JP7334552B2 - electronic controller - Google Patents

Description

The present disclosure relates to an electronic control device with multiple CPU cores.

2. Description of the Related Art In recent years, electronic control devices such as engine control devices have increasingly adopted multi-core microcomputers as a countermeasure against increasing processing loads.
In Patent Document 1, in an electronic control device comprising a master-side core and a slave-side core, when the master-side core detects an abnormality in the slave-side core, processing to be executed by the slave-side core is performed on behalf of the master-side core. is described.

JP 2009-274569 A

However, with the technique described in Patent Document 1, if the master core simply substitutes for the processing of the slave core, the master core must execute processing of other cores in addition to the original processing. Otherwise, the processing capacity of the master core may be exceeded.

Regarding this point, Patent Literature 1 describes that the master-side core executes the processing to be executed by the slave-side core in a low-load manner. However, the load status of the electronic control system can be high or low depending on the operating status of the system. Therefore, in a situation where the master core cannot execute all the processing of the slave core, the master core can take over all the processing of the slave core, or conversely, the master core can execute all the processing of the slave core. In this case, the master-side core intentionally takes over the processing of the slave-side core with a low load, which may deteriorate the control performance.

An object of the present disclosure is to improve control performance when an abnormality occurs.

One aspect of the present disclosure is a plurality of CPU cores (11, 12, 13, 14), a program designation storage unit (15), a core designation storage unit (40), an interrupt control unit (19), an abnormal An electronic control device (1) comprising a determination section (18, 33), a substitute storage section (15), and a change section (S210 to S260, S310 to S360, S510 to S580, S610 to S680).

The program designation storage unit is configured to store program designation information (VT1, VT2) designating a program to be executed by each of the plurality of CPU cores for each of the plurality of interrupt factors.

The core designation storage unit is configured to store core designation information designating a CPU core that generates an interrupt due to an interrupt factor for each of a plurality of interrupt factors.
The interrupt control unit is configured to, when an interrupt factor occurs, generate an interrupt to the CPU core corresponding to the generated interrupt factor based on the core designation information stored in the core designation storage unit. be.

The abnormality determination unit is configured to determine whether or not an abnormality has occurred in the abnormality determination target core (11), with at least one CPU core set in advance among the plurality of CPU cores as the abnormality determination target core (11). be.

The proxy storage unit stores a plurality of pieces of proxy information (ST1, ST2, ST11, ST12, ST13).

The change unit is configured to change the core designation information based on the substitute information stored in the substitute storage unit when the abnormality determination unit determines that an abnormality has occurred in the abnormality determination target core. .

In the electronic control device of the present disclosure configured as described above, when an interrupt factor occurs, the interrupt control unit generates an interrupt to the CPU core corresponding to the generated interrupt factor based on the core designation information. Let Thereby, in the electronic control device of the present disclosure, the CPU core corresponding to the interrupt factor executes the program corresponding to the interrupt factor based on the program designation information.

Then, in the electronic control device of the present disclosure, the change unit changes the core designation information based on the proxy information when an abnormality occurs in the abnormality determination target core. As a result, when an abnormality occurs in the abnormality determination target core, the electronic control device of the present disclosure can cause the substitute core to execute the program that the abnormality determination target core was executing when the interrupt factor occurred. can. Therefore, in the electronic control device of the present disclosure, when an abnormality occurs in the abnormality determination target core, the alternate core can execute the program on behalf of the core.

Then, the electronic control device of the present disclosure stores a plurality of substitute information that designates a substitute core for each interrupt factor when an abnormality occurs in the abnormality determination target core. For this reason, the electronic control device of the present disclosure presets a plurality of pieces of proxy information according to the operational status of the electronic control device, thereby allowing the proxy core to appropriately execute the proxy according to the operational status of the electronic control device. be able to. As a result, the electronic control device of the present disclosure can improve control performance when an abnormality occurs.

3 is a block diagram showing the configuration of an ECU; FIG. 3 is a diagram showing the configuration of a first CPU core and an interrupt controller; FIG. It is a figure which shows the structure of the vector table of 1st Embodiment. FIG. 10 is a diagram showing configurations of a low load selection table and a high load selection table; 4 is a flow chart showing an idle task; 4 is a flow chart showing a 10 ms task; 4 is a flowchart showing error processing according to the first embodiment; 4 is a flowchart showing table switching processing according to the first embodiment; It is a figure which shows the structure of the vector table of 2nd Embodiment. FIG. 10 is a diagram showing configurations of a low load selection table and first and second high load selection tables; 9 is a flowchart showing error processing according to the second embodiment; 10 is a flowchart showing table switching processing according to the second embodiment;

[First embodiment]
A first embodiment of the present disclosure will be described below with reference to the drawings.
An electronic control unit 1 (hereinafter referred to as ECU 1) of the present embodiment is mounted on a vehicle and includes a microcomputer 2 (hereinafter referred to as microcomputer 2), an input circuit 3, and an output circuit 4, as shown in FIG. ECU is an abbreviation for Electronic Control Unit.

A crank angle signal from a crank angle sensor 51, a cam angle signal from a cam angle sensor 52, and a throttle opening signal from a throttle opening sensor 53 are input to the microcomputer 2 through an input circuit 3. .

A crank angle sensor 51 outputs a crank angle signal according to the rotation of the crankshaft of the engine. A cam angle sensor 52 outputs a cam angle signal according to the rotation of the camshaft of the engine. A throttle opening sensor 53 detects the opening of a throttle valve that adjusts the amount of air supplied to the engine (hereinafter referred to as throttle opening), and outputs a throttle opening signal indicating the detection result.

The microcomputer 2 detects the state of the engine based on each of the above signals input through the input circuit 3 . Based on the state of the engine, the microcomputer 2 outputs control signals for controlling various actuators such as spark plugs 61 in each cylinder of the engine, injectors 62 in each cylinder, and a throttle motor 63 that changes the throttle opening. is output through the output circuit 4.

The throttle valve is configured to be rotatable about a rotating shaft. Rotational torque from the throttle motor 63 is transmitted to the rotating shaft via a reduction gear, opening and closing in the intake pipe, thereby adjusting the throttle opening. change.

A return spring is attached to the rotating shaft. This return spring biases the rotary shaft to a preset throttle opening (hereinafter referred to as an opener opening) so as to obtain an engine output that enables limp home travel. That is, even if power supply to the throttle motor 63 is stopped and rotational torque is no longer transmitted to the rotating shaft, the throttle valve is maintained at the opener opening, thereby providing an intake air amount necessary for limp home running. is ensured.

The microcomputer 2 includes a first CPU core 11, a second CPU core 12, a third CPU core 13, a fourth CPU core 14, a ROM 15, a RAM 16, an input/output unit 17, an error management device 18, and an interrupt controller 19. , and a bus 20 . Hereinafter, the first CPU core 11, the second CPU core 12, the third CPU core 13 and the fourth CPU core 14 are collectively referred to as the CPU cores 11-14.

Various functions of the microcomputer are realized by the CPU cores 11 to 14 executing programs stored in non-transitional physical recording media. In this example, the ROM 15 corresponds to a non-transitional substantive recording medium storing programs. Also, by executing this program, a method corresponding to the program is executed. Part or all of the functions executed by the CPU cores 11 to 14 may be configured as hardware using one or a plurality of ICs or the like. Further, the number of microcomputers constituting the ECU 1 may be one or more.

The first CPU core 11, the second CPU core 12, the third CPU core 13, and the fourth CPU core 14 distribute and execute various control processes for controlling the engine mounted on the vehicle.

The ROM 15 is a non-volatile memory and stores programs for executing various control processes for controlling the engine.
The RAM 16 is a volatile memory, and temporarily stores calculation results and the like of the CPU cores 11-14.

The input/output unit 17 is a circuit for inputting/outputting data between the outside of the microcomputer 2 and the CPU cores 11-14.
The error management device 18 is a device that detects an abnormality in the first CPU core 11 .

The interrupt controller 19 receives interrupt request signals indicating the occurrence of various interrupt factors, and determines the priority based on the priority set in advance for each interrupt factor corresponding to the input interrupt request signal. An interrupt signal corresponding to the highest interrupt factor is output to the CPU cores 11-14.

The bus 20 connects the CPU cores 11 to 14, the ROM 15, the RAM 16, the input/output unit 17, the error management device 18 and the interrupt controller 19 so that data can be input/output to each other.
As shown in FIG. 2 , the first CPU core 11 includes a master core 31 , a checker core 32 and a lockstep comparator 33 .

The master core 31 and the checker core 32 have arithmetic units, registers, and the like for executing programs. Then, the master core 31 and the checker core 32 execute the same computation in parallel and output the computation result to the lockstep comparator 33 .

The lockstep comparator 33 compares the calculation result from the master core 31 and the calculation result from the checker core 32 and outputs comparison result information indicating whether the calculation results match or not to the error management device 18 .

When the error management device 18 acquires the comparison result information from the lockstep comparator 33, the error management device 18 determines whether or not the calculation results match based on the comparison result information. If the calculation results do not match, the error management device 18 determines that an error has occurred in the first CPU core 11 and outputs lockstep error information to the interrupt controller 19 .

The interrupt controller 19 has a request control register 40 . The request control register 40 comprises n interrupt cause fields 40_1, 40_2, 40_3, 40_4, 40_5, . . . , 40_n. n is a positive integer.

A different interrupt factor is set in each of the plurality of interrupt factor fields 40_i. In this embodiment, the interrupt factor field 40_1 corresponds to the lockstep error of the first CPU core 11 . The interrupt factor field 40_2 corresponds to the input of the crank angle signal. The interrupt factor field 40_3 corresponds to the input of the cam angle signal. The interrupt cause field 40_4 corresponds to timer interrupt. The interrupt cause field 40_5 corresponds to an external request interrupt.

The interrupt factor field 40_i is composed of 3 bits, and 1 or 0 is stored in each bit. i is an integer from 1 to n. The value stored in the interrupt cause field 40_i designates a CPU core that executes processing in response to the occurrence of the interrupt cause. In this embodiment, when the value stored in the interrupt factor field 40_i is 0x000, the first CPU core 11 is designated. Similarly, when the values stored in the interrupt cause field 40_i are 0x001, 0x010, and 0x011, the second CPU core 12, third CPU core 13, and fourth CPU core 14 are designated, respectively.

FIG. 2 shows the values stored in the interrupt cause field 40_i during normal times when no lockstep error occurs.
In FIG. 2, 0x001 is stored in the interrupt cause field 40_1. Therefore, when a lockstep error occurs in the first CPU core 11, the second CPU core 12 executes processing corresponding to the lockstep error.

Also, 0x000 is stored in the interrupt factor field 40_2. Therefore, when a crank angle signal is input during normal operation, the first CPU core 11 executes processing corresponding to the input of the crank angle signal. Also, 0x000 is stored in the interrupt factor field 40_3. Therefore, when a cam angle signal is input in normal times, the first CPU core 11 executes processing corresponding to the input of the cam angle signal. Specifically, the first CPU core 11 identifies the crank position by crank interrupt and cam interrupt, drives the injector 62 at a predetermined crank position to inject fuel, and controls the ignition plug 61 at a predetermined crank position. is energized and ignited.

Also, 0x001 is stored in the interrupt cause field 40_4. Therefore, when a timer interrupt occurs during normal operation, the second CPU core 12 executes processing corresponding to the timer interrupt. Specifically, the second CPU core 12 controls the energization of the throttle motor 63 so that the throttle valve opens at a desired opening, for example, by a timer interrupt that occurs every 2 ms.

Also, 0x000 is stored in the interrupt cause field 40_5. Therefore, when an external request interrupt occurs during normal operation, the first CPU core 11 executes processing corresponding to the external request interrupt.

The ROM 15 stores a vector table VT1 as shown in FIG. The vector table VT1 specifies control programs to be executed by the CPU cores 11 to 14 for each of multiple interrupt factors.

In this embodiment, when the interrupt factor is the input of the crank angle signal, the ignition/injection control program is specified for the first CPU core 11 and the second CPU core 12 . Further, when the interrupt factor is the input of the cam angle signal, the ignition/injection control program is specified for the first CPU core 11 and the second CPU core 12 . Further, when the interrupt factor is a timer interrupt, an electronic throttle control program is specified for the second CPU core 12 .

It should be noted that the programs enclosed by the dashed rectangles RC1, RC2, and RC3 are executed normally when no lockstep error occurs. That is, normally, the first CPU core 11 executes the ignition/injection control program, and the second CPU core 12 executes the electronic throttle control program.

As shown in FIG. 4, the ROM 15 stores a low load selection table ST1 and a high load selection table ST2.
The low load selection table ST1 and the high load selection table ST2 designate CPU cores that execute programs for each of a plurality of interrupt factors.

In the low load selection table ST1 of this embodiment, the second CPU core 12 is selected when the interrupt factor is the input of the crank angle signal. Further, when the interrupt factor is the input of the cam angle signal, the second CPU core 12 is selected. Also, when the interrupt factor is a timer interrupt, the second CPU core 12 is selected.

In the high load selection table ST2 of this embodiment, the second CPU core 12 is selected when the interrupt factor is the input of the crank angle signal. Further, when the interrupt factor is the input of the cam angle signal, the second CPU core 12 is selected. Also, if the interrupt factor is a timer interrupt, there is no CPU core to be selected.

Next, the idle task procedure executed by the CPU cores 12 to 14 will be described. An idle task is processing that is executed when the CPU cores 12 to 14 are not executing interrupt processing. That is, when the processing load of the CPU cores 12-14 is 100%, the idle tasks are not executed. In the following, the procedure of the idle task will be described using the second CPU core 12 as a representative example.

When the idle task is executed, the second CPU core 12, as shown in FIG. Store in counter Counter.

Then, in S20, the second CPU core 12 determines whether or not the value stored in the idle counter Counter exceeds the preset reset determination value J1. The reset determination value J1 is set to a value that the idle counter Counter reaches when the idle state continues for 1 ms.

Here, if the value stored in the idle counter Counter is equal to or less than the reset determination value J1, the second CPU core 12 proceeds to S10. On the other hand, if the value stored in the idle counter Counter exceeds the reset determination value J1, the second CPU core 12 stores 0 in the idle counter Counter in S30.

Further, in S40, the second CPU core 12 adds 1 to the value stored in the 1 millisecond counter 1ms_Counter provided in the RAM 16, stores the added value in the 1 millisecond counter 1ms_Counter, and terminates the idle task. .

Next, the procedure of the 10 ms task executed by the CPU cores 12-14 will be explained. A 10 ms task is a process that is executed every 10 ms. In the following, the procedure of the 10 ms task will be described using the second CPU core 12 as a representative.

When the 10ms task is executed, the second CPU core 12 first acquires the value stored in the 1ms counter 1ms_Counter in S110, as shown in FIG. Then, the second CPU core 12 stores the value calculated by the right side of the following equation (1) in the processing load CPU_Load provided in the RAM 16 in S120.

CPU_Load=(1−1ms_Counter/10)×100 (1)
Furthermore, in S130, the second CPU core 12 stores 0 in the 1 millisecond counter 1ms_Counter and terminates the 10 ms task.

Next, the procedure of error processing executed by the second CPU core 12 will be described. Error processing is processing that is started when an interrupt signal corresponding to a lockstep error is input from the interrupt controller 19 to the second CPU core 12 .

When error processing is executed, the second CPU core 12 first checks the value stored in the processing load CPU_Load of the second CPU core 12 in S210, as shown in FIG.
Then, in S220, the second CPU core 12 determines whether or not the value stored in the processing load CPU_Load of the second CPU core 12 is less than the preset high load determination value J2.

Here, if the value stored in the processing load CPU_Load of the second CPU core 12 is less than the high load determination value J2, the second CPU core 12 refers to the low load selection table ST1 in S230, Move to S250. On the other hand, if the value stored in the processing load CPU_Load of the second CPU core 12 is greater than or equal to the high load determination value J2, the second CPU core 12 refers to the high load selection table ST2 in S240, transition to

After shifting to S250, the second CPU core 12 changes the request control register 40 of the interrupt controller 19 in S250.
Specifically, when referring to the low load selection table ST1, the second CPU core 12 sets at least the values of the interrupt factor fields 40_2, 40_3, and 40_4 to 0x001. As a result, the ignition/injection control program and the electronic throttle control program are executed by the second CPU core 12 . On the other hand, when referring to the high load selection table ST2, the second CPU core 12 sets at least the values of the interrupt factor fields 40_2 and 40_3 to 0x001, and sets the value of the interrupt factor field 40_4 to 0x100. As a result, the ignition/injection control program is executed by the second CPU core 12, and the electronic throttle control program is not executed by any of the CPU cores 11-14.

Then, in S260, the second CPU core 12 sets the core abnormality flag F1 provided in the RAM 16, and terminates the error processing. In the following description, setting a flag means setting the value of the flag to 1, and clearing the flag means setting the value of the flag to 0.

Next, a procedure of table switching processing executed by the second CPU core 12 will be described. The table switching process is a process executed every 10 ms while the second CPU core 12 is operating.

When the table switching process is executed, the second CPU core 12 first determines in S310 whether or not the core abnormality flag F1 is set, as shown in FIG. Here, when the core abnormality flag F1 is cleared, the second CPU core 12 ends the table switching process.

On the other hand, if the core abnormality flag F1 is set, the second CPU core 12 checks the value stored in the processing load CPU_Load of the second CPU core 12 in S320 in the same manner as in S210.

Then, in S330, the second CPU core 12 determines whether or not the value stored in the processing load CPU_Load of the second CPU core 12 is less than the high load determination value J2 in the same manner as in S220.

Here, if the value stored in the processing load CPU_Load of the second CPU core 12 is less than the high load determination value J2, the second CPU core 12, in S340, similarly to S230, selects the low load selection table Referring to ST1, the process proceeds to S360. On the other hand, if the value stored in the processing load CPU_Load of the second CPU core 12 is equal to or greater than the high load judgment value J2, the second CPU core 12, in S350, similarly to S240, selects the high load selection table ST2. , and the process proceeds to S360.

After proceeding to S360, the second CPU core 12 changes the request control register 40 of the interrupt controller 19 in the same manner as in S250, and ends the table switching process.
The ECU 1 configured as described above includes CPU cores 11 to 14 , a ROM 15 , a request control register 40 , an interrupt controller 19 , an error management device 18 and a lockstep comparator 33 .

The ROM 15 stores a vector table VT1 specifying programs to be executed by each of the CPU cores 11 to 14 for each of a plurality of interrupt factors.
The request control register 40 stores core designation information (ie, 0x000, 0x001, 0x010, 0x011, 0x100) that designates the CPU cores 11 to 14 that generate an interrupt due to the interrupt factor for each of a plurality of interrupt factors. Stored in interrupt factor fields 40_1, 40_2, 40_3, 40_4, 40_5, . . . , 40_n.

When an interrupt factor occurs, the interrupt controller 19 generates an interrupt to the CPU cores 11 to 14 corresponding to the interrupt factor, based on the core designation information stored in the request control register 40 .

The error management device 18 and the lockstep comparator 33 determine whether or not an abnormality has occurred in the abnormality determination target core, with the first CPU core 11 among the CPU cores 11 to 14 as the abnormality determination target core.

The ROM 15 stores a low load selection table ST1 and a high load selection table for specifying, for each interrupt factor, a core (substitute core) that executes a program in place of an abnormality determination target core when an abnormality occurs in the abnormality determination target core. Store ST2.

When the error management device 18 determines that an abnormality has occurred in the abnormality determination target core, the second CPU core 12 performs the request based on the low load selection table ST1 and the high load selection table ST2 stored in the ROM 15. The core designation information stored in the control register 40 is changed.

Thus, in the ECU 1, when an interrupt factor occurs, the interrupt controller 19 generates an interrupt to the CPU cores 11 to 14 corresponding to the interrupt factor, based on the core designation information. As a result, in the ECU 1, the CPU cores 11 to 14 corresponding to the interrupt factor execute a program corresponding to the interrupt factor based on the vector table VT1.

In the ECU 1, the second CPU core 12 changes the core designation information based on the low load selection table ST1 and the high load selection table ST2 when an abnormality occurs in the abnormality determination target core. Accordingly, when an abnormality occurs in the abnormality determination target core, the ECU 1 can cause the substitute core to execute the program that the abnormality determination target core was executing when the interrupt factor occurred. Therefore, when an abnormality occurs in the abnormality determination target core, the ECU 1 can cause the substitute core to execute the program on behalf of the abnormality determination target core.

The ECU 1 stores a low load selection table ST1 and a high load selection table ST2 for designating a substitute core for each interrupt factor when an abnormality occurs in the abnormality determination target core. Therefore, the ECU 1 presets the low load selection table ST1 and the high load selection table ST2 according to the operational status of the ECU 1, so that the substitute core can appropriately execute the substitution according to the operational status of the ECU 1. can. As a result, the ECU 1 can improve control performance when an abnormality occurs.

Also, the CPU cores 12 to 14 measure the processing loads of the CPU cores 12 to 14, respectively. The ROM 15 stores a low load selection table ST1 corresponding to a case where the processing load of the second CPU core 12 is low and a high load selection table ST2 corresponding to a case where the processing load of the second CPU core 12 is high. The second CPU core 12 selects the low load selection table ST1 or the high load selection table ST2 corresponding to the measured processing load of the second CPU core 12, and based on the selected low load selection table ST1 or high load selection table ST2, , to change the core specification information. Thereby, the ECU 1 can change the substitute core according to the processing load of the second CPU core 12, and can improve the control performance when an abnormality occurs.

Moreover, ECU1 is mounted in the vehicle. The vector table VT1 and the core designation information are set so that the abnormality determination core controls the spark plug 61 and the injector 62 when the error management device 18 determines that no abnormality has occurred in the abnormality determination core. is set. As a result, the ECU 1 can continue to control the spark plug 61 and the injector 62 with the substitute core even when an abnormality occurs in the abnormality determination target core.

Further, the throttle valve for adjusting the amount of air supplied to the engine of the vehicle is such that when the power supply to the throttle motor 63 for driving the throttle valve is stopped, the opening of the throttle valve is adjusted so that the vehicle can limp home. It is configured to have a certain preset opener opening.

The vector table VT1 and the low load selection table ST1 or the high load selection table ST2 indicate that the second CPU core 12 controls the throttle motor 63 and the second CPU core 12 does not control the throttle motor 63 when the high load condition is satisfied. The high load condition of this embodiment is that the processing load of the second CPU core 12 is equal to or higher than the high load determination value J2.

Therefore, due to the occurrence of an abnormality in the first CPU core 11, when the second CPU core 12 takes over control of the ignition plug 61 and the injector 62 and controls the throttle motor 63, the processing load of the second CPU core 12 is reduced. becomes equal to or higher than the high load judgment value J2, the second CPU core 12 stops controlling the throttle motor 63. FIG.

When the second CPU core 12 stops controlling the throttle motor 63, power supply to the throttle motor 63 stops. As a result, the opening degree of the throttle valve becomes the preset opener opening degree at which the vehicle can limp home. Therefore, the ECU 1 can ensure the minimum necessary engine output for running the vehicle when an abnormality occurs in the first CPU core 11 . After that, when the processing load of the second CPU core 12 becomes less than the high load determination value J2, the ECU 1 restarts the control of the throttle motor 63 by the second CPU core 12, so that the vehicle can be returned to the normal driving state. .

In the embodiment described above, the ECU 1 corresponds to the electronic control unit, the ROM 15 corresponds to the program designation storage section, the request control register 40 corresponds to the core designation storage section, and the interrupt controller 19 corresponds to the interrupt control section. do.

Further, the error management device 18 and the lockstep comparator 33 correspond to an abnormality determination section, the ROM 15 corresponds to a substitute storage section, and S210 to S260 and S310 to S360 correspond to processing as a change section.

Further, the vector table VT1 corresponds to program designation information, the low load selection table ST1 and high load selection table ST2 correspond to a plurality of proxy information, and S10 to S40 and S110 to S130 correspond to processing as a load measuring unit. .

[Second embodiment]
A second embodiment of the present disclosure will be described below with reference to the drawings. In addition, in the second embodiment, portions different from the first embodiment will be described. The same code|symbol is attached|subjected about a common structure.

The ECU 1 of the second embodiment has the fourth CPU core 14 omitted, the vector table changed, the low load selection table and the high load selection table changed, and error processing and table switching processing. is different from the first embodiment.

Specifically, the ECU 1 of the second embodiment differs from the first embodiment in that it includes a vector table VT2 instead of the vector table VT1.
The vector table VT2, as shown in FIG. 9, designates control programs to be executed by the CPU cores 11 to 13 for each of multiple interrupt factors.

In this embodiment, when the interrupt factor is the input of the crank angle signal, the ignition/injection control program is specified for the first CPU core 11 and the second CPU core 12 . Further, when the interrupt factor is the input of the cam angle signal, the ignition/injection control program is specified for the first CPU core 11 and the second CPU core 12 . Further, when the interrupt factor is a timer interrupt, an electronic throttle control program is specified for the second CPU core 12 and the third CPU core 13 . When the interrupt factor is an external request interrupt, a program (hereinafter referred to as a external synchronization program) is specified.

It should be noted that the programs enclosed by dashed rectangles RC11, RC12, RC13, and RC14 are executed normally when no lockstep error occurs. That is, normally, the first CPU core 11 executes the ignition/injection control program and the external synchronization program, and the second CPU core 12 executes the electronic throttle control program.

Further, the ECU 1 of the second embodiment has a low load selection table ST11, a first high load selection table ST12 and a second high load selection table ST13 instead of the low load selection table ST1 and the high load selection table ST2. Differs from one embodiment.

As shown in FIG. 10, the low load selection table ST11, the first high load selection table ST12, and the second high load selection table ST13 designate CPU cores executing programs for each of a plurality of interrupt factors.

In the low load selection table ST11 of this embodiment, the second CPU core 12 is selected when the interrupt factor is the input of the crank angle signal. Further, when the interrupt factor is the input of the cam angle signal, the second CPU core 12 is selected. Also, when the interrupt factor is a timer interrupt, the second CPU core 12 is selected. Further, when the interrupt factor is an external request interrupt, the second CPU core 12 is selected.

In the first high load selection table ST12 of this embodiment, the second CPU core 12 is selected when the interrupt factor is the input of the crank angle signal. Further, when the interrupt factor is the input of the cam angle signal, the second CPU core 12 is selected. Further, when the interrupt factor is a timer interrupt, the third CPU core 13 is selected. Further, when the interrupt factor is an external request interrupt, the third CPU core 13 is selected.

In the second high load selection table ST13 of this embodiment, the second CPU core 12 is selected when the interrupt factor is the input of the crank angle signal. Further, when the interrupt factor is the input of the cam angle signal, the second CPU core 12 is selected. Further, when the interrupt factor is a timer interrupt, the third CPU core 13 is selected. Also, if the interrupt factor is an external request interrupt, there is no CPU core to be selected.

Next, the procedure of error processing according to the second embodiment will be described.
When the error processing of the second embodiment is executed, as shown in FIG. 13 and the value stored in the processing load CPU_Load.

Then, in S520, the second CPU core 12 determines whether or not the value stored in the processing load CPU_Load of the second CPU core 12 is less than the high load determination value J2.
Here, if the value stored in the processing load CPU_Load of the second CPU core 12 is less than the high load determination value J2, the second CPU core 12 refers to the low load selection table ST11 in S530, Go to S570. On the other hand, if the value stored in the processing load CPU_Load of the second CPU core 12 is equal to or greater than the high load determination value J2, the second CPU core 12 stores in the processing load CPU_Load of the third CPU core 13 in S540. It is determined whether or not the current value is less than the high load determination value J2.

Here, if the value stored in the processing load CPU_Load of the third CPU core 13 is less than the high load determination value J2, the second CPU core 12 refers to the first high load selection table ST12 in S550. Then, the process proceeds to S570. On the other hand, if the value stored in the processing load CPU_Load of the third CPU core 13 is equal to or greater than the high load determination value J2, the second CPU core 12 refers to the second high load selection table ST13 in S560. , S570.

After shifting to S<b>570 , the second CPU core 12 changes the request control register 40 of the interrupt controller 19 .
Specifically, when referring to the low load selection table ST11, the second CPU core 12 sets at least the values of the interrupt factor fields 40_2, 40_3, 40_4, and 40_5 to 0x001. As a result, the second CPU core 12 executes the ignition/injection control program, the electronic throttle control program, and the external synchronization program.

Further, when referring to the first high load selection table ST12, the second CPU core 12 sets at least the values of the interrupt factor fields 40_2 and 40_3 to 0x001 and the values of the interrupt factor fields 40_4 and 40_5 to 0x010. set to As a result, the second CPU core 12 executes the ignition/injection control program, and the third CPU core 13 executes the electronic throttle control program and the external synchronization program.

Further, when referring to the second high load selection table ST13, the third CPU core 13 sets at least the values of the interrupt factor fields 40_2 and 40_3 to 0x001, and sets the value of the interrupt factor field 40_4 to 0x010. and sets the value of the interrupt cause field 40_5 to 0x100. As a result, the ignition/injection control program is executed by the second CPU core 12, the electronic throttle control program is executed by the third CPU core 13, and the external synchronization program is not executed by any of the CPU cores 11-13.

Then, in S580, the second CPU core 12 sets the core abnormality flag F1 and terminates the error processing.
Next, a procedure for table switching processing according to the second embodiment will be described.

When the table switching process of the second embodiment is executed, the second CPU core 12 first determines in S610 whether or not the core abnormality flag F1 is set, as shown in FIG. Here, when the core abnormality flag F1 is cleared, the second CPU core 12 ends the table switching process.

On the other hand, if the core abnormality flag F1 is set, the second CPU core 12, in S620, similarly to S510, sets the value stored in the processing load CPU_Load of the second CPU core 12 and the third CPU core 13 to confirm.

Then, in S630, the second CPU core 12 determines whether or not the value stored in the processing load CPU_Load of the second CPU core 12 is less than the high load determination value J2 in the same manner as in S520.

Here, if the value stored in the processing load CPU_Load of the second CPU core 12 is less than the high load determination value J2, the second CPU core 12, in S640, similarly to S530, sets the low load selection table Referring to ST11, the process proceeds to S680. On the other hand, if the value stored in the processing load CPU_Load of the second CPU core 12 is equal to or greater than the high load determination value J2, the second CPU core 12, in S650, similarly to S540, It is determined whether or not the value stored in the processing load CPU_Load is less than the high load determination value J2.

Here, if the value stored in the processing load CPU_Load of the third CPU core 13 is less than the high load judgment value J2, the second CPU core 12 performs the first high load Referring to the selection table ST12, the process proceeds to S680. On the other hand, if the value stored in the processing load CPU_Load of the third CPU core 13 is equal to or greater than the high load determination value J2, the second CPU core 12 selects the second high load in S670 in the same manner as in S560. Referring to table ST13, the process proceeds to S680.

After proceeding to S680, the second CPU core 12 changes the request control register 40 of the interrupt controller 19 in the same manner as in S570, and terminates the table switching process.
The ECU 1 configured as described above includes CPU cores 11 to 13 , a ROM 15 , a request control register 40 , an interrupt controller 19 , an error management device 18 and a lockstep comparator 33 .

The ROM 15 stores a vector table VT2 specifying programs to be executed by each of the CPU cores 11 to 13 for each of a plurality of interrupt factors.
The request control register 40 stores core specification information specifying the CPU cores 11 to 13 that generate an interrupt due to the interrupt factor in interrupt factor fields 40_1, 40_2, 40_3, 40_4, and 40_5 for each of a plurality of interrupt factors. , . . . , 40_n.

When an interrupt factor occurs, the interrupt controller 19 generates an interrupt to the CPU cores 11 to 13 corresponding to the interrupt factor, based on the core designation information stored in the request control register 40 .

The error management device 18 and the lockstep comparator 33 determine whether or not an abnormality has occurred in the abnormality determination target core, with the first CPU core 11 among the CPU cores 11 to 13 as the abnormality determination target core.

The ROM 15 stores a low load selection table ST11, a first high load selection table ST12, and a second high load selection table ST13 that designate a substitute core for each interrupt factor.
When the error management device 18 determines that an abnormality has occurred in the abnormality determination target core, the second CPU core 12 selects the low load selection table ST11, the first high load selection table ST12, and the second CPU core 12 stored in the ROM 15. The core designation information stored in the request control register 40 is changed based on the high load selection table ST13.

Thus, in the ECU 1, when an interrupt factor occurs, the interrupt controller 19 generates an interrupt to the CPU cores 11 to 13 corresponding to the interrupt factor, based on the core designation information. As a result, in the ECU 1, the CPU cores 11 to 13 corresponding to the interrupt factor execute the program corresponding to the interrupt factor based on the vector table VT2.

Then, in the ECU 1, when an abnormality occurs in the abnormality determination target core, the second CPU core 12 determines the core designation information based on the low load selection table ST11, the first high load selection table ST12, and the second high load selection table ST13. to change Accordingly, when an abnormality occurs in the abnormality determination target core, the ECU 1 can cause the substitute core to execute the program that the abnormality determination target core was executing when the interrupt factor occurred. Therefore, when an abnormality occurs in the abnormality determination target core, the ECU 1 can cause the substitute core to execute the program on behalf of the abnormality determination target core.

The ECU 1 stores a low-load selection table ST11, a first high-load selection table ST12, and a second high-load selection table ST13 for designating a substitute core for each interrupt factor when an abnormality occurs in the abnormality determination target core. there is For this reason, the ECU 1 presets a low load selection table ST11, a first high load selection table ST12, and a second high load selection table ST13 according to the operation status of the ECU 1. Delegation by the core can be executed appropriately. As a result, the ECU 1 can improve control performance when an abnormality occurs.

The CPU cores 12 and 13 also measure the processing loads of the CPU cores 12 and 13, respectively. The ROM 15 stores a low load selection table ST11 corresponding to the case where the processing load of the second CPU core 12 is low, and a first high load selection table ST11 corresponding to the case where the processing load of the second CPU core 12 is high and the processing load of the third CPU core 13 is low. A load selection table ST12 and a second high load selection table ST13 corresponding to the case where the processing load on the second CPU core 12 is high and the processing load on the third CPU core 13 is high are stored. The second CPU core 12 selects the low load selection table ST11, the first high load selection table ST12, or the second high load selection table ST13 corresponding to the measured processing loads of the second CPU core 12 and the third CPU core 13. The core designation information is changed based on the low load selection table ST11, the first high load selection table ST12, or the second high load selection table ST13. Thereby, the ECU 1 can change the substitute core according to the processing load of the second CPU core 12 and the third CPU core 13, and can improve the control performance when an abnormality occurs.

In the embodiment described above, S510 to S580 and S610 to S680 correspond to the processing of the changing section, the vector table VT2 corresponds to the program designation information, the low load selection table ST11, the first high load selection table ST12 or the second The 2-high load selection table ST13 corresponds to a plurality of proxy information.

An embodiment of the present disclosure has been described above, but the present disclosure is not limited to the above embodiment, and can be implemented in various modifications.
[Modification 1]
For example, in the above-described embodiment, the first CPU core 11 is used as the abnormality determination target core, but the number of abnormality determination target cores may be plural.

The ECU 1 and techniques thereof described in the present disclosure are implemented by a dedicated computer provided by configuring a processor and memory programmed to perform one or more functions embodied by a computer program. may Alternatively, the ECU 1 and techniques described in this disclosure may be implemented by a dedicated computer provided by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the ECU 1 and techniques thereof described in this disclosure are configured by a combination of a processor and memory programmed to perform one or more functions and a processor configured by one or more hardware logic circuits. may be implemented by one or more dedicated computers configured as Computer programs may also be stored as computer-executable instructions on a computer-readable non-transitional tangible recording medium. The method of realizing the function of each part included in the ECU 1 does not necessarily include software, and all the functions may be realized using one or more pieces of hardware.

A plurality of functions possessed by one component in the above embodiment may be implemented by a plurality of components, or a function possessed by one component may be implemented by a plurality of components. Also, a plurality of functions possessed by a plurality of components may be realized by a single component, or a function realized by a plurality of components may be realized by a single component. Also, part of the configuration of the above embodiment may be omitted. Also, at least part of the configuration of the above embodiment may be added or replaced with respect to the configuration of the other above embodiment.

In addition to the above-described ECU 1, various systems including the ECU 1 as a component, a program for causing a computer to function as the ECU 1, a non-transitional physical recording medium such as a semiconductor memory in which the program is recorded, a device control method, etc. The present disclosure can also be implemented in a form.

Reference Signs List 1 ECU, 11 first CPU core, 12 second CPU core, 13 third CPU core, 14 fourth CPU core, 15 ROM, 18 error management device, 19 interrupt controller, 33 lock step comparator, 40... Request control register

Claims (2)

mounted on the vehicle
a plurality of CPU cores (11, 12, 13, 14);
a program designation storage unit (15) configured to store program designation information (VT1, VT2) designating a program to be executed by each of the plurality of CPU cores for each of a plurality of interrupt factors;
a core designation storage unit (40) configured to store, for each of a plurality of interrupt factors, core designation information designating the CPU core that generates an interrupt due to the interrupt factor;
When the interrupt factor occurs, the CPU core corresponding to the generated interrupt factor is caused to generate the interrupt based on the core designation information stored in the core designation storage unit. an interrupt control unit (19);
Abnormality configured to determine whether or not an abnormality has occurred in the abnormality determination target core (11), with at least one of the plurality of CPU cores set in advance as the abnormality determination target core (11). a determination unit (18, 33);
A plurality of proxy information (ST1, ST2, a proxy storage unit (15) configured to store ST11, ST12, ST13);
The core designation information is changed based on the proxy information stored in the proxy storage unit when the fault judgment unit judges that the fault judgment target core is faulty. and a changing unit (S210 to S260, S310 to S360, S510 to S580, S610 to S680) ,
The throttle valve for adjusting the amount of air supplied to the engine of the vehicle is designed so that the throttle motor (63) for driving the throttle valve is de-energized so that the opening of the throttle valve does not affect the limp home of the vehicle. It is configured to have a preset opener opening that allows running,
a load measuring unit (S10 to S40, S110 to S130) configured to measure the processing load of the acting core;
the proxy storage unit stores a plurality of pieces of proxy information different from each other according to the processing load of the proxy core;
The changing unit (S210 to S260, S310 to S360) selects the proxy information corresponding to the processing load measured by the load measuring unit, and changes the core designation information based on the selected proxy information. death,
The program designation information (VT1) and the proxy information (ST1, ST2) indicate that when a preset high load condition indicating that the processing load of the proxy core is high is not satisfied, the proxy core An electronic control unit (1) that executes control of the throttle motor and is set so that the substitute core does not execute control of the throttle motor when the high load condition is satisfied. The electronic control device according to claim 1 ,
The program designation information and the core designation information are arranged such that the abnormality determination core controls the engine of the vehicle when the abnormality determination unit determines that the abnormality determination core does not have an abnormality. Electronic control unit that is set.