WO2020012822A1

WO2020012822A1 - Computation system and computation device

Info

Publication number: WO2020012822A1
Application number: PCT/JP2019/021817
Authority: WO
Inventors: 憲太森島
Original assignee: 日立オートモティブシステムズ株式会社
Priority date: 2018-07-11
Filing date: 2019-05-31
Publication date: 2020-01-16
Also published as: JP2020009288A; JP7011983B2

Abstract

Provided is a computation system comprising a plurality of computation devices for alternately executing a prescribed computation, wherein each of the computation devices comprises: a communication part for carrying out a communication with the other computation devices; a computation part for carrying out a prescribed computation; and an execution control part for, when a prescribed condition is satisfied when the computation part is carrying out the prescribed computation, interrupting the prescribed computation and transmitting a delegation signal for causing another of the computation devices to take over the prescribed computation. The execution control part causes the computation part to commence the prescribed computation upon receiving the delegation signal.

Description

Arithmetic system, arithmetic unit

<< The present invention relates to an arithmetic system and an arithmetic device.

Automobiles are equipped with multiple computing devices that control the vehicle. Patent Literature 1 discloses that in a vehicle control system including a plurality of in-vehicle devices connected via a communication path, each of the plurality of in-vehicle devices diagnoses a state of another in-vehicle device other than its own, and The status of the other in-vehicle device diagnosed is exchanged with another in-vehicle device, and based on the status of the other in-vehicle device diagnosed by itself and the status of the other in-vehicle device obtained from the other in-vehicle device. A vehicle control system that determines the state of another vehicle-mounted device is disclosed.

Japanese Patent Application Laid-Open No. 2007-126127

In the invention described in Patent Literature 1, a predetermined operation cannot be executed alternately by a plurality of operation devices.

An arithmetic system according to a first aspect of the present invention is an arithmetic system including a plurality of arithmetic devices that alternately execute a predetermined arithmetic operation, wherein each of the arithmetic devices communicates with another of the arithmetic devices. Unit, an operation unit that performs the predetermined operation, and stops the predetermined operation when a predetermined condition is satisfied when the operation unit is performing the predetermined operation, and causes the other operation device to execute the predetermined operation. An execution control unit that transmits a commission signal for taking over the computation, wherein the execution control unit causes the computation unit to start the predetermined computation when the commission signal is received.
An arithmetic device according to a second aspect of the present invention is an arithmetic device capable of alternately executing a predetermined operation, and a communication unit that communicates with another arithmetic device, and an arithmetic unit that performs the predetermined operation. An execution control unit that stops the predetermined operation when a predetermined condition is satisfied when the operation unit is performing the predetermined operation, and transmits a commission signal that allows the predetermined operation to be taken over to another operation device. The execution control unit, upon receiving the delegation signal, causes the operation unit to start the predetermined operation.

According to the present invention, a predetermined operation can be executed alternately by a plurality of operation devices.

Schematic diagram of arithmetic system 2000 Configuration diagram of first ECU 101 Schematic diagram showing how the ECU 100 takes turns monitoring communication of the vehicle 1000 FIG. 4A illustrates an example of the transition table 18b, and FIG. 4B illustrates a visualization of the transition table 18b. Diagram showing rotation of status monitoring and communication monitoring 5 is a flowchart illustrating the operation of the communication monitoring block 14 according to the first embodiment. 5 is a flowchart illustrating the operation of the communication monitoring block 14 according to the first embodiment. 5 is a flowchart illustrating the operation of the communication monitoring block 14 according to the first embodiment. 5 is a flowchart illustrating the operation of the communication monitoring block 14 according to the first embodiment. 9 is a flowchart illustrating the operation of the communication monitoring block 14 according to the second embodiment.

-First embodiment-
Hereinafter, a first embodiment of an arithmetic system will be described with reference to FIGS.

(overall structure)
FIG. 1 is a schematic diagram of an arithmetic system 2000 according to the present invention. The arithmetic system 2000 is stored in the vehicle 1000. The arithmetic system 2000 includes a gateway 200, a first ECU 101, a second ECU 102, a third ECU 103, a fourth ECU 104, a first communication bus 21, a second communication bus 22, and a communication device 110. Hereinafter, the first ECU 101, the second ECU 102, the third ECU 103, and the fourth ECU 104 will be referred to as “ECU 100” unless otherwise distinguished. The communication device 110 can communicate with a communication network 201, for example, the Internet by wireless communication. Although FIG. 1 shows only the first to fourth ECUs, the number of ECUs provided in vehicle 1000 may be two or more, and there is no upper limit. The vehicle 1000 may have only one communication bus or three or more communication buses.

The communication system of the devices mounted on the vehicle 1000 is not particularly limited, and for example, CAN (registered trademark) or IEEE802.3 can be used. The names of data transmitted over a network according to a communication method or a communication protocol are various such as frames, datagrams, and packets, but are referred to as “packets” in the present embodiment. The gateway 200 operates as a so-called repeater, and transmits information received at one port from the other port. That is, all packets are transferred without looking at the destination of the received packet and determining whether transfer to the other communication bus is necessary.

The communication device 110, the first ECU 101, and the gateway 200 are connected to the first communication bus 21. The gateway 200, the second ECU 102, the third ECU 103, and the fourth ECU 104 are connected to the second communication bus 22. The communication device 110 has a role of providing update information to the ECU 100. That is, this means that there is a possibility that the communication device 110 may be intruded from outside with the communication device 110 as an entrance, as indicated by a dashed line in FIG. For this reason, in the present embodiment, an unusual event caused by an external intrusion is detected.

(Configuration of ECU)
FIG. 2 is a diagram showing the configuration of the first ECU 101. However, the second ECU 102 to the fourth ECU 104 have substantially the same configuration as the first ECU 101. The first ECU 101 includes an application 12, basic software 13, a communication monitoring block 14, and a communication unit 11. Each ECU 100 has a different function realized by the application 12, but has the same other configuration.

The first ECU 101 includes a CPU, a ROM, and a RAM (not shown). The first ECU 101 expands a program stored in the ROM into the RAM, and executes the program, thereby realizing the application 12, the basic software 13, and the communication monitoring block 14. it can. However, it may be realized by a hardware circuit or a rewritable logic circuit.

The application 12 is an application that implements a function that the first ECU 101 mainly performs. The basic software 13 is an operating system for operating the application 12. The communication monitoring block 14 alternately monitors communication in the vehicle 1000 with another ECU. Details of the communication monitoring block 14 will be described in detail below. The first ECU 101 monitors the communication in the vehicle 1000 using the communication monitoring block 14 for a certain time while exerting the original function by the application 12. This will be described in detail with reference to FIG.

FIG. 3 is a schematic diagram showing a situation in which the ECU 100 takes turns, that is, rotates and monitors the communication of the vehicle 1000. 3A to 3D are arranged in chronological order, and the process returns to FIG. 3A after FIG. 3D. As shown in FIG. 3A, first, the first ECU 101 monitors communication, and when a predetermined condition is satisfied, transmits a delegation packet 32, which is a signal for taking over monitoring of communication, to the second ECU 102. Note that the “delegation packet” can also be called a “delegation signal”.

(4) The first ECU 101 that has transmitted the delegation packet 32 ends the communication monitoring. The second ECU 102 that has received the commission packet 32 monitors the communication as shown in FIG. Then, when the predetermined condition is satisfied, the second ECU 102 transmits the commission packet 32 to the third ECU 103 and ends the monitoring. In this way, the ECU 100 transmits the commission packet 32 and alternately monitors the communication one after another. Returning to FIG. 2, the description will be continued.

The communication unit 11 includes a reception buffer 11a, a transmission buffer 11b, and a controller (not shown). The reception buffer 11a is a buffer to which all packets flowing through the communication bus 20 by the controller are input. The basic software 13 processes a packet to be handled by the first ECU 101 and ignores other packets. However, when the monitoring unit 16 described below is operating, the monitoring unit 16 monitors all packets input to the reception buffer 11a. The packet to be handled by the first ECU 101 is a packet whose CAN-ID has a specific value in CAN or a packet whose destination IP address is the first ECU 101 in IEEE802.3.

The transmission buffer 11b is a buffer to which a packet transmitted by the first ECU 101 is input. The packet input to the transmission buffer 11b is output to the communication bus 20 by the controller according to the availability of the communication bus 20 or a predetermined communication cycle.

The communication monitoring block 14 includes an execution control unit 15, a monitoring unit 16, a verification unit 17, and a storage unit 18. In the following, the monitoring unit and the verification unit 17 are also collectively referred to as a calculation unit 30. The storage unit 18 stores a monitoring order 18a indicating the order of the ECUs 100 monitoring communication, and a transition table 18b indicating a normal state transition regarding communication in the vehicle. Hereinafter, a state related to communication in the vehicle is referred to as a “communication state”. That is, the normal transition of the communication state is stored in the transition table 18b. For example, the monitoring order 18a corresponding to the example shown in FIG. 3 is {first ECU 101, second ECU 102, third ECU 103, fourth ECU 104}. A specific example of the transition table 18b will be described later.

(4) Upon receiving the commission packet 32 addressed to the first ECU 101, the execution control unit 15 causes the monitoring unit 16 and the verification unit 17 to start operating. When a predetermined condition is satisfied while the monitoring unit 16 and the verification unit 17 are operating, the execution control unit 15 stops the operation of the monitoring unit 16 and the verification unit 17 and transmits the delegation packet 32. The predetermined condition is an elapse of a predetermined time or an increase in processing load. The transmission destination of the delegation packet 32 is determined according to the monitoring order 18a. The delegation packet 32 is transmitted with the current communication state added thereto as described later. Details will be described later.

(4) The execution control unit 15 keeps track of which ECU 100 is monitoring communication. Hereinafter, the ECU 100 monitoring the communication is referred to as “monitoring ECU”, and the information recorded by the execution control unit 15 and indicating the monitoring ECU is referred to as “monitoring ECU information”. Since the commission packet 32 is transmitted to all the ECUs 100 via the communication bus 20, the monitoring ECU can be grasped even if the commission packets 32 are transmitted and received between the other ECUs 100.

The monitoring unit 16 monitors the identifier of the packet input to the reception buffer 11a, for example, the CAN-ID, and outputs it to the verification unit 17. The verification unit 17 determines whether the communication state has successfully transitioned using the current communication state, the identifier of the packet output by the monitoring unit 16, and the three pieces of information of the transition table 18b.

(Transition table 18b)
FIG. 4A is a diagram illustrating an example of the transition table 18b, and FIG. 4B is a diagram visualizing the transition table 18b. The transition table 18b includes a plurality of records, and each record includes fields of a communication state, a transition trigger condition, a transition destination communication state, a timeout period, and a trigger setting. The communication status field stores a communication status number. The condition for transition to the next communication state is stored in the trigger condition field. The field of the communication state of the transition destination stores the number of the communication state to which the transition is made when the trigger condition is satisfied. The time-out field stores the time from the transition to the state to the time-out. However, if there is no timeout, “none” is stored.

{For example, the example in the first line of FIG. 4A indicates that when a packet having a CAN-ID of 6 is detected in the communication state 1, the communication state is changed to 2. In the example of the second line in FIG. 4A, when a packet having a CAN-ID of 7 is detected in the communication state 2, the communication state is changed to 3, and the CAN-ID is changed within 1 ms after the transition to the communication state 2. Indicates that a timeout occurs if the packet of No. 7 is not detected. When a timeout occurs, the state transits to an abnormal state described later.

4 (b) is a visualization diagram of the transition table 18b created by supplementing the description omitted in FIG. 4 (a). The circled numbers shown in FIG. 4B indicate communication states, and the numbers near arrows connecting the communication states indicate CAN-IDs serving as trigger conditions. A part of the operation of the verification unit 17 will be described with reference to FIG. According to FIG. 4B, since the normal transition destination from the communication state 1 is only the communication state 2, when a packet having a CAN-ID other than 6 is received in the communication state 1, the verification unit 17 makes a transition to the abnormal state. In the communication state 2, when a packet having a CAN-ID other than 7, 11, or 13 is received, the verification unit 17 makes a transition to an abnormal state. When the verification unit 17 receives a packet with the CAN-ID of 8 in the communication state 3, the verification unit 17 maintains the communication state.

(Schematic diagram of monitoring)
FIG. 5 is a diagram schematically showing rotation of state monitoring and communication monitoring. The upper part of FIG. 5 shows a state where the first ECU 101 monitors communication, and the lower part of FIG. 5 shows a state where the second ECU 102 monitors communication. The inside of the frame indicated by the reference numeral 31 schematically shows the transition of the communication state, and the number with an underbar indicates that it is the current communication state. Note that the schematic diagram of the communication state shown in FIG. 5 is different from FIG. 4 due to the drawing convenience.

(5) The first ECU 101 starts monitoring from the communication state 1, receives a packet several times, and repeats the state transition, and the communication state is changed to the communication state 3 as shown in the upper right of FIG. Then, since the predetermined condition is satisfied, the commission packet 32 is transmitted to the second ECU 102 that monitors the communication next. The delegation packet 32 also includes information indicating that the current communication state is “communication state 3”. The second ECU 102 that has received the commission packet 32 starts monitoring communication based on the information included in the commission packet 32, assuming that the current communication state is “communication state 3”. The second ECU 102 changes the communication state upon receiving the packet, and satisfies a predetermined condition when the communication state becomes “communication state 5”. Therefore, the next third ECU 103 transmits the commission packet 32 including information indicating that the current communication state is “communication state 5”.

(flowchart)
6 to 9 are flowcharts showing the operation of the communication monitoring block 14. In the description of FIGS. 6 to 8, the ECU 100 that performs the operation described below is referred to as “the ECU” or “self”. When started, the execution control unit 15 of the ECU 100 starts the operation shown in FIG.

The execution control unit 15 first reads the monitoring order 18a (S102), and determines whether the ECU is in the first order (S103). For example, in the case of the monitoring order 18a described above, only the first ECU 101 makes a positive determination in S103 and proceeds to S104, and the other ECUs make a negative determination in S103 and proceeds to S105. In S104, the execution control unit 15 transmits the commission packet 32 to the ECU itself, and proceeds to S105. The delegation packet 32 includes information indicating that the current communication state is “communication state 1”.

In S105, the execution control unit 15 waits until a packet is received, and upon receiving a packet, proceeds to S107. When the process proceeds from S104 to S105, the process immediately proceeds to S107. In S107, the execution control unit 15 determines whether or not the communication is being monitored. If it is determined that the communication is being monitored, the process proceeds to box 2 in FIG. 7, and if it is determined that the communication is not being monitored, the process proceeds to S108. In S108, the execution control unit 15 determines whether or not the received packet is the delegation packet 32. If it is determined that the delegation packet 32 has been received, the process proceeds to box 3 in FIG. When it is determined that is received, the process proceeds to a circle 4 in FIG.

FIG. 7 is a diagram showing a process when a positive determination is made in S107 or S108 of FIG. S118 is executed by the execution control unit 15 via the circle 3 when the affirmative judgment is made in S108 of FIG. In S118, it is determined whether the received commission packet 32 is addressed to the ECU. The destination of the delegation packet 32 may be determined based on the CAN-ID, which is the identifier of the packet, or the IP address indicating the destination, or may be determined from information included in the payload. The execution control unit 15 proceeds to S120 when judging that it is addressed to itself, and proceeds to S119 when judging that it is not addressed to itself. In S119, the execution control unit 15 updates the monitoring ECU information, and proceeds to box 1.

In S120, the execution control unit 15 sets a communication state and sets a timer, which are processes at the start of monitoring, and proceeds to S121. The setting of the communication state is to read the information included in the delegation packet 32 and the current communication state, for example, any one of the states 1 to 4 shown in FIG. 4B. The setting of the timer is to start measuring the time to change the monitoring of the communication after a monitoring time that is a predetermined length of time, for example, 10 seconds.

Step S121 is executed after the step S120 or in the affirmative determination in the step S107 in FIG. In S121, the execution control unit 15 performs a process at the time of monitoring as described later, and proceeds to S122. In S122, the execution control unit 15 determines whether or not the monitoring time has ended, that is, whether or not the time counting started in S120 has reached a predetermined time. The execution control unit 15 proceeds to S124 when making a positive determination in S122, and proceeds to S123 when making a negative determination in S122. In S124, the execution control unit 15 refers to the monitoring order 18a, specifies the ECU 100 that is in charge of monitoring next, and creates and transmits the commission packet 32 to the specified ECU 100. However, this delegation packet 32 also includes information indicating the current communication state. Then, the execution control unit 15 proceeds to box 1 after S124.

In S123, the execution control unit 15 determines whether or not the current processing load of the ECU 100 is larger than a predetermined value. When it is determined that the current processing load is larger than the predetermined value, the process proceeds to S124. move on. That is, the execution control unit 15 transmits the commission packet 32 and causes the next ECU 100 to monitor the communication when a predetermined time has elapsed after the start of monitoring the communication or when the processing load has become larger than the predetermined value.

FIG. 8 is a diagram showing a process executed via the circle 4 when a negative determination is made in S108 of FIG. In S109 executed after the circle 4, the execution control unit 15 determines whether or not the first specified time has elapsed since the transmission of the commission packet 32 immediately before. However, the first specified time is a time of a predetermined length. The execution control unit 15 proceeds to S110 when making a positive determination in S109, and proceeds to circle 1 when making a negative determination in S109.

In S110, the execution control unit 15 determines whether the monitoring ECU currently monitoring the communication is immediately before the monitoring ECU 18a in the monitoring order 18a. The execution control unit 15 proceeds to S115 when the monitoring ECU determines that it is immediately before itself, and proceeds to S112 when the monitoring ECU determines that it is not immediately before itself. In S112, the execution control unit 15 determines whether or not the second specified time has elapsed since the last transmission of the delegation packet 32. However, the second specified time is a time of a predetermined length, and may be the same as or different from the first specified time. When the execution control unit 15 makes an affirmative decision in S112, it proceeds to S113, and when it makes a negative decision in S112, it proceeds to box 1.

In S113, the execution control unit 15 outputs an alert because the delegation packet 32 has not been detected for a long time. In S114, the execution control unit 15 transmits the delegation packet 32 to itself and proceeds to box 1. In S115, the execution control unit 15 determines whether a failure of the monitoring ECU has been detected. The ECU 100 may be provided with a function of detecting a failure of the ECU 100 connected to the communication bus 20, or may be configured to detect a failure of the crisis connected to the communication bus 20 and transmit the failure to each ECU 100. Good. The execution control unit 15 proceeds to S117 when making a positive determination in S115, and proceeds to S116 when making a negative determination in S115.

In S116, the execution control unit 15 outputs an alert, and proceeds to S117. The reason why an alert is output only when a negative determination is made in S115 is because it is assumed that when a failure is detected, a countermeasure other than communication monitoring will be used. In step S117, the delegation packet is transmitted to itself, and the process proceeds to box 1.

FIG. 9 is a flowchart showing the details of S121 in FIG. The processing illustrated in FIG. 9 is executed by the verification unit 17 that has been instructed by the execution control unit 15 to operate. The verification unit 17 first updates the communication state based on the received packet in S130. In subsequent S131, the verification unit 17 determines whether or not fraud has been detected, that is, whether or not a transition to an abnormal state has occurred in S130. If the verification unit 17 determines that an abnormal state has been detected, the process proceeds to S132, outputs an alert, and proceeds to S133. If it determines that the state has not transitioned to an abnormal state, the process proceeds to S133. In step S133, the communication state changed in step S130 is notified to the execution control unit 15, and the process illustrated in FIG. 9 ends.

According to the above-described first embodiment, the following operation and effect can be obtained.
(1) The arithmetic system 2000 includes a plurality of ECUs 100 that alternately monitor communication. ECU 100 communicates with another ECU 100, communication unit 11 performs a predetermined calculation, and arithmetic unit 30 stops a predetermined calculation when a predetermined condition is satisfied when the calculation unit 30 performs a predetermined calculation. And an execution control unit 15 for transmitting a commission packet 32 for allowing another ECU 100 to take over a predetermined operation. Upon receiving the commission packet 32, the execution control unit 15 causes the calculation unit 30 to start a predetermined calculation. Therefore, the arithmetic system 2000 can execute a predetermined arithmetic operation alternately by the plurality of arithmetic devices 100.

(2) The calculation unit 30 includes a monitoring unit 16 that receives communication between the ECUs 100, a storage unit 18 that stores a transition table 18b indicating a normal communication order, and a communication order and a transition table that the monitoring unit 16 receives. And a verification unit 17 for collating with the verification unit 18b. Therefore, the arithmetic unit 30 can monitor the communication of the arithmetic system 2000.

(3) One of the conditions under which the ECU 100 changes the communication monitoring is a predetermined time since the communication monitoring is started, that is, the monitoring time has elapsed. Therefore, it is possible to prevent the calculation load from being biased to a specific ECU 100.

(4) One of the conditions under which the ECU 100 changes the monitoring of the communication is that the current processing load of the ECU is higher than a predetermined threshold. Therefore, when the processing load of the application 12 is high, the monitoring of the communication is delegated to the next ECU 100, and the adverse effect of monitoring the communication on the original operation of the ECU 100 can be reduced.

(5) The execution control unit 15 sets a condition that the first period, that is, the first specified time in S109 of FIG. 8 or the second specified time in S112 has elapsed since the calculation unit 30 completed the predetermined calculation. As one of the above, the operation unit 30 is caused to execute a predetermined operation without receiving the delegation packet 32. Even when a failure occurs in another ECU 100 and the delegation packet 32 cannot be transmitted, the ECU can monitor the communication.

(6) The delegation packet 32 contains monitoring progress information, that is, the current communication state. Therefore, as shown in FIG. 5, even if the ECU 100 that monitors the communication is changed, the communication state information can be taken over and monitored.

(Modification 1)
In the first embodiment described above, the delegation packet 32 includes the monitoring ECU information, but does not include the remaining time-out time. However, the ECU 100 may also transmit the remaining time of the timeout. For example, when the timeout of a certain communication state is 10 ms, and the delegation packet 32 is output 4 ms after the transition to the communication state, the communication state and 4 ms have already passed in the delegation packet 32. Information to the effect. The ECU 100 that has received the commission packet 32 determines that a timeout has occurred if no packet is received within 6 ms. According to the first modification, the timeout can be accurately evaluated even if the monitoring ECU is changed.

(Modification 2)
One of the ECUs 100 may be a master unit having a function of changing the order of rotation. The parent machine changes the order of rotation upon elapse of a certain time or detection of entry, and transmits the commission packet 32 with the changed order of rotation. The ECU 100 that has received the commission packet 32 overwrites the monitoring order 18 a stored in the storage unit 18 with the rotation order included in the commission packet 32. Further, the ECU 100 which has received the commission packet 32 includes the commissioned packet 32 transmitted by itself, which is the received information, that is, the changed rotation order.

In addition, the order of rotation can be changed without the parent device, for example, by the following configuration. In other words, a plurality of monitoring orders 18a may be stored in the ECU 100 in advance, and the order of rotation may be changed by changing the monitoring order 18a that each ECU 100 refers to by its own judgment according to a condition such as the passage of time.

According to the second modification, the following operation and effect can be obtained in addition to the operation and effect of the first embodiment.
(7) The order in which the ECU 100 monitors the communication is not fixed. Therefore, the order of rotation can be changed to improve safety.

(Modification 3)
When the processing load is larger than the predetermined value in S123 of FIG. 7, the commission packet 32 is immediately created and the monitoring of the communication is commissioned to the next ECU 100. However, the monitoring time may be shortened according to the processing load. For example, three levels of processing load thresholds are provided. If the processing threshold exceeds the lowest threshold, the time for the ECU to monitor the network is shortened by 30%. If it exceeds, monitoring may be terminated immediately.

(Modification 4)
When receiving the commission packet 32, the ECU 100 starts monitoring the communication. However, when the processing load is larger than a predetermined threshold when the commission packet 32 is received, the commission packet 32 may be ignored. For example, if it is determined that the processing load is greater than the predetermined threshold value when the determination is affirmative in S118, the process proceeds to the circle 1 without proceeding to S120. According to the fourth modification, it is possible to concentrate on the original processing of the ECU 100.

(Modification 5)
In the first embodiment, the ECU 100 alternately monitors communication. However, the processing performed in turn is not limited to monitoring communication. For example, calculations for implementing functions necessary for traveling of the vehicle 1000 and additional functions may be executed alternately. The function required for traveling of vehicle 1000 is, for example, calculation of an optimal ignition timing of the engine. The additional function is, for example, an operation of processing data acquired by a sensor included in the vehicle 1000 to detect an obstacle.

(Modification 6)
The ECU 100 may transmit the commission packet 32 to the ECU 100 that is two places ahead in the monitoring order 18a. In this case, the ECU 100 performs the following operation. When the ECU 100 transmits the commission packet 32, the ECU 100 monitors the transmission of the commission packet 32 of the next ECU 100 in the monitoring order 18a. If the transmission of the delegation packet 32 cannot be confirmed within a predetermined time after the transmission of the delegation packet 32 by itself, the delegation packet 32 is transmitted to the next ECU 100. The next ECU 100 in the monitoring order 18a is also referred to as the “next device”, and the next ECU 100 is also referred to as the “next device”.

{For example, when the monitoring order 18a is the order of the first ECU 101, the second ECU 102, the third ECU 103, and the fourth ECU 104, as in the first embodiment, the specific operation mainly performed by the first ECU 101 is as follows. When transmitting the commission packet 32 to the second ECU 102, the first ECU 101 monitors the transmission of the commission packet 32 by the second ECU 102. If the first ECU 101 determines that the second ECU 102 has not transmitted the delegation packet 32 to the third ECU 103 within a predetermined period of time after transmitting the delegation packet 32 to the second ECU 102, the first ECU 101 delegates to the third ECU 103, which is one after another. The packet 32 is transmitted.

According to the sixth modification, the following operation and effect can be obtained in addition to the operation and effect of the first embodiment.
(8) The storage unit 18 stores the monitoring order 18a. The execution control unit 15 specifies the next device and the next device by referring to the monitoring order 18a. The execution control unit 15 transmits the delegation packet 32 to the next device if it does not detect the delegation packet 32 from the next device to the next device until the second predetermined time elapses after transmitting the delegation packet 32 to the next device. Output.

(Modification 7)
In S123 of FIG. 7, the execution control unit 15 determines whether or not the current processing load of the ECU 100 is larger than a predetermined value. However, the execution control unit 15 may predict the processing load of the ECU 100 in the near future, for example, after 10 ms or 100 ms, and determine whether the predicted processing load is larger than a predetermined value. According to the present modification, it is possible to reduce the adverse effect on the original processing by monitoring the communication, that is, the processing of the application 12. Note that the processing of the ECU 100 is often periodic, so that it is easy to predict the processing load.

-Second embodiment-
A second embodiment of the arithmetic system will be described with reference to FIG. In the following description, the same components as those in the first embodiment are denoted by the same reference numerals, and the differences will be mainly described. The points that are not particularly described are the same as in the first embodiment. This embodiment is different from the first embodiment mainly in that, when a commission packet is received at short time intervals, monitoring is not terminated even if the processing load is large.

(Overview of Second Embodiment)
In the first embodiment described above, when the processing load on the ECU 100 monitoring the communication increases, the monitoring of the communication is terminated even before the monitoring time ends (S122: NO in FIG. 7, S123: YES, S124). Therefore, when the processing load of all the ECUs 100 is high, the ECU 100 that has received the commission packet 32 immediately transmits the commission packet 32 to the next ECU 100, and the monitoring ECU is changed one after another. In this case, it is not preferable because only the monitoring ECU is changed and the communication is not monitored.

Therefore, in the present embodiment, when the commission packet 32 is received again in a short time, the ECU 100 sets a flag indicating that the processing load on the ECU 100 is high as a whole (hereinafter, “continuation flag”) to ON. When the continuation flag is on, communication monitoring is continued until the monitoring time ends even if the processing load is higher than a predetermined threshold. Although all the ECUs 100 perform the same operation in the first embodiment, some ECUs 100 may perform the same operation as the first embodiment in the present embodiment.

(Constitution)
The configuration of the vehicle 1000 and the functional configuration of the ECU 100 are the same as those of the first embodiment except for the following points. That is, at least some of the operations of the ECU 100 are different as described below. This means that, for example, a program stored in a ROM (not shown) is different, a hardware circuit is different, or a circuit written in a logic circuit is different.

(flowchart)
FIG. 10 is a flowchart illustrating the operation of the communication monitoring block 14 according to the second embodiment. However, FIG. 10 is a flowchart executed in place of FIG. 7 in the first embodiment. That is, the communication monitoring block 14 according to the second embodiment performs the operations shown in FIGS. 6, 8 to 10. The difference between FIG. 7 and FIG. 10 is that, when an affirmative determination is made in S118, steps S142 to S144 are executed and the process proceeds to S120, and when an affirmative determination is made in S123, S149 is executed. Although S151 and S153 are added after S124, these may not be provided. Hereinafter, the added steps will be described.

In S142, which is executed when an affirmative determination is made in S118, the execution control unit 15 determines whether or not the time interval from the previous execution of S124 to the execution of S142 is shorter than a predetermined threshold. This threshold value is, for example, a product of three products of the monitoring time, which is a predetermined time length, the number of ECUs 100 connected to the communication bus 20, and a predetermined coefficient, for example, 0.1. The execution control unit 15 proceeds to S144 to set the continuation flag to ON when making a positive determination in S142, and proceeds to S143 to set the continuation flag to OFF when making a negative determination. After executing S143 or S144, the execution control unit 15 proceeds to S120. The processing in S120 is the same as that in the first embodiment, and a description thereof will not be repeated.

In S149 executed when a positive determination is made in S123, the execution control unit 15 determines whether or not the continuation flag is on. When the execution control unit 15 determines that the continuation flag is off, the process proceeds to box 1 without creating the delegation packet 32. When the execution control unit 15 determines that the continuation flag is off, the process proceeds to S124. That is, in the present embodiment, when the continuation flag is on, the process does not proceed to S124 unless the monitoring time has expired.

The execution control unit 15 executes S124 as in the first embodiment, and then proceeds to S151. In S151, the execution control unit 15 determines whether or not the continuation flag is on, and if the continuation flag is on, proceeds to S153 and sets the continuation flag to off z. When the execution control unit 15 determines that the continuation flag is off, the execution control unit 15 proceeds to the circle 1 as it is.

各 The above-described embodiments and modifications may be combined with each other. Although various embodiments and modifications have been described above, the present invention is not limited to these contents. Other embodiments that can be considered within the scope of the technical idea of the present invention are also included in the scope of the present invention.

The disclosure of the following priority application is incorporated herein by reference.
Japanese patent application 2018-131352 (filed on July 11, 2018)

11 communication unit 14 communication monitoring block 15 execution control unit 16 monitoring unit 17 verification unit 18 storage unit 30 calculation unit 32 delegation packet 100 ECU
1000: vehicle 2000: arithmetic system

Claims

An arithmetic system including a plurality of arithmetic devices that alternately execute a predetermined operation,
Each of the arithmetic units is
A communication unit that communicates with the other arithmetic devices;
An operation unit that performs the predetermined operation;
An execution control unit that stops the predetermined operation when a predetermined condition is satisfied when the operation unit is performing the predetermined operation, and transmits a commission signal that allows the other operation device to take over the predetermined operation; and With
The operation system, wherein the execution control unit causes the operation unit to start the predetermined operation when receiving the delegation signal.
The arithmetic system according to claim 1,
The arithmetic unit includes:
A monitoring unit that receives communication between the computing devices,
A storage unit that stores order information indicating a normal order of the communication,
An arithmetic system comprising: a verification unit that compares the order of communication received by the monitoring unit with the order information.
The arithmetic system according to claim 1,
The arithmetic system according to claim 1, wherein the predetermined condition is a lapse of a predetermined time from the start of the predetermined calculation.
The arithmetic system according to claim 1,
The arithmetic system, wherein the predetermined condition is that a current or future processing load of the arithmetic unit is higher than a predetermined threshold.
The arithmetic system according to claim 1,
An operation system, wherein the execution control unit causes the operation unit to execute the predetermined operation without receiving the delegation signal when a first period elapses after the operation unit ends the predetermined operation.
The arithmetic system according to claim 2,
The storage unit further stores monitoring order information indicating an order of the arithmetic devices that execute the predetermined processing,
The execution control unit determines a next device that executes the predetermined process next to the arithmetic device, and a next device that executes the predetermined process next to the next device with reference to the monitoring order information. ,
The execution control unit, if the delegation signal from the next device to the next device is not detected before the second predetermined time has elapsed after transmitting the delegation signal to the next device, delegation to the next device. An arithmetic system that outputs signals.
The arithmetic system according to claim 1,
An operation system, wherein the delegation signal includes progress information of the predetermined operation.
The arithmetic system according to claim 1,
An arithmetic system in which the order in which the plurality of arithmetic devices execute the predetermined arithmetic is not constant.
An arithmetic device capable of alternately executing a predetermined operation,
A communication unit that communicates with the other arithmetic devices;
An operation unit that performs the predetermined operation;
An execution control unit that stops the predetermined operation when a predetermined condition is satisfied when the operation unit is performing the predetermined operation, and transmits a commission signal that allows the other operation device to take over the predetermined operation; and With
The arithmetic unit, wherein the execution control unit causes the arithmetic unit to start the predetermined arithmetic upon receiving the delegation signal.