electronic control device

Abstract

The present invention appropriately executes tasks in an electronic control device equipped with a processor having a plurality of cores. An ECU (100) of the present invention is provided with a multi-core CPU having a plurality of cores that execute a first task whose execution time within each prescribed period varies depending on processing amount and a second task that is higher in priority than the first task and is prohibited from being interrupted. The second task is set so as not to be executed simultaneously among the plurality of cores. A task allocation section (11) generates a first schedule. A diagnosis task schedule section (12) generates a second schedule. Task processing sections (10a, 10b) execute the first task according to the first schedule. A diagnosis task correction section (13) times a delay time of the first task executed by the task processing sections (10a, 10b), and defers the second task of the second schedule to a subsequent executable timing according to the delay time obtained by the timing. A diagnosis section (14) executes the second task in each core according to the second schedule corrected by the diagnosis task correction section (13).

Description

Technical Field

[0001] This invention relates to an electronic control device. Background Technology

[0002] To handle computationally demanding processing, electronic control devices equipped with multi-core CPUs (multiple cores within a single CPU) are increasingly being adopted. Safety-critical products such as electronic control devices in vehicles require verification that each core is operating correctly to ensure reliability. Patent Document 1 discloses a method that generates numerous task start-up patterns within the constraints of the execution order of each core's tasks, executes these generated task start-up patterns as test items, and verifies the operation to confirm that each core is operating correctly.

[0003] Especially in systems like autonomous driving, the possibility of malfunctions during system operation is considered. The system needs to switch to simplified mode or stop at the shoulder within a specified timeframe, often constrained by fault detection time. Therefore, microcomputer manufacturers recommend periodically executing core diagnostic tasks—that is, confirming that the core is operating normally—within a shorter timeframe than the time constraint. Diagnostic methods using core diagnostic tasks mostly involve the CPU's internal diagnostic module pausing normal task processing, inputting a specific test mode into the target core, and comparing the output with specified values.

[0004] Existing technical documents

[0005] Patent documents

[0006] Patent Document 1: Japanese Patent Application Publication No. 2018-32062 Summary of the Invention

[0007] The problem the invention aims to solve

[0008] However, in this diagnostic method, interruptions are prohibited because normal task processing must be stopped. Therefore, when the execution times of core diagnostic tasks overlap with those of high-priority tasks, priority reversal occurs. Core diagnostic tasks involve the reliability of electronic control devices, so a high priority is required. However, in systems such as autonomous driving systems where critical data communicates between multiple subsystems, the timing of data transmission from other subsystems is unclear. Therefore, communication-related tasks must be prioritized to ensure continuous data reception. In this case, communication-related tasks have a higher priority than core diagnostic tasks.

[0009] Generally, rate monotonic scheduling is widely known as the optimal scheduling algorithm for fixed priorities. This method relies on the premise that all tasks can be interrupted. However, core diagnostic tasks cannot be interrupted, making rate monotonic scheduling unsuitable. In other words, with known scheduling methods, the probability of actions exceeding guarantees, such as the loss of communication data, is high.

[0010] The present invention was made to solve the above-mentioned problems, and its object is to provide a technology that enables tasks to be performed properly in an electronic control device equipped with a processor having multiple cores.

[0011] Technical means to solve the problem

[0012] To achieve the above objectives, the electronic control device of the present invention includes a processor having multiple cores, the multiple cores executing a first task and a second task, wherein the execution time of the first task varies according to the processing volume in each predetermined cycle, the second task has a lower priority than the first task and is prohibited from being interrupted, and the second task is configured not to be executed simultaneously among the multiple cores. The electronic control device includes: a first planning unit that generates a first plan, the first plan allocating the first task to each of the cores; a second planning unit that generates a second plan, the second plan allocating the second task to each of the cores during an executable period when the first task is not executed; a first execution unit that executes the first task according to the first planning unit; a correction unit that times the delay time of the first task executed by the first execution unit and postpones the second task of the second plan to a subsequent executable period according to the delay time obtained by the timed delay; and a second execution unit that executes the second task in each of the cores according to the second plan corrected by the correction unit.

[0013] The effects of the invention

[0014] According to the present invention, even if the first task is delayed, the second task can be executed at a time that does not overlap with the first task, so that the task can be properly executed in an electronic control device equipped with a processor with multiple cores. Attached Figure Description

[0015] Figure 1 This is a diagram of the ECU's structure.

[0016] Figure 2 This is a functional block diagram of the ECU.

[0017] Figure 3 This is an example of a typical task list.

[0018] Figure 4 Here is an example of a diagnostic task table.

[0019] Figure 5 This is an execution example under rate monotonic scheduling.

[0020] Figure 6 This is an example illustrating the execution of interruption prohibition under monotonic scheduling.

[0021] Figure 7 This is a timeline for representing the first plan.

[0022] Figure 8 This is a timeline representing the second plan under normal circumstances.

[0023] Figure 9 This is a timeline representing the second plan when a delay occurs. Detailed Implementation

[0024] This embodiment relates to an electronic control device with a multi-core CPU. In particular, electronic control devices installed in vehicles are constrained by fault detection time, for example, by performing microcomputer communication tasks, collision avoidance tasks, and core diagnostic tasks on a predetermined cycle. Microcomputer communication tasks have a higher priority than core diagnostic tasks; an example where core diagnostic tasks cannot be interrupted will be explained.

[0025] The embodiments will now be described with reference to the accompanying drawings.

[0026] <Hardware Configuration>

[0027] Figure 1 This is a diagram of the ECU's structure.

[0028] An ECU (Electronic Control Unit) 100, as an example of an "electronic control device," is installed in a vehicle to control other devices installed in the vehicle. The ECU 100 incorporates a microcomputer (hereinafter referred to as a microcomputer) 1, as an example of a "computer," and a microcomputer 2, as an example of an "other computer." The microcomputer 1 has a multi-core CPU 3, as an example of a "processor," which integrates various data. The multi-core CPU 3 has a first core 4, a second core 5, a diagnostic function module 6, and registers 7. The first core 4, the second core 5, the diagnostic function module 6, and the registers 7 are connected together via a bus 8 in a manner capable of communication. The microcomputer 2 controls the sensors and motors installed in the vehicle and acquires various data from them. The various data acquired by the microcomputer 2 include, for example, images and moving images captured by an onboard camera. Furthermore, the multi-core CPU 3 may have three or more cores. The microcomputer 2 only needs to have a CPU; it may or may not have a multi-core CPU.

[0029] Microcomputer 1 and microcomputer 2 are connected together in a manner that enables them to communicate with each other via an inter-microcomputer channel 9, which serves as an example of a "channel". The inter-microcomputer channel 9 transmits data between microcomputer 1 and microcomputer 2. Furthermore, the inter-microcomputer channel 9 consists of one or more physical signal lines and can be used for serial or parallel communication. The communication method and protocol can be any known technology.

[0030] The first core 4 performs an inter-microcomputer communication task as an example of a "first task" and a first core diagnostic task as an example of a "second task." The execution time of the inter-microcomputer communication task varies according to the processing volume (communication volume) of each predetermined cycle. The first core diagnostic task has a lower priority than the inter-microcomputer communication task and is prohibited from being interrupted. The inter-microcomputer communication task is the task of sending and receiving data between microcomputer 1 and microcomputer 2 via inter-microcomputer channel 9. The first core diagnostic task is the task of diagnosing faults in the first core 4.

[0031] Core 5 performs a collision avoidance task as an example of the "first task" and a second core diagnostic task as an example of the "second task." The second core diagnostic task has lower priority than the collision avoidance task and cannot be interrupted. The collision avoidance task is used to prevent the vehicle from colliding with other obstacles. The second core diagnostic task is used to diagnose faults in Core 5.

[0032] Here, the first core diagnostic task and the second core diagnostic task are configured not to execute simultaneously between the first core 4 and the second core 5. Furthermore, the inter-microcomputer communication task and the collision avoidance task are configured not to start simultaneously between the first core 4 and the second core 5.

[0033] <Functional Block Diagram>

[0034] Figure 2 This is a functional block diagram of the ECU.

[0035] The ECU 100 includes task processing units 10a and 10b, exemplified as a "first execution unit"; a task allocation unit 11, exemplified as a "first planning unit"; a diagnostic task planning unit 12, exemplified as a "second planning unit"; a diagnostic task correction unit 13, exemplified as a "correction unit"; and a diagnostic unit 14, exemplified as a "second execution unit". Task processing unit 10a corresponds to... Figure 1 The first core 4, the task processing unit 10b corresponds to Figure 1 The second core 5, the task allocation unit 11, the diagnostic task planning unit 12, the diagnostic task correction unit 13, and the diagnostic unit 14 correspond to Figure 1The diagnostic function module 6. In addition, in this embodiment, the multi-core CPU 3 has two cores, namely the first core 4 and the second core 5, and therefore has two task processing units 10a and 10b.

[0036] The task allocation unit 11 determines the tasks to be executed by each task processing unit 10a and 10b based on the interruption event 15 of routine tasks other than diagnostic tasks with higher priority and the routine task table 16 used to manage routine tasks. Specifically, the task allocation unit 11 generates a first plan to allocate inter-microcomputer communication tasks to the first core 4 and collision avoidance tasks to the second core 5.

[0037] Diagnostic Task Planning Department 12, based on routine task schedule 16 ( Figure 3 ) and Diagnostic Task Table 17 for managing diagnostic tasks ( Figure 4 The timing for each core 4 and 5 to begin core diagnostic tasks is planned. Specifically, the diagnostic task planning unit 12 generates a second plan, which assigns core diagnostic tasks to each core 4 and 5 at executable times when the inter-microcomputer communication task is not performed in the first core 4 and the collision avoidance task is not performed in the second core 5.

[0038] The diagnostic task correction unit 13 corrects the start time of the core diagnostic task generated by the diagnostic task planning unit 12. Specifically, the diagnostic task correction unit 13 times the delay time of the inter-microcomputer communication task executed by the task processing unit 10a according to the first plan and the collision avoidance task executed by the task processing unit 10b, and postpones the core diagnostic task of the second plan to a subsequent executable time based on the delay time obtained by timing.

[0039] The diagnostic unit 14 executes a core diagnostic task in each task processing unit 10a, 10 according to the second plan revised by the diagnostic task correction unit 13. Specifically, the diagnostic unit 14 causes one of the first core 4 and the second core 5 to send a core diagnostic task to the other, and causes the other to send a response result to one. The sent response result is compared with a predetermined expected value, thereby diagnosing faults in the first core 4 and the second core 5. Thus, faults in the first core 4 and the second core 5 can be diagnosed. At this time, the diagnostic unit 14 causes each task processing unit 10a, 10b that is executing the core diagnostic task to prevent the execution of other tasks. That is, the diagnostic unit 14 prevents other tasks from interrupting the core diagnostic task.

[0040] <Routine Task List 16>

[0041] Figure 3 This is an example of a typical task list.

[0042] The normal task table 16 includes, for each task other than the core diagnostic task, the allocation core 18, the priority within the allocation core (hereinafter also referred to as priority) 19, the task name 20, and the required execution time design value 21 as an example of "execution time".

[0043] Assignment core 18 is the name or ID of the core assigned during the task design for each task. Assignment core 18 is set to "first" equivalent to first core 4 and "second" equivalent to second core 5. Priority 19 within the assignment core is the priority ranking among tasks assigned to the same core. For example, priority 19 is in the range of "1" to "4".

[0044] Furthermore, such as Figure 4 As shown, in this embodiment, the priority of the core diagnostic task is set to "2" in the first core 4 and the second core 5. Therefore, the priority 19 column in the allocation core of the normal task table 16 is missing "2".

[0045] Task name 20 is the name or ID of the task determined during the task design. Task name 20 is "Inter-microcomputer communication task", "Data consistency verification task", "Data integration task", "Collision avoidance task" and "Startup generation task".

[0046] The required execution time design value 21 is a design value for the required execution time envisioned during the task design phase, serving as an example of the "execution time" for each task. For tasks with large variations in required execution time, the required execution time design value 21 can be appropriately selected based on indicators such as its average or median value. In this embodiment, the inter-microcomputer communication task, compared to the core diagnostic task, is a task whose required execution time varies greatly depending on the amount of data communication. Regarding the inter-microcomputer communication task in this embodiment, the time required to communicate with a data volume that is 1.5 times the average of the upper and lower limits of the communication volume defined in the form of design values ​​can be set as the required execution time design value 21. For example, the required execution time design value 21 for the inter-microcomputer communication task is 3 ms.

[0047] <Diagnostic Task Sheet 17>

[0048] Figure 4 This is an example of a diagnostic task table 17.

[0049] Similar to the regular task table 16, the diagnostic task table 17 includes the allocation core 18, the priority within the allocation core 19, the task name 20, and the design value for the required execution time 21 for each core diagnostic task.

[0050] In the diagnostic task table 17, priority 19 is set to "2", task name 20 is "first core diagnostic task" executed in the first core 4 and "second core diagnostic task" executed in the second core 5, and the required execution time design value 21 is set to "2ms".

[0051] <Task Allocation Department 11>

[0052] Here, the generation process of the first plan by the task allocation unit 11 will be explained. The task allocation unit 11 refers to the normal task list 16 and sequentially allocates short execution cycles starting with tasks of high priority. Thus, the task allocation unit 11 determines the timing of task processing in each core 4 and 5. In this embodiment, the task allocation unit 11 allocates a 10ms cycle for the inter-microcomputer communication task, a 20ms cycle for the data consistency check task, and a 30ms cycle for the data integration task in the first core 4; and allocates a 10ms cycle for the collision avoidance task and a 20ms cycle for the trajectory generation task in the second core 5.

[0053] Figure 5 This is an execution example under rate monotonic scheduling.

[0054] For example, in the first core 4, if the processing of a data integration task with priority "4" becomes the time to process a data consistency check task with priority "3", an interruption event 15 occurs. In this case, the first core 4 interrupts the data integration task and executes the data consistency check task, which has a higher priority than the data integration task. Furthermore, in the first core 4, if the processing of a data consistency check task with priority "3" becomes the time to process an inter-microcomputer communication task with priority "1", another interruption event 15 occurs. In this case, the first core 4 interrupts the data consistency check task and executes the inter-microcomputer communication task, which has a higher priority than the data consistency check task.

[0055] Next, after the inter-microcomputer communication task is completed, the first core 4 resumes the data consistency verification task, and after the data consistency verification task is completed, it resumes the data integration task.

[0056] That is, after all tasks with higher priority than the data integration task (data consistency verification task and inter-microcomputer communication task) have been completed, the first core 4 resumes the data integration task. This method is widely known as rate monotonic scheduling. The task allocation unit 11 can also determine the timing of task processing using scheduling algorithms other than rate monotonic scheduling.

[0057] <Diagnostic Task Planning Department 12>

[0058] Next, the generation process of the second plan of the diagnostic task planning department 12 will be explained.

[0059] Figure 6 This is an example illustrating the execution of interruption prohibition under monotonic scheduling.

[0060] Figure 6 The example of allocating the first core diagnostic task to the first core 4 through rate monotonic scheduling is illustrated.

[0061] For example, in the first core 4, if the execution of a first core diagnostic task with priority "2" overlaps with the processing time of a microcomputer communication task with priority "1", the microcomputer communication task with priority "1" cannot be executed because interruption is prohibited during the execution of the first core diagnostic task. Therefore, actions exceeding the guarantee, such as data loss, occur in microcomputer 1. Consequently, the diagnostic task planning unit 12 generates a second plan, which allocates the core diagnostic task to the core 4 at a time when it does not overlap with the processing time of tasks with higher priority than the core diagnostic task.

[0062] Figure 7 This is a timeline for representing the first plan.

[0063] Core 4 performs a priority "1" inter-microcomputer communication task at a base time of 0ms. Core 5 performs a priority "1" collision avoidance task at 3ms. Cores 4 and 5 can perform core diagnostic tasks between 5ms and 10ms and between 15ms and 20ms without overlapping with these priority "1" inter-microcomputer communication and collision avoidance tasks.

[0064] Thus, each core 4 and 5 has an opportunity to perform core diagnostic tasks every 10ms.

[0065] Figure 8 This is a timeline representing the second plan under normal circumstances.

[0066] Therefore, as Figure 8 As shown, the diagnostic task planning unit 12 sets the diagnostic start time of the first core 4 to 20n-15 [ms] and the diagnostic start time of the second core 5 to 20n-5 [ms] to generate the second plan (n is a natural number).

[0067] <Diagnostic Task Correction Department 13>

[0068] The diagnostic task correction unit 13 corrects the start time of the core diagnostic task generated by the diagnostic task planning unit 12, i.e., the second plan, based on the delay time of the inter-microcomputer communication task and collision avoidance task executed by each task processing unit 10a and 10b according to the first plan. The delay time may be equivalent to the start-up offset time of each core 4 and 5 of the task processing units 10a and 10b, or, as an example, the required execution time delayed according to the actual operating conditions, which is an example of "actual required execution time".

[0069] In this embodiment, as a constraint on fault detection time, a fault must be detected within 30ms from the occurrence of an anomaly in the first core 4 or the second core 5. In this case, each core 4 and 5 can process core diagnostic tasks between 25ms and 30ms. However, since the fault detection time is constrained to be within 30ms, each core 4 and 5 does not need to process core diagnostic tasks within this timeframe. That is, the 5ms interval between 25ms and 30ms becomes an idle time during which core diagnostic tasks are not processed. The diagnostic task correction unit 13 can use this idle time to correct the diagnostic start timing.

[0070] Figure 9 This is a timeline representing the second plan when a delay occurs.

[0071] For example, if a large amount of inter-microcomputer communication data is received at reference time 0, the first core 4 determines that the execution of the inter-microcomputer communication task, which has a designed execution time of 3.0 ms, will require 9.0 ms. The first core diagnostic task requires 2.0 ms. Therefore, if the second plan is executed directly, the timing will overlap with the next inter-microcomputer communication task. Thus, the diagnostic task correction unit 13 shifts the start time of both the first and second core diagnostic tasks 10 ms backward from the second plan, correcting the start time of the first core diagnostic task to 20n - 5 ms and the start time of the second core diagnostic task to 20n + 5 ms (where n is a natural number). In other words, the diagnostic task correction unit 13 postpones both the first and second core diagnostic tasks to the next diagnostic time.

[0072] When planning the start time of a core diagnostic task, the diagnostic task correction unit 13 can make a 10ms shift within the nearest 30ms if the fault detection time constraint is taken into account. If the next inter-microcomputer communication task also requires more than 8.0ms of execution time, the fault detection time constraint cannot be met. Therefore, the diagnostic task correction unit 13 can notify the multi-core CPU 3 of the occurrence of the anomaly and switch it to a decomposition mode or shutdown, or other prescribed anomaly detection response mode.

[0073] According to this configuration, the ECU 100 has a multi-core CPU 3, which has a first core 4 and a second core 5. The first core 4 and the second core 5 execute inter-computer communication tasks and collision avoidance tasks whose execution time varies according to the communication volume in each predetermined cycle, as well as first core diagnostic tasks and second core diagnostic tasks with lower priority than inter-computer communication tasks and collision avoidance tasks and which are prohibited from being interrupted. The first core diagnostic tasks and second core diagnostic tasks are set to not be performed simultaneously between the first core 4 and the second core 5. The ECU 100 has a task allocation unit 11, a diagnostic task planning unit 12, task processing units 10a and 10b, a diagnostic task correction unit 13, and a diagnostic unit 14. The task allocation unit 11 generates a first plan, which allocates inter-computer communication tasks to the first core 4 and collision avoidance tasks to the second core 5. The diagnostic task planning unit 12 generates a second plan, which allocates first core diagnostic tasks to the first core 4 and second core diagnostic tasks to the second core 5 during executable periods when inter-computer communication tasks and collision avoidance tasks are not being executed. Task processing unit 10a executes the inter-computer communication task according to the first plan, and task processing unit 10b executes the collision avoidance task according to the first plan. Diagnostic task correction unit 13 times the delay time of the inter-computer communication task and the collision avoidance task executed by task processing units 10a and 10b, and postpones the first core diagnostic task and the second core diagnostic task of the second plan to a later executable time based on the timed delay time. Diagnostic unit 14 executes the first core diagnostic task in the first core 4 and the second core diagnostic task in the second core 5 according to the second plan corrected by diagnostic task correction unit 13. Therefore, even if the inter-computer communication task or the collision avoidance task is delayed, the first core diagnostic task and the second core diagnostic task can be executed at a time that does not overlap with the inter-computer communication task and the collision avoidance task, thus ensuring the execution time of the first core diagnostic task and the second core diagnostic task while maintaining the priority of each task. Therefore, tasks can be executed appropriately in the ECU 100 equipped with a multi-core CPU 3 having a first core 4 and a second core 5.

[0074] The system includes a microcomputer 1 with a multi-core CPU 3 and a microcomputer-to-microcomputer channel 9 connecting microcomputer 1 and microcomputer 2. Within each specified cycle, tasks whose execution time varies depending on communication volume include microcomputer-to-microcomputer communication diagnostic tasks that are transmitted and received between microcomputer 1 and microcomputer 2 via the microcomputer-to-microcomputer channel 9. This allows for the maintenance of communication priority between microcomputer 1 and microcomputer 2.

[0075] Compared to inter-microcomputer communication tasks and collision avoidance tasks, the tasks with lower priority and prohibited from interruption are the first core diagnostic tasks and second core diagnostic tasks for the first core 4 and second core 5, which have limited fault detection time. Therefore, the first core 4 and second core 5 can execute the first core diagnostic tasks and second core diagnostic tasks in a manner that does not overlap with the execution time of the inter-microcomputer communication tasks and collision avoidance tasks, thus meeting the fault detection time constraint. As a result, the reliability of ECU 100's operation can be improved.

[0076] The delay time is the startup offset time of the first core 4 and the second core 5, or the actual execution time required for the inter-microcomputer communication task and the collision avoidance task. Therefore, even if the startup of the first core 4 and the second core 5 is delayed, or the required execution time of the inter-microcomputer communication task and the collision avoidance task is extended, the first core diagnostic task and the second diagnostic task can still be executed appropriately.

[0077] The diagnostic task correction unit 13 postpones the first core diagnostic task and the second core diagnostic task to the earliest executable time among multiple subsequent executable times. This shortens the execution time intervals of the first and second core diagnostic tasks, thereby meeting the constraints of fault detection time.

[0078] If the execution timing of the first core diagnostic task, which is postponed in the first core 3, overlaps with that of the second core diagnostic task in the second core 5, the diagnostic task correction unit 13 postpones the second core diagnostic task of the second core 5 to a later executable time. Thus, the constraints on the fault detection time of the first core diagnostic task in the first core 3 and the fault detection time of the second core diagnostic task in the second core 5 are both satisfied.

[0079] Furthermore, the present invention includes various modifications and is not limited to the above embodiments.

[0080] For example, the diagnostic task planning unit 12 can also change the fault detection time according to the vehicle's driving status. Specifically, when it is possible to select an urban mode for driving in urban areas and a high-speed mode for driving on highways, the ECU 100 sets the fault detection time in high-speed mode to be shorter than that in urban mode. In this case, the microcomputer communication task in high-speed mode can be set to 1ms. Thus, the microcomputer communication task can be executed appropriately according to the vehicle's driving status.

[0081] The diagnostic task planning unit 12 first assigns diagnostic tasks to the cores with longer communication task execution times, either the first core 4 or the second core 5. This allows for easy assignment of either first or second core diagnostic tasks to cores with longer execution times.

[0082] For example, if the execution times of the first core diagnostic task and the second core diagnostic task are different, the diagnostic task planning unit 12 can assign the first core diagnostic task or the second core diagnostic task to the first core 4 or the second core 5 that has the longer execution time. This allows for easy assignment of the diagnostic task with the longer execution time to the first core 4 or the second core 5, thereby ensuring the appropriate execution of both the first and second core diagnostic tasks.

[0083] Furthermore, if tasks other than inter-microcomputer communication tasks are set as tasks with higher priority than core diagnostic tasks, the ECU 100 may not have microcomputer 2 and inter-microcomputer channel 9.

[0084] Symbol Explanation

[0085] 1…Microcomputer, 2…Microcomputer, 3…Multi-core CPU, 4…First core, 5…Second core, 9…Inter-microcomputer channel, 10a…Task processing unit, 10b…Task processing unit, 11…Task allocation unit, 12…Diagnostic task planning unit, 13…Diagnostic task correction unit, 14…Diagnostic unit, 100…ECU.

Claims

1. An electronic control device, comprising: a computer including a processor having a plurality of cores, the processor executing a first task and a second task, the first task being executed in each predetermined period with a time varying according to a processing amount, the second task being lower in priority than the first task and being prohibited from being interrupted, the first task including a communication task transmitted and received between the computer and another computer via a channel, the second task being set not to be executed simultaneously among the plurality of cores, the electronic control device characterized by comprising: a first planning unit that generates a first plan allocating the first task to each of the cores; a second planning unit that generates a second plan allocating the second task to each of the cores in an executable opportunity in which the first task is not executed; a first execution unit that executes the first task according to the first plan; a correction unit that time-logs a delay time of the first task executed by the first execution unit, and defers the second task of the second plan to a subsequent executable opportunity according to the delay time obtained by the time-logging; and a second execution unit that executes the second task in each of the cores according to the second plan corrected by the correction unit.

2. The electronic control device according to claim 1, characterized in that the second task is a core diagnosis task for the plurality of cores, the core diagnosis task being restricted in a failure detection time.

3. The electronic control device according to claim 1, characterized in that the delay time is a start-up offset time of the plurality of cores or an actual required execution time of the first task.

4. The electronic control device according to claim 2, characterized in that the correction unit defers the core diagnosis task to an earliest executable opportunity among a plurality of the subsequent executable opportunities.

5. The electronic control device according to claim 2, characterized in that the plurality of cores include a first core and a second core, in a case where the core diagnosis task deferred in the first core overlaps with an execution opportunity of the core diagnosis task of the second core, the correction unit defers the core diagnosis task of the second core to the subsequent executable opportunity.

6. The electronic control device according to claim 5, characterized in that the second execution unit causes one of the first core and the second core to transmit the core diagnosis task to the other, and causes the other to transmit a reply result, compares the transmitted reply result with an expected result decided in advance, and thereby diagnoses a failure of the first core and the second core.

7. The electronic control device according to claim 2, characterized in that the electronic control device is an electronic control device that controls a vehicle, and the second planning unit changes the failure detection time according to a traveling environment of the vehicle.

8. The electronic control device according to claim 2, characterized in that ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ The second planning unit allocates the core diagnosis task to a core that takes a long time to execute the first task among the plurality of cores.

9. The electronic control device according to claim 2, wherein The second planning unit allocates the core diagnosis task to a core that executes a core diagnosis task that takes a long time among the plurality of core diagnosis tasks.

Images