monitoring and communication monitoring. The upper part of FIG. 5 shows a state in which the first ECU 101 monitors communication, and the lower part of FIG. 5 shows a state in which the second ECU 102 monitors communication. The inside of the frame shown by reference numeral 31 schematically shows the transition of the communication state, and the number with the underscore indicates the current communication state. The schematic diagram of the communication state shown in FIG. 5 is different from that of FIG. 4 due to the convenience of drawing.

The first ECU 101 started monitoring from the communication state 1, received the packet several times, repeated the state transition, and became the communication state 3 as shown in the upper right of FIG. Then, since the predetermined condition is satisfied, the delegated packet 32 is transmitted to the second ECU 102 that monitors the communication next. The delegated packet 32 also includes information indicating that the current communication state is "communication state 3". Upon receiving the delegated packet 32, the second ECU 102 starts monitoring the communication assuming that the current communication state is "communication state 3" according to the information included in the delegated packet 32. The second ECU 102 receives the packet and changes the communication state, and when the communication state becomes "communication state 5", the predetermined condition is satisfied. Therefore, the delegated packet 32 including the information indicating that the current communication state is "communication state 5" is transmitted to the next third ECU 103.

(flowchart)
6 to 9 are flowcharts showing the operation of the communication monitoring block 14. In the description of FIGS. 6 to 8, the ECU 100 that performs the operation described below is referred to as "the ECU" or "self". When the execution control unit 15 of the ECU 100 is activated, the operation shown in FIG. 6 is started.

The execution control unit 15 first reads the monitoring order 18a (S102), and determines whether or not the ECU is in the first order (S103). For example, in the case of the above-mentioned example of the monitoring order 18a, only the first ECU 101 positively determines S103 and proceeds to S104, and the other ECUs negatively determine S103 and proceed to S105. In S104, the execution control unit 15 transmits the delegated packet 32 to the ECU itself and proceeds to S105. The delegated packet 32 contains information that the current communication state is "communication state 1".

In S105, the execution control unit 15 waits until some packet is received, and when the packet is received, the process proceeds to S107. If the process proceeds from S104 to S105, the process immediately proceeds to S107. In S107, the execution control unit 15 determines whether or not the communication is being monitored, and if it is determined that the communication is being monitored, the process proceeds to the circle 2 in FIG. 7, and if it is determined that the communication is not being monitored, the process proceeds to S108. In S108, the execution control unit 15 determines whether or not the received packet is the delegation packet 32, and if it is determined that the delegation packet 32 has been received, proceeds to the circle 3 in FIG. 7, and the packet other than the delegation packet 32. If it is determined that the packet has been received, the process proceeds to the circle 4 in FIG.

FIG. 7 is a diagram showing processing when a positive judgment is made in S107 or S108 of FIG. S118 is executed by the execution control unit 15 via the circle 3 when affirmatively determined in S108 of FIG. In S118, it is determined whether or not the received delegated packet 32 is addressed to the ECU. The destination of the delegated packet 32 may be determined by the CAN-ID which is the identifier of the packet or the IP address indicating the destination, or may be determined from the information contained in the payload. The execution control unit 15 proceeds to S120 when it is determined that it is addressed to itself, and proceeds to S119 when it is determined that it is not addressed to itself. In S119, the execution control unit 15 updates the monitoring ECU information and proceeds to the circle 1.

In S120, the execution control unit 15 sets the communication state and the timer, which is the process at the start of monitoring, and proceeds to S121. The setting of the communication state is to read the information included in the delegated packet 32 and the current communication state, for example, which of the states 1 to 4 shown in FIG. 4B is. The set of timers is to start timing to take turns in the monitoring time, which is a predetermined length of time, for example, 10 seconds.

S121 is executed after S120, or after being affirmed by S107 in FIG. 6, via the circle 2. In S121, the execution control unit 15 performs processing at the time of monitoring as described later, and proceeds to S122. In S122, the execution control unit 15 determines whether or not the monitoring time has ended, that is, whether or not the timekeeping started in S120 has reached a predetermined time. If the execution control unit 15 determines S122 affirmatively, the process proceeds to S124, and if S122 is negatively determined, the process proceeds to S123. In S124, the execution control unit 15 refers to the monitoring order 18a to specify the ECU 100 in charge of monitoring next, and creates and transmits the delegated packet 32 to the specified ECU 100. However, the delegated packet 32 also includes information indicating the current communication state. Then, the execution control unit 15 proceeds to the circle 1 after S124.

In S123, the execution control unit 15 determines whether or not the current processing load of the ECU 100 is larger than the predetermined value, proceeds to S124 if it is determined to be larger than the predetermined value, and circled 1 if it is determined to be equal to or less than the predetermined value. move on. That is, when the execution control unit 15 starts monitoring the communication and a predetermined time elapses or the processing load becomes larger than the predetermined value, the execution control unit 15 transmits the delegated packet 32 to cause the next ECU 100 to monitor the communication.

FIG. 8 is a diagram showing a process executed via the circle 4 when a negative determination is made in S108 of FIG. In S109 executed after the encircled 4, the execution control unit 15 determines whether or not the first specified time or more has elapsed since the delegated packet 32 was transmitted immediately before. However, the first specified time is a predetermined length of time. The execution control unit 15 proceeds to S110 when affirming S109, and proceeds to circle 1 when making a negative determination of S109.

In S110, the execution control unit 15 determines whether or not the monitoring ECU currently monitoring the communication is immediately before itself in the monitoring order 18a. The execution control unit 15 proceeds to S115 when it is determined that the monitoring ECU is immediately in front of itself, and proceeds to S112 when it is determined that the monitoring ECU is not immediately in front of itself. In S112, the execution control unit 15 determines whether or not the second specified time or more has elapsed since the delegated packet 32 was transmitted immediately before. However, the second specified time is a predetermined length of time, and may be the same as or different from the first specified time. The execution control unit 15 proceeds to S113 when the S112 is affirmed, and proceeds to the circle 1 when the S112 is negatively determined.

In S113, the execution control unit 15 outputs an alert because the delegated packet 32 is not detected for a long time, and in the following S114, the delegated packet 32 is transmitted to itself and proceeds to the circle 1. In S115, the execution control unit 15 determines whether or not the failure of the monitoring ECU has been detected. The function of detecting the failure of the ECU 100 connected to the communication bus 20 may be provided in each of the ECUs 100, or the crisis connected to the communication bus 20 may detect the failure and transmit it to each ECU 100. good. The execution control unit 15 proceeds to S117 when the determination of S115 is affirmative, and proceeds to S116 when the determination of S115 is negative.

In S116, the execution control unit 15 outputs an alert and proceeds to S117. The reason why the alert is output only when a negative judgment is made in S115 is that it is assumed that if a failure is detected, it will be dealt with by a protection mechanism other than communication monitoring. In S117, a delegation packet is sent to itself and the process proceeds to circle 1.

FIG. 9 is a flowchart showing the details of S121 of FIG. The process shown in FIG. 9 is executed by the verification unit 17 instructed to operate by the execution control unit 15. First, in S130, the verification unit 17 updates the communication state based on the received packet. In the following S131, the verification unit 17 determines whether or not the fraud is detected, that is, whether or not the abnormal state has occurred in S130. When the verification unit 17 determines that an abnormal state has been detected, it proceeds to S132, outputs an alert, proceeds to S133, and determines that it has not transitioned to an abnormal state, proceeds to S133. In S133, the execution control unit 15 is notified of the communication state transitioned in S130, and the process shown in FIG. 9 is terminated.

According to the first embodiment described above, the following effects can be obtained.
(1) The arithmetic system 2000 includes a plurality of ECUs 100 that alternately perform communication monitoring. The ECU 100 stops a predetermined calculation when a predetermined condition is satisfied when the communication unit 11 that communicates with another ECU 100, the calculation unit 30 that performs a predetermined calculation, and the calculation unit 30 are performing a predetermined calculation. It is provided with an execution control unit 15 for transmitting a delegated packet 32 for causing another ECU 100 to take over a predetermined operation. When the execution control unit 15 receives the delegated packet 32, the execution control unit 15 causes the calculation unit 30 to start a predetermined calculation. Therefore, the arithmetic system 2000 can alternately execute predetermined arithmetics by the plurality of arithmetic units 100.

(2) The calculation unit 30 includes a monitoring unit 16 that receives communication between ECUs 100, a storage unit 18 that stores a transition table 18b showing the normal communication order, and a communication order and transition table received by the monitoring unit 16. A verification unit 17 for collating with 18b is provided. Therefore, the arithmetic unit 30 can monitor the communication of the arithmetic system 2000.

(3) One of the conditions for the ECU 100 to switch the monitoring of communication is a predetermined time from the start of monitoring the communication, that is, the lapse of the monitoring time. Therefore, it is possible to prevent the calculation load from being biased to the specific ECU 100.

(4) One of the conditions for the ECU 100 to switch the monitoring of communication is that the current processing load of the ECU is higher than a predetermined threshold value. Therefore, when the processing load of the application 12 is high, it is possible to delegate the monitoring of communication to the next ECU 100 and reduce the adverse effect of monitoring the communication on the original operation of the ECU 100.

(5) The execution control unit 15 is conditioned on the condition that the first period, that is, the first specified time in S109 of FIG. 8 or the second specified time in S112 elapses after the calculation unit 30 finishes the predetermined calculation. As one of the above, the arithmetic unit 30 is made to execute a predetermined arithmetic even if the delegated packet 32 is not received. Even when a failure occurs in another ECU 100 and the delegated packet 32 cannot be transmitted, the ECU can monitor the communication.

(6) The delegated packet 32 includes monitoring progress information, that is, the current communication status. Therefore, as shown in FIG. 5, even if the ECU 100 that monitors communication is replaced, the communication status information can be taken over and monitored.

(Modification 1)
In the first embodiment described above, the delegated packet 32 includes the monitoring ECU information, but does not include the time-out remaining time. However, the ECU 100 may also transmit the remaining time of the timeout. For example, if the timeout of a certain communication state is 10 ms and the delegated packet 32 is output 4 ms after the transition to the communication state, the communication state and 4 ms have already passed in the delegated packet 32. Include information to that effect. The ECU 100 that has received the delegated packet 32 determines that the timeout has occurred if the packet is not received within 6 ms. According to this modification 1, the timeout can be accurately evaluated even if the monitoring ECU is changed.

(Modification 2)
Any ECU 100 may be a master unit having a function of changing the rotation order. The master unit changes the rotation order when a certain time elapses or detection of an approach, and transmits the changed rotation order including the changed rotation order in the delegated packet 32. Upon receiving the delegated packet 32, the ECU 100 overwrites the monitoring order 18a stored in the storage unit 18 in the order of rotation included in the delegated packet 32. Further, the ECU 100 that has received the delegated packet 32 includes the changed rotation order, which is the received information, in the delegated packet 32 transmitted by itself.

For example, the rotation order can be changed without a master unit by the following configuration. That is, a plurality of monitoring orders 18a may be stored in the ECU 100 in advance, and the rotation order may be changed by changing the monitoring order 18a that each ECU 100 refers to at its own discretion depending on conditions such as the passage of time.

According to this modification 2, in addition to the action and effect of the first embodiment, the following action and effect can be obtained.
(7) The order in which the ECU 100 monitors communication is not fixed. Therefore, the order of rotation can be changed to improve safety.

(Modification 3)
When the processing load is larger than the predetermined value in S123 of FIG. 7, a delegated packet 32 is immediately created and communication monitoring is delegated to the next ECU 100. However, the monitoring time may be shortened according to the magnitude of the processing load. For example, three processing load thresholds are set, and when the lowest threshold is exceeded, the time for the ECU to monitor the network is shortened by 30%, and when the next threshold is exceeded, the time is shortened by 60%, and the largest threshold is set. If the value is exceeded, monitoring may be terminated immediately.

(Modification example 4)
Upon receiving the delegated packet 32, the ECU 100 started monitoring the communication. However, if the processing load is larger than a predetermined threshold value when the delegated packet 32 is received, the received delegated packet 32 may be ignored. For example, if it is determined in S118 that the processing load is larger than the predetermined threshold value, the process proceeds to the circle 1 without proceeding to S120. According to this modification 4, it is possible to concentrate on the original processing of the ECU 100.

(Modification 5)
In the first embodiment, the ECU 100 takes turns monitoring the communication. However, the processing performed in turn is not limited to communication monitoring. For example, the calculation for realizing the function necessary for the running of the vehicle 1000 or the additional function may be executed alternately. The function required for the running of the vehicle 1000 is, for example, the calculation of the optimum ignition timing of the engine. The additional function is, for example, an operation of processing data acquired by a sensor included in the vehicle 1000 to detect an obstacle.

(Modification 6)
The ECU 100 may transmit the delegated packet 32 to the ECU 100 which is two ahead in the monitoring order 18a. In this case, the ECU 100 performs the following operation. When the ECU 100 transmits the delegated packet 32, the ECU 100 monitors the transmission of the next delegated packet 32 of the ECU 100 in the monitoring order 18a. Then, if the transmission of the delegated packet 32 cannot be confirmed within a predetermined time after the delegated packet 32 is transmitted, the delegated packet 32 is transmitted to the ECU 100 two destinations ahead. The ECU 100 in the order next to the ECU in the monitoring order 18a is also referred to as a "next device", and the next ECU 100 is also referred to as a "sequential device".

For example, when the monitoring order 18a is the order of the first ECU 101, the second ECU 102, the third ECU 103, and the fourth ECU 104 as in the first embodiment, the specific operation mainly by the first ECU 101 is as follows. When the first ECU 101 transmits the delegated packet 32 to the second ECU 102, the first ECU 101 monitors the transmission of the delegated packet 32 by the second ECU 102. Then, if it is determined that the second ECU 102 has not transmitted the delegated packet 32 to the third ECU 103 within a predetermined time after the first ECU 101 transmits the delegated packet 32 to the second ECU 102, the first ECU 101 delegates to the third ECU 103 which is a device one after another. The packet 32 is transmitted.

According to this modification 6, in addition to the action and effect of the first embodiment, the following action and effect can be obtained.
(8) The monitoring order 18a is stored in the storage unit 18. The execution control unit 15 identifies the next device and the next device one after another with reference to the monitoring order 18a. If the execution control unit 15 does not detect the delegation packet 32 from the next device to the device one after another by the time when the second predetermined time elapses after transmitting the delegation packet 32 to the next device, the execution control unit 15 sends the delegation packet 32 to the device one after another. Output.

(Modification 7)
In S123 of FIG. 7, the execution control unit 15 determines whether or not the current processing load of the ECU 100 is larger than a predetermined value. However, the execution control unit 15 may predict the processing load of the ECU 100 in the near future, for example, after 10 ms or 100 ms, and determine whether or not the predicted processing load is larger than a predetermined value. According to this modification, it is possible to reduce the adverse effect on the original processing by monitoring the communication, that is, the processing of the application 12. Since the processing of the ECU 100 is often periodic, it is easy to predict the processing load.

-Second embodiment-
A second embodiment of the arithmetic system will be described with reference to FIG. In the following description, the same components as those in the first embodiment are designated by the same reference numerals, and the differences will be mainly described. The points not particularly described are the same as those in the first embodiment. The present embodiment is different from the first embodiment in that the monitoring is not terminated even if the processing load is large when the delegated packet is received at a short time interval.

(Outline of the second embodiment)
In the first embodiment described above, when the processing load of the ECU 100 monitoring the communication becomes large, the communication monitoring is completed even before the monitoring time ends (S122: NO in FIG. 7). S123: YES, S124). Therefore, when the processing load of all the ECUs 100 is high, the ECU 100 that has received the delegated packet 32 immediately transmits the delegated packet 32 to the next ECU 100, and the monitoring ECU is changed one after another. In this case, it is not preferable because only the monitoring ECU is changed and the communication is not monitored.

Therefore, in the present embodiment, when the ECU 100 receives the delegated packet 32 again in a short time, the flag indicating that the ECU 100 has a high processing load as a whole (hereinafter, “continuation flag”) is set to ON. When the continuation flag is on, communication monitoring is continued until the monitoring time ends even if the processing load is higher than a predetermined threshold value. In addition, although all the ECUs 100 performed the same operation in the first embodiment, in the present embodiment, some ECUs 100 may perform the same operation as in the first embodiment.

(Constitution)
The configuration of the vehicle 1000 and the functional configuration of the ECU 100 are the same as those of the first embodiment except for the following points. That is, the operation of at least a part of the ECU 100 is different as described below. This means, for example, that the programs stored in the ROM (not shown) are different, the hardware circuits are different, or the circuits written in the logic circuits are different.

(flowchart)
FIG. 10 is a flowchart showing the operation of the communication monitoring block 14 in the second embodiment. However, FIG. 10 is a flowchart executed instead of FIG. 7 in the first embodiment. That is, the communication monitoring block 14 in the second embodiment performs the operations shown in FIGS. 6 and 8 to 10. The difference between FIGS. 7 and 10 is that when affirmative judgment is made in S118, S142 to S144 are executed and then transitions to S120, and when affirmative judgment is made in S123, S149 is executed. Although S151 and S153 are added after S124, they may not be added. Each added step will be described below.

In S142, which is executed when affirmative determination is made in S118, the execution control unit 15 determines whether or not the time interval from the previous execution of S124 to the execution of S142 is shorter than a predetermined threshold value. This threshold value is, for example, a product of three, that is, a monitoring time, which is a predetermined length of time, the number of ECUs 100 connected to the communication bus 20, and a predetermined coefficient, for example, 0.1. The execution control unit 15 proceeds to S142 to set the continuation flag on when making an affirmative determination of S142, and proceeds to S143 to set the continuation flag to off when making a negative determination. When S143 or S144 is executed, the execution control unit 15 proceeds to S120. Since the processing of S120 is the same as that of the first embodiment, the description thereof will be omitted.

In S149, which is executed when S123 is affirmed, the execution control unit 15 determines whether or not the continuation flag is on. If it is determined that the execution control unit 15 is on, the process proceeds to the circle 1 without creating the delegation packet 32, and if it is determined that the continuation flag is off, the process proceeds to S124. That is, in the present embodiment, when the continuation flag is on, the process does not proceed to S124 unless the monitoring time ends.

The execution control unit 15 executes S124 in the same manner as in the first embodiment, and then proceeds to S151. In S151, the execution control unit 15 determines whether or not the continuation flag is on, and if the continuation flag is on, proceeds to S153 and sets the continuation flag to off z. When the execution control unit 15 determines that the continuation flag is off, the execution control unit 15 proceeds to the circle 1 as it is.

Each of the above-described embodiments and modifications may be combined. Although various embodiments and modifications have been described above, the present invention is not limited to these contents. Other aspects considered within the scope of the technical idea of the present invention are also included within the scope of the present invention.

11 ... Communication unit 14 ... Communication monitoring block 15 ... Execution control unit 16 ... Monitoring unit 17 ... Verification unit 18 ... Storage unit 30 ... Calculation unit 32 ... Delegated packet 100 ... ECU
1000 ... Vehicle 2000 ... Arithmetic system

Claims (2)

An arithmetic system that includes a plurality of arithmetic units that perform predetermined arithmetic in turn.
Each of the arithmetic units
With a communication unit that communicates with the other arithmetic unit,
A calculation unit that performs the predetermined calculation and
An execution control unit that stops the predetermined calculation when the predetermined condition is satisfied when the calculation unit is performing the predetermined calculation, and transmits a delegation signal to the other arithmetic unit to take over the predetermined calculation. Equipped with
When the execution control unit receives the delegation signal, the execution control unit causes the calculation unit to start the predetermined calculation.
The arithmetic unit
A monitoring unit that receives communication between the arithmetic units, and
A storage unit that stores order information indicating the normal order of communication, and
A verification unit that collates the order of communication received by the monitoring unit with the order information is provided.
The storage unit further stores order information indicating the order of the arithmetic units that execute the predetermined process.
The execution control unit determines the next device that executes the predetermined process next to the arithmetic unit, and the next device that executes the predetermined process next to the next device, with reference to the order information.
If the execution control unit does not detect the delegation signal from the next device to the next device by the time when the second predetermined time elapses after transmitting the delegation signal to the next device, the execution control unit delegates to the next device. An arithmetic system that outputs signals . An arithmetic unit that can perform predetermined operations in turn,
With a communication unit that communicates with the other arithmetic unit,
A calculation unit that performs the predetermined calculation and
An execution control unit that stops the predetermined calculation when the predetermined condition is satisfied when the calculation unit is performing the predetermined calculation, and transmits a delegation signal to the other arithmetic unit to take over the predetermined calculation. Equipped with
When the execution control unit receives the delegation signal, the execution control unit causes the calculation unit to start the predetermined calculation.
The arithmetic unit
A monitoring unit that receives communication between the arithmetic units, and
A storage unit that stores order information indicating the normal order of communication, and
A verification unit that collates the order of communication received by the monitoring unit with the order information is provided.
The storage unit further stores order information indicating the order of the arithmetic units that execute the predetermined process.
The execution control unit determines the next device that executes the predetermined process next to the arithmetic unit, and the next device that executes the predetermined process next to the next device, with reference to the order information.
If the execution control unit does not detect the delegation signal from the next device to the next device by the time when the second predetermined time elapses after transmitting the delegation signal to the next device, the execution control unit delegates to the next device. An arithmetic unit that outputs a signal .

Images