JP7327188B2 - electronic controller - Google Patents

Description

The disclosure in this specification relates to an electronic control device provided with a plurality of cores that execute arithmetic processing.

Patent Document 1 describes a multi-core microcomputer having a master core and slave cores. In this microcomputer, when the master core instructs the slave core to perform interrupt processing, the master core updates data in the shared memory. On the other hand, the slave core that has received the interrupt processing command checks whether the data in the shared memory has been updated, and if it has not been updated, diagnoses that the received command was an erroneous notification.

JP 2012-108786 A

However, in a general electronic control device, an interrupt controller allocates interrupt processing to both cores instead of a configuration in which the master core directly instructs the slave core to perform interrupt processing. The interrupt controller waits for the interrupt processing until the scheduled time to be executed, and commands the interrupt processing to either of the two cores when the scheduled time comes.

Therefore, for example, when the interrupt controller fails, or when the wiring connecting the interrupt controller and each core is disconnected, abnormalities such as interrupt processing not being properly commanded from the interrupt controller to both cores are described in the patent document It cannot be detected by the above diagnosis method according to 1.

One object of the disclosure is to provide an electronic control device capable of diagnosing an abnormality such as an interrupt process not being normally commanded by an interrupt controller.

To achieve the above object, one aspect disclosed is
a first core (21) to which a part of a plurality of control processes for controlling one controlled object is assigned and which executes the operation of the assigned processes;
a second core (22) to which another part of the plurality of control processes is assigned and which executes the operations of the assigned processes;
an interrupt controller (24) that allocates interrupt processing separate from control processing to the first core and the second core;
A first required time (T10) from the start of waiting for interrupt processing by the interrupt controller to the start of execution of interrupt processing by the first core, and the start of waiting for interrupt processing by the interrupt controller to interrupt processing by the second core an acquisition unit (20) for acquiring a second required time (T20) until the start of execution of
a determination unit (20) that determines an abnormal state when at least one of the first required time and the second required time acquired by the acquisition unit is longer than the reference time (Tth);
with
Among the control processing, the processing of the acquisition unit and the determination unit is diagnostic processing,
The electronic control device is such that the core that executes the diagnostic processing can be sequentially changed so that the diagnostic processing is executed by the core with the smaller processing load of the first core and the second core.

In short, according to the electronic control device, the required time from the start of waiting for interrupt processing in the interrupt controller to the start of execution (wake-up) of interrupt processing in each core is acquired, and the acquired required time is used as the reference time. If it is longer, it is determined to be in an abnormal state.

According to this, when an abnormality occurs such that an interrupt processing command is not normally issued from the interrupt controller to both cores, the required time becomes longer than the reference time, and an abnormal state is determined. For example, if the interrupt controller fails or the wiring that connects the interrupt controller and each core is disconnected, the execution of the interrupt process will not start (wake up) unless the interrupt process is commanded to both cores. Therefore, the required time becomes infinite, and it can be determined as an abnormal state. As described above, according to the electronic control device, it is possible to diagnose an abnormality such as an interrupt process not being normally commanded from the interrupt controller.

It should be noted that the reference numbers in parentheses above merely indicate an example of correspondence with specific configurations in the embodiments described later, and do not limit the technical scope in any way.

1 is a block diagram showing the configuration of an electronic control unit according to a first embodiment; FIG. 4 is a timing chart of processing for diagnosing the presence or absence of an abnormality in the first embodiment; FIG. 10 is a timing chart of processing for diagnosing whether or not there is an abnormality in the first embodiment, and shows a state in which the reference time has been changed to be longer. 4 is a flowchart of processing for diagnosing whether or not there is an abnormality in the first embodiment. 5 is a flowchart showing subroutine processing of FIG. 4; 9 is a timing chart for executing diagnosis processing in the second core in the second embodiment;

A plurality of embodiments of the present disclosure will be described below based on the drawings. Note that redundant description may be omitted by assigning the same reference numerals to corresponding components in each embodiment. When only a part of the configuration is described in each embodiment, the configurations of other embodiments previously described can be applied to other portions of the configuration.

(First embodiment)
The electronic control unit in this specification is called an ECU (Electronic Control Unit). The ECU includes at least hardware and software recorded in a storage medium.

The ECU 10 shown in FIG. 1 includes a microcomputer (microcomputer 20) and a monitoring IC 30, which is an integrated circuit for monitoring. The microcomputer 20 has a first core 21 , a second core 22 , a shared RAM 23 , an interrupt controller 24 and a timer 25 .

The first core 21 and the second core 22 are collectively referred to as both cores in this specification. Each of the cores is a processor core called CPU. A shared RAM 23 is a memory connected to each of the cores via a bus and shared by the cores. This memory is a non-transitional and tangible storage medium that non-temporarily stores "programs and/or data" readable by a processor. A storage medium is provided by a semiconductor memory. The program may be distributed alone or as a storage medium storing the program.

Of the plurality of control processes for controlling one controlled object, some control processes are assigned to the first core 21 and some other control processes are assigned to the second core 22 . For example, the ECU 10 according to the present embodiment is mounted on a vehicle, and objects to be controlled are an actuator mounted on the vehicle and a drive circuit that outputs a drive signal to the actuator. This vehicle is equipped with an internal combustion engine. An internal combustion engine burns fuel injected from a fuel injection valve, thereby functioning as a drive source for a vehicle. As an example of the drive circuit, there is a drive circuit that supplies electric power to an actuator provided in the fuel injection valve to drive the actuator. This drive circuit has a booster circuit that boosts the battery voltage to generate a boost voltage, a switching circuit that switches between the battery voltage and the boost voltage to supply power, and the like.

The ECU 10 outputs on/off signals to various switching elements of the booster circuit and various switching elements of the switching circuit. For example, in the example of FIG. 2, when the microcomputer 20 executes the pulse-on process P10 and interrupt processes IP1 and IP2, an on/off signal is output to the booster circuit according to these processes. The booster circuit operates according to these on/off signals to drive the actuator so as to inject fuel from the fuel injection valve at a desired timing.

The pulse-on process P10 illustrated in FIG. 2 starts outputting a pulse-on signal to one of the plurality of switch elements at the standby start time t1, which is a scheduled time. For example, the pulse-on period t1 to t3 corresponds to a period for instructing fuel injection. In the example of FIG. 2, the pulse-on process P10 is executed by the first core 21. FIG. The first interrupt process IP1 is a process executed by the first core 21, and the second interrupt process IP2 is a process executed by the second core 22. FIG.

The interrupt controller 24 allocates which of the two cores is to execute these interrupt processes. Further, the interrupt controller 24 controls the timing of instructing both cores to process these interrupts. In the example of FIG. 2, the interrupt controller 24 executes two interrupt processes IP1 and IP2 simultaneously to both cores at the scheduled time t2, which is slightly delayed from the output start time of the pulse-on signal (standby start time t1). commanding to The reason why the scheduled time t2 is slightly behind the standby start time t1 is due to physical limitations of the interrupt controller 24 and the like.

Each of the two cores executes the instructed interrupt processing by using the reception of the interrupt processing command from the interrupt controller 24 as a trigger (interrupt trigger). In the normal case, both cores execute the interrupt process with priority over the process being executed at the timing of receiving the interrupt trigger (scheduled time t2). However, if the process being executed has a higher priority than the interrupt process, or if the process being executed is a process for which interrupts are prohibited, wait until the process being executed ends before Both cores execute interrupt processing.

In the example of FIG. 2, the first interrupt process IP1 is started by the first core 21 at a timing (wake-up time ta) delayed from the timing of the interrupt trigger (scheduled time t2). The time from the standby start time t1 to the wake-up time ta, that is, the standby time required until the first interrupt process IP1 is executed corresponds to the first required time T10. Similarly, the second interrupt process IP2 is started by the second core 22 at a timing (wake-up time tb) delayed from the timing of the interrupt trigger (scheduled time t2). The time from the standby start time t1 to the wake-up time tb, that is, the standby time required until the second interrupt process IP2 is executed corresponds to the second required time T20.

Either one of the two cores executes a diagnostic process P20, which is one of the control processes, after both the two interrupt processes IP1 and IP2 have been executed. In the example of FIG. 2, the first core 21 executes the diagnostic process P20 immediately after the completion of the first interrupt process IP1.

The diagnosis process P20 diagnoses an abnormal state when at least one of the first required time T10 and the second required time T20 is longer than the reference time Tth (see FIG. 2). This abnormal state means an abnormal state in which the interrupt controller 24 does not normally issue an interrupt processing command to both cores. When an abnormal state is diagnosed, the microcomputer 20 sets an abnormal flag to ON.

Specific examples of the abnormal state include failure of the interrupt controller 24, disconnection of wiring connecting the interrupt controller 24 and both cores, memory sticking, and the like. When these abnormalities occur, interrupt processing commands to both cores may be delayed or may not be commanded. As a result, the interrupt processes IP1 and IP2 may or may not wake up later than the timing at which they should originally wake up. Then, the required times T10 and T20 become longer than the reference time Tth, and an abnormal state is diagnosed.

The reference time Tth is individually set for each of both cores. Note that the reference times Tth of both cores may be set to the same value. Also, the reference time Tth is not fixed at one value, but is variably set in the diagnostic process P20. For example, as shown in FIG. 3, when the first core 21 is executing another process P11, which is one of the control processes, at the scheduled time t2, the reference time Tth is set longer than in the case shown in FIG. In this case, both the reference time Tth for the first core 21 and the reference time Tth for the second core 22 may be lengthened. Alternatively, the reference time Tth of the target first core 21 may be lengthened while the reference time Tth of the second core 22 may be set in the same manner as in FIG.

Also, in order to suppress erroneous diagnosis, the setting of the reference time Tth is changed as in (1) to (4) below. However, it is desirable to set an upper limit time and a lower limit time for the width of the setting change.

(1) The reference time Tth is changed to a longer value as the priority of the interrupt process to the control process is lower. This is because the lower the priority, the longer the required times T10 and T20 even in a normal state.

(2) The higher the processing load of the first core 21 is, the longer the reference time Tth with respect to the first required time T10 is set. Similarly, the higher the processing load of the second core 22, the longer the reference time Tth with respect to the second required time T20. For example, input information to the microcomputer 20 and abnormal/normal judgment results are learned (accumulated) in association with each other, and fed back to change the setting of the reference time Tth. Specific examples of input information include engine speed, accelerator opening, and temperature. For example, when the engine speed is high, the processing load on the microcomputer 20 is high, so the reference time Tth is set long.

(3) When it is determined that there is an abnormality, the reference time Tth used in the next determination is changed to a longer value than the reference time Tth used this time. In addition, when it is determined to be normal, the setting of the reference time Tth used in the next determination may be changed to a value shorter than the reference time Tth used this time. Moreover, when it is determined to be normal, the ON setting of the abnormality flag due to the previous determination of abnormality may be changed to the OFF setting.

(4) Once it is determined that there is an abnormality, by resetting the reference time Tth, it is determined whether or not an abnormality has actually occurred. Then, if an abnormality is determined even at the reset reference time Tth, the abnormality flag is set to ON. In this resetting, the reference time Tth may be set long or short.

Note that when it is determined that an abnormal state exists, the priority of the interrupt processes IP1 and IP2 with respect to the control process is changed to be higher. For example, after the other process P11 of FIG. 3 is executed, the chance that another other process is executed with priority over the diagnosis process P20 is reduced.

FIG. 4 is a flow chart showing a process for acquiring data necessary for the diagnostic process P20 and a procedure of the diagnostic process, which the first core 21 executes at a predetermined calculation cycle.

First, in steps S11, S12, and S13 in FIG. 4, the pulse-on process P10 described above is executed. In step S11, the standby start time t1, which is the time to turn on the output pulse, is calculated. In subsequent step S12, the standby start time t1 calculated in step S11 is stored in the shared RAM 23. FIG. In the subsequent step S13, the timer 25 is set to the standby start time t1.

In the next step S20, it is determined whether or not the elapsed time of the timer set in step S13 is equal to or longer than the waiting start time t1. When it is determined that the standby start time t1 has been reached, the wake-up time ta of the first interrupt process IP1 is acquired from the timer 25 (step S31). Then, while storing the obtained wake-up time ta in the shared RAM 23 (step S32), the first interrupt process IP1 is executed.

It should be noted that the second core 22 also executes steps S31, S32, and S33 in the same manner as the first core 21 does. That is, when it is determined that the standby start time t1 has been reached, the second core 22 acquires the wake-up time tb of the second interrupt process IP2 from the timer 25 (step S31). Then, while storing the obtained wake-up time tb in the shared RAM 23 (step S32), the second interrupt process IP2 is executed.

In the next step S40, the diagnostic process P20 described above is executed according to the procedure shown in FIG. First, in step S41 of FIG. 5, the standby start time t1 and wake-up times ta and tb stored in the shared RAM 23 are acquired. Also, the value of the reference time Tth set by another process (not shown) is acquired.

In the next step S42, the first required time T10 is calculated from the acquired wake-up time ta and standby start time t1. Then, it is determined whether or not the calculated first required time T10 is greater than or equal to the reference time Tth obtained in step S41. If an affirmative determination is made that T10≧Tth, then in step S44 it is determined that the aforementioned abnormal state exists.

If a negative determination is made that T10≧Tth, it is determined in step S43 whether or not the calculated second required time T20 is equal to or greater than the reference time Tth acquired in step S41. If an affirmative determination is made that T20≧Tth, then in step S44 it is determined that the above-described abnormal state has occurred.

It should be noted that the microcomputer 20 executing the process of step S41 corresponds to the "acquisition unit" that acquires the first required time T10 and the second required time T20. The microcomputer 20 during the processes of steps S42, S43, and S44 determines that an abnormal state exists when at least one of the first required time T10 and the second required time T20 is longer than the reference time Tth. It corresponds to the "judgment part". In other words, the diagnosis processing P20 includes processing by the acquisition unit and processing by the determination unit.

As described above, according to the ECU 10, the required times T10 and T20 from the start of standby of the interrupt processes IP1 and IP2 in the interrupt controller 24 to wake-up are acquired. Then, when at least one of the acquired required times T10 and T20 is longer than the reference time Tth, it is determined that the abnormal state has occurred. Therefore, when an abnormality occurs such that the interrupt processes IP1 and IP2 are not normally instructed to both cores from the interrupt controller 24, the required times T10 and T20 become longer than the reference time Tth, and it is determined as an abnormal state. . In other words, the ECU 10 can diagnose an abnormality such as an interrupt process not being normally commanded from the interrupt controller 24 .

A change in the setting of the reference time Tth will be described below.

In the ECU 10, the setting of the reference time Tth is changed to a longer value as the priority of the interrupt process to the control process is lower. For example, if the priority of the interrupt process is low after the other process P11 of FIG. 3 is completed, there is a high possibility that another process will be executed before the interrupt process. In that case, the first required time T10 becomes long even though the state is normal, and there is a concern that the state may be diagnosed as abnormal. In view of this point, if the reference time Tth used for determining the first required time T10 is set to a longer value as the priority is lower, the above concerns can be suppressed. Therefore, according to this embodiment, erroneous diagnosis of an abnormal state can be reduced.

Further, in the ECU 10, the higher the processing load of the first core 21 or the second core 22 is, the longer the reference time Tth is set. Therefore, it is possible to suppress the concern that the required times T10 and T20 will be long even though the state is normal and that the state will be misdiagnosed as an abnormal state, and the accuracy of the abnormality diagnosis can be improved.

Further, in the ECU 10, when it is determined that there is an abnormality, the reference time Tth used in the next determination is changed to a longer value than the reference time Tth used this time. According to this, even if the required times T10 and T20 become long due to a temporary increase in the processing load and an abnormality is determined, it is possible to immediately switch to a normal determination.

Further, in the ECU 10, when an abnormal state is determined, the priority of the interrupt processes IP1 and IP2 with respect to the control process is changed to be higher. According to this, even if the required times T10 and T20 become long due to the large number of control processes that are executed with priority over the interrupt processes IP1 and IP2 and an abnormality is determined, the normal determination is immediately made. can be switched to

(Second embodiment)
In the above-described first embodiment, the diagnostic process P20 is executed by either one of the two cores. In contrast, in the present embodiment, the core that executes the diagnostic process P20 is not limited to a specific core, and it is possible to sequentially change which of the two cores executes the diagnostic process.

Then, in the ECU 10 according to the present embodiment, the diagnostic process P20 is executed by the core with the smaller processing load among the two cores. For example, when the second core 22 has a smaller processing load than the first core 21 as shown in FIG. 6, the second core 22 executes the diagnosis process P20. Therefore, the diagnostic process P20 can be completed quickly, and an abnormal state can be quickly detected. In addition, equalization of the processing load balance of both cores is promoted. The diagnostic process P20 in the second core 22 is started after the first interrupt process IP1 ends. The reason is that after the first interrupt process IP1 ends, it is determined whether or not another high-priority process is executed. If it is determined to be executed, the diagnostic process P20 is transferred to another core (second core 22).

(Third Embodiment)
In the above-described first embodiment, the first command time (scheduled time t2) at which the first core 21 is commanded to perform the first interrupt processing IP1 and the second command time at which the second core 22 is commanded to perform the second interrupt processing IP2 (scheduled time t2) is the same. A first standby start time (standby start time t1) at which the interrupt controller 24 starts waiting for the first interrupt process IP1 and a second standby time at which the interrupt controller 24 starts waiting for the second interrupt process IP2 The start time (standby start time t1) is the same. In other words, for the first interrupt process IP1 and the second interrupt process IP2 that have the same command time and standby start time, it is diagnosed whether there is an abnormality such as a longer required time or a process not starting up at a normal timing. do.

Based on this premise, in the present embodiment, when the difference between the first required time T10 and the second required time T20 when the abnormal state is determined is less than the lower limit, the reference used in the next determination The time Tth is changed to a value longer than the reference time Tth used this time. Even if an abnormal state is determined, if the difference between the two times is small, there is a high probability that the abnormal state is determined due to the high processing loads of both cores. In view of this point, in the present embodiment, the setting of the reference time Tth is changed to a longer value as described above, so there is concern that the required times T10 and T20 will become longer even though the state is normal, resulting in an erroneous diagnosis of an abnormal state. can be suppressed.

Furthermore, in the present embodiment, when the difference between the first required time T10 and the second required time T20 is equal to or greater than the upper limit value, either the first required time T10 or the second required time T20 is shorter than the reference time Tth. However, it is diagnosed as being in an abnormal state. Even if the state is determined to be normal, if the difference between the two times is large, there is a high probability that the processing load is concentrated on one of the two cores, resulting in an abnormal state. In view of this point, in the present embodiment, as described above, if the difference between the two times is equal to or greater than the upper limit value, an abnormal state is diagnosed. Therefore, it is possible to suppress the possibility of misdiagnosis as a normal state due to the short required times T10 and T20 in spite of the abnormal state in which the processing load is biased.

(Other embodiments)
As described above, a plurality of embodiments of the present disclosure have been described. can be partially combined with each other. Also, unspecified combinations of configurations described in a plurality of embodiments and modifications are also disclosed by the following description.

In each of the above-described embodiments, the first interrupt process IP1 and the second interrupt process IP2, which have the same command time and standby start time, are diagnosed as to whether or not there is an abnormality that makes the required time longer. On the other hand, the first interrupt process IP1 and the second interrupt process IP2, which have different command times and standby start times, may be diagnosed for an abnormality that makes the required time longer.

Although the reference time Tth is variably set in each of the above embodiments, it may be fixed at a specific value.

In each of the above-described embodiments, if an event in which the required times T10 and T20 are greater than or equal to the reference time Tth is detected even once, an abnormal state is diagnosed. On the other hand, an abnormal state may be diagnosed on the condition that the above event is continuously detected a plurality of times or more.

The reference time Tth may be set to different values for the first required time T10 and the second required time T20, or may be set to the same value.

10 ECU (electronic control unit), 20 microcomputer (acquisition unit, determination unit), 21 first core, 22 second core, 24 interrupt controller, T10 first required time, T20 second required time, Tth reference time.

Claims (12)

a first core (21) to which a part of a plurality of control processes for controlling one controlled object is assigned and which executes the operation of the assigned processes;
a second core (22) to which another part of the plurality of control processes is assigned and which executes the operations of the assigned processes;
an interrupt controller (24) allocating interrupt processing different from the control processing to the first core and the second core;
A first required time (T10) from the start of waiting for the interrupt processing by the interrupt controller to the start of execution of the interrupt processing by the first core, and the above-mentioned an acquisition unit (20) for acquiring a second required time (T20) until the start of execution of the interrupt process by the second core;
A determination unit (20) that determines that an abnormal state occurs when at least one of the first required time and the second required time acquired by the acquisition unit is longer than a reference time (Tth) ,
Among the control processing, the processing of the acquisition unit and the determination unit are diagnostic processing,
The electronic control device, wherein the core that executes the diagnostic processing can be successively changed so that the diagnostic processing is executed by the core of the first core and the second core that has a smaller processing load. 2. The electronic control device according to claim 1 , wherein the higher the processing load of said first core or said second core, the longer said reference time is set. a first core (21) to which a part of a plurality of control processes for controlling one controlled object is assigned and which executes the operation of the assigned processes;
a second core (22) to which another part of the plurality of control processes is assigned and which executes the operations of the assigned processes;
an interrupt controller (24) allocating interrupt processing different from the control processing to the first core and the second core;
A first required time (T10) from the start of waiting for the interrupt processing by the interrupt controller to the start of execution of the interrupt processing by the first core, and the above-mentioned an acquisition unit (20) for acquiring a second required time (T20) until the start of execution of the interrupt process by the second core;
a determination unit (20) for determining an abnormal state when at least one of the first required time and the second required time acquired by the acquisition unit is longer than a reference time (Tth);
with
The electronic control device , wherein the higher the processing load of the first core or the second core, the longer the reference time is set . 4. The method according to any one of claims 1 to 3 , wherein, when said determination unit determines that said abnormal state exists, said reference time used in said next determination is changed to a value longer than said reference time used this time. An electronic control unit according to any one of the preceding claims. a first core (21) to which a part of a plurality of control processes for controlling one controlled object is assigned and which executes the operation of the assigned processes;
a second core (22) to which another part of the plurality of control processes is assigned and which executes the operations of the assigned processes;
an interrupt controller (24) allocating interrupt processing different from the control processing to the first core and the second core;
A first required time (T10) from the start of waiting for the interrupt processing by the interrupt controller to the start of execution of the interrupt processing by the first core, and the above-mentioned an acquisition unit (20) for acquiring a second required time (T20) until the start of execution of the interrupt process by the second core;
A determination unit (20) that determines that an abnormal state occurs when at least one of the first required time and the second required time acquired by the acquisition unit is longer than a reference time (Tth) ,
The electronic control device, wherein the reference time used in the next determination is changed to a longer value than the reference time used this time when the determination unit determines that the abnormal state exists. The electronic control device according to any one of claims 1 to 5, wherein when the abnormal state is determined, the priority of the interrupt process with respect to the control process is increased. a first core (21) to which a part of a plurality of control processes for controlling one controlled object is assigned and which executes the operation of the assigned processes;
a second core (22) to which another part of the plurality of control processes is assigned and which executes the operations of the assigned processes;
an interrupt controller (24) allocating interrupt processing different from the control processing to the first core and the second core;
A first required time (T10) from the start of waiting for the interrupt processing by the interrupt controller to the start of execution of the interrupt processing by the first core, and the above-mentioned an acquisition unit (20) for acquiring a second required time (T20) until the start of execution of the interrupt process by the second core;
A determination unit (20) that determines that an abnormal state occurs when at least one of the first required time and the second required time acquired by the acquisition unit is longer than a reference time (Tth) ,
The electronic control device , wherein the priority of the interrupt process with respect to the control process is increased when the abnormal state is determined . Of the interrupt processes, the process assigned to the first core is defined as a first interrupt process, and the process assigned to the second core is defined as a second interrupt process,
A time when the interrupt controller commands the first interrupt process to the first core as a first command time,
A time when the interrupt controller commands the second interrupt processing to the second core as a second command time,
The time at which the interrupt controller starts waiting for the first interrupt process is defined as a first waiting start time,
setting the time at which the interrupt controller starts waiting for the second interrupt process as a second waiting start time;
The obtaining unit obtains the first interrupt process and the second interrupt process in which the first command time and the second command time are the same, and the first standby start time and the second standby start time are the same. The electronic control device according to any one of claims 1 to 7 , wherein the first required time and the second required time are acquired for processing. a first core (21) to which a part of a plurality of control processes for controlling one controlled object is assigned and which executes the operation of the assigned processes;
a second core (22) to which another part of the plurality of control processes is assigned and which executes the operations of the assigned processes;
an interrupt controller (24) allocating interrupt processing different from the control processing to the first core and the second core;
A first required time (T10) from the start of waiting for the interrupt processing by the interrupt controller to the start of execution of the interrupt processing by the first core, and the above-mentioned an acquisition unit (20) for acquiring a second required time (T20) until the start of execution of the interrupt process by the second core;
A determination unit (20) that determines that an abnormal state occurs when at least one of the first required time and the second required time acquired by the acquisition unit is longer than a reference time (Tth) ,
Of the interrupt processes, the process assigned to the first core is defined as a first interrupt process, and the process assigned to the second core is defined as a second interrupt process,
A time when the interrupt controller commands the first interrupt process to the first core as a first command time,
A time when the interrupt controller commands the second interrupt processing to the second core as a second command time,
The time at which the interrupt controller starts waiting for the first interrupt process is defined as a first waiting start time,
setting the time at which the interrupt controller starts waiting for the second interrupt process as a second waiting start time;
The obtaining unit obtains the first interrupt process and the second interrupt process in which the first command time and the second command time are the same, and the first standby start time and the second standby start time are the same. An electronic control unit that acquires the first required time and the second required time for a process . When the difference between the first required time and the second required time when the abnormal state is determined is less than the lower limit value, the reference time used in the next determination is the reference used this time. 10. The electronic control unit according to claim 8 or 9 , wherein the setting is changed to a value longer than time. When the difference between the first required time and the second required time is equal to or greater than the upper limit value, even if the first required time or the second required time is shorter than the reference time, the determination unit The electronic control device according to any one of claims 8 to 10 , wherein it is determined that is in an abnormal state. The electronic control device according to any one of claims 1 to 11 , wherein the lower the priority of said interrupt process to said control process, the longer said reference time is set.

Images