VEHICLE CONTROL UNIT AND CONTROL METHOD

Abstract

A vehicle control unit includes: a first computing unit powered by a first power supply system and a first environment which is a first execution environment capable of executing applications;and a second computing unit powered by a second power supply system and comprising a second environment, which is a second execution environment capable of running applications, wherein the first computing unit includes a first redundant execution control unit that controls the execution of the applications in the first environment, the second computing unit includes a second redundant execution control unit that controls the execution of the applications in the second environment, and the first redundant execution control unit and the second redundant execution control unit cause a specific application that satisfies a predefined condition to run simultaneously in the first environment and in the second environment.

Description

Technical field

[0001] The present invention relates to a vehicle control device and a control method. background

[0002] In the automotive sector, electronic vehicle control units (ECUs), which control sensors, actuators, and the like, have been widely used to manage a vehicle's driving state through a microcomputer and software. With the development of technologies such as autonomous driving and electrification in recent years, the functions required for ECUs are increasing. Furthermore, the number of ECUs installed in a car has increased, and the reliability required for ECUs has also risen. For example, in an autonomous driving system, if the autonomous driving level for which the system is responsible is "3" or higher, a fault tolerance must be in place that allows the system to continue control even if a power supply fails. PTL 1 discloses a redundant system.which is installed in a vehicle capable of autonomous driving and includes at least a first power supply system and a second power supply system distinct from the first power supply system, wherein the redundant system includes: an operational control main control unit that executes a process to enable the vehicle to drive autonomously; and an operational control sub-control unit that is used in place of the operational control main control unit when an anomaly is detected with respect to the operational control main control unit, wherein the operational control main control unit is connected to the first power supply system and not to the second power supply system, and the operational control sub-control unit is connected to the second power supply system and not to the first power supply system. Citation list for patent literature

[0003] PTL 1: WO 2022 / 118459 A Overview of the invention Technical problem

[0004] The invention described in PTL 1 has room for improvement in terms of redundancy of the power supply and redundancy of the execution. Solution to the problem

[0005] A vehicle control device according to a first aspect of the present invention comprises: a first computing unit which is supplied with power by a first power supply system and has a first environment which is a first execution environment which enables the execution of applications;and a second computing unit, which is powered by a second power supply and has a second environment, which is a second execution environment that enables the execution of applications, wherein the first computing unit contains a first application control unit that controls the execution of the applications in the first environment, the second computing unit contains a second application control unit that controls the execution of the applications in the second environment, and the first application control unit and the second application control unit execute a specific application that satisfies a predefined condition simultaneously in the first environment and the second environment.

[0006] A control method according to a second aspect of the present invention is a control method implemented by a vehicle control device comprising a first computing unit powered by a first power supply system and having a first environment that is a first execution environment enabling the execution of applications, and a second computing unit powered by a second power supply system and having a second environment that is a second execution environment enabling the execution of applications, wherein the first computing unit includes a first application control unit that controls the execution of the applications in the first environment, and the second computing unit includes a second application control unit that controls the execution of the applications in the second environment.wherein the control method involves the simultaneous execution of a specific application that satisfies a predefined condition in the first environment and the second environment by the first application control unit and the second application control unit. Advantageous effects of the invention

[0007] According to the present invention, power supply redundancy and execution redundancy can be efficiently achieved in a vehicle control unit. Further features, configurations, and effects not described above will become apparent from the embodiments described below. Brief description of the drawings [ Fig. 1] Fig. Figure 1 is a configuration diagram of an ECU. [ Fig. 2] Fig. Figure 2 is a diagram illustrating a configuration of a first application control unit. [ Fig. 3] Fig. Figure 3 is a diagram illustrating a configuration of a second application control unit. [ Fig. 4] Fig. Figure 4 is a view that illustrates an example of an initial application list and an initial requirements table. [ Fig. 5] Fig. Figure 5 is a view illustrating an example of a first execution plan and a second execution plan. [ Fig. 6] Fig. Figure 6 is a flowchart illustrating the processing of a first normal planning unit. [ Fig. 7] Fig. Figure 7 is a flowchart illustrating the processing of an initial result comparison unit. [ Fig. 8] Fig. Figure 8 is a flowchart illustrating the processing of a first other error detection unit. [ Fig. 9] Fig. Figure 9 is a flowchart illustrating the processing of a first degeneration determination unit. [ Fig. 10] Fig. Figure 10 is a flowchart illustrating the processing of a first degeneration planning unit. [ Fig. 11] Fig. Figure 11 is a configuration diagram of an ECU in a first modification. Description of the embodiments / design forms-

[0008] The following describes embodiments of a vehicle control device and a control method with reference to the Fig. 1 to 10 described.

[0009] Fig. Figure 1 is a diagram of an ECU (Electronic Control Unit) 9, which is a vehicle control device. A first battery 31 and a second battery 32 are connected to the ECU 9. The ECU 9 contains a first processing unit 1, a second processing unit 2, a first power supply IC 311, which is connected to the first battery 31 and supplies power to the first processing unit 1, and a second power supply IC 321, which is connected to the second battery 32 and supplies power to the second processing unit 2. The first processing unit 1 and the second processing unit 2 are, for example, independent SoCs (Systems on a Chip).

[0010] The configurations of the first processing unit 1 and the second processing unit 2 are essentially the same, and there is no particular superiority or inferiority in performance. However, for the sake of simplicity, the first processing unit 1 can be referred to as the "main" and the second processing unit 2 as the "subordinate." Both the first battery 31 and the second battery 32 are power supplies that provide power to the ECU 9. These two systems can also be referred to as the "first power supply system" and the "second power supply system."

[0011] The ECU 9 further includes an Intermediate Control Unit-Communication Unit 41, a First Communication Path 42, a Second Communication Path 43, a First Onboard Communication Unit 44, and a Second Onboard Communication Unit 45. The Intermediate Control Unit-Communication Unit 41 connects the First Control Unit 1 and the Second Control Unit 2. The First Communication Path 42 connects the Second Control Unit 2 and the First Power Supply IC 311. The Second Communication Path 43 connects the First Control Unit 1 and the Second Power Supply IC 321. The First Onboard Communication Unit 44 is a communication path powered by the First Battery 31 and communicates with other control devices in a vehicle.The second on-board communication unit 45 is a communication path that is powered by the second battery 32 and communicates with the other control devices in the vehicle.

[0012] The configurations of the first compute unit 1 and the second compute unit 2 are essentially the same, and configurations with similar names perform the same operations. The following describes the first compute unit 1 in detail as a representative of both the first compute unit 1 and the second compute unit 2, and also describes the differences of the second compute unit 2. The first compute unit 1 contains a first main core 16 and a first subcore 17, which perform computations, as well as a first intrinsic error determination unit 18. The first main core 16 and the first subcore 17 have different names only for the sake of simplicity. The first main core 16 and the first subcore 17 can have the same hardware configuration or different hardware configurations.The first main core 16 and the first subcore 17 can be different processing cores contained in the same physical package, or they can be processing cores contained in different physical packages.

[0013] The first intrinsic error detection unit 18 operates independently of the first main core 16 and the first subcore 17 and detects an error in the first processing unit 1. The first intrinsic error detection unit 18 is, for example, a microcomputer. For instance, the first intrinsic error detection unit 18 diagnoses the normality of the volatile memory and non-volatile memory that comprise the first processing unit 1. If it finds a non-writable area or an area where a value other than a written value is read, the first intrinsic error detection unit 18 determines that an error has occurred in the first processing unit 1.

[0014] The first main core 16 and the first subcore 17 load a program stored in a ROM (not shown) into a RAM (not shown) and execute the program, thereby implementing a first OS 15, a first hypervisor 14, a first result comparison unit 11, a first application control unit 12, and a first other error detection unit 13. The first OS 15 is an operating system, and the first hypervisor 14, the first result comparison unit 11, the first application control unit 12, and the first other error detection unit 13 run on the first OS 15.

[0015] The first hypervisor 14 is an execution environment for virtual machines (VMs). The virtual machine images are stored in a storage device (not shown) contained in the first computing unit 1, or in a storage device in the vehicle connected via the first onboard communication unit 44. Each virtual machine runs an application. Therefore, in the present embodiment, each virtual machine is considered an application. Thus, the first hypervisor 14 can also be referred to as an application execution environment.

[0016] There is a wide variety of virtual machines that can run on the first Hypervisor 14. In the present embodiment, the virtual machine is identified by a combination of "VM" and a number. Fig. VM1 to VM4 operate on the first hypervisor 14, but the present invention is not limited thereto. The virtual machine will be described in detail later. The first result comparison unit 11 compares a computation result of the first computation unit 1 with a computation result of the second computation unit 2. The first application control unit 12 controls the execution of an application in the first computation unit 1, that is, the execution of a virtual machine. The first other error detection unit 13 detects an error in the second computation unit 2.

[0017] The second processing unit 2 contains a second main core 26 and a second subcore 27, which perform calculations, and a second intrinsic error detection unit 28. The second intrinsic error detection unit 28 operates independently of the second main core 26 and the second subcore 27 and detects an error in the second processing unit 2. The second main core 26 and the second subcore 27 load a program stored in a ROM (not shown) into a RAM (not shown) and execute the program, thereby implementing a second OS 25, a second hypervisor 24, a second result comparison unit 21, a second application control unit 22, and a second other error detection unit 23. The second other error detection unit 23 detects an error in the first processing unit 1.

[0018] In Fig. VM1, VM2, VM5, and VM6 run on the second hypervisor 24. VM1 and VM2 are the same as VM1 and VM2 running on the first hypervisor 14 of the first compute unit 1. That is, VM1 and VM2 are executed redundantly in the first compute unit 1 and the second compute unit 2.

[0019] Fig. Figure 2 is a diagram illustrating a configuration of the first application control unit 12 in the first compute unit 1. The first application control unit 12 includes, as functions, a first normal scheduling unit 121, which creates an execution plan for an application during normal operation; a first degradation determination unit 122, which determines whether to switch to degradation control when an anomaly occurs; and a first degradation scheduling unit 123, which creates an execution plan for an application during degradation control. The first application control unit 12 contains a first execution plan 124, a first application list 125, and a first request table 126, which are data. The first application control unit 12 executes an application on the first hypervisor 14 based on the first execution plan 124.

[0020] The first execution plan 124 is an execution plan for an application in the first computing unit 1. The first execution plan 124 is created by the first normal planning unit 121 or the first degradation planning unit 123. The first application list 125 is a list of applications to be executed in the first computing unit 1. The first requirements table 126 stores an ASIL (Automotive Safety Integrity Level) level (hereafter referred to as the "requirement level") requested by each application. Note that the ASIL level is also referred to hereafter as the "functional safety level." The first requirements table 126 stores at least the requirement level of the application described in the first application list 125.

[0021] Fig. Figure 3 is a diagram illustrating a configuration of the second application control unit 22 in the second compute unit 2. The second application control unit 22 contains a second normal scheduling unit 221, which creates an execution plan for an application during normal operation; a second degradation determination unit 222, which determines whether to switch to degradation control when an anomaly occurs; and a second degradation scheduling unit 223, which controls the execution plan during degradation control. The second application control unit 22 contains a second execution plan 224, a second application list 225, and a second request table 226, which are data. The second application control unit 22 executes an application on the second hypervisor 24 based on the second execution plan 224.

[0022] The second execution plan 224 is an execution plan for an application in the second computing unit 2. The second execution plan 224 is created by the second normal planning unit 221 or by the second degeneration planning unit 223. The second application list 225 is a list of applications to be executed by the second computing unit 2. The second requirements table 226 stores a requirements level requested by each application. The second requirements table 226 stores at least the requirements level of the application described in the second application list 225.

[0023] Fig. Figure 4 is a view showing an example of the first application list 125 and the first request table 126 in the first compute unit 1. VM1 to VM4 and VM7 to VM8 are stored in the first application list 125. The first request table 126 describes the request level of each application from VM1 to VM10, which is contained in the first application list 125. The request level is 6 or higher only in VM1 and VM2, and the request level in VM3 and subsequent virtual machines is 5 or lower.

[0024] Fig. Figure 5 is a view showing two examples of the first execution plan 124 and the second execution plan 224. A first example of the first execution plan 124 and the second execution plan 224 is shown in two upper parts of Fig. 5 is shown, and a second example of the first execution plan 124 and the second execution plan 224 is shown in two lower parts of Fig. 5 shown. Fig. In 5, branch numbers 1 and 2 have been added to distinguish the first example from the second example.

[0025] The first execution plan 124 specifies an application to be executed for each time slot (L0, L1, ...) representing a computation cycle for each of the first main core 16 and the first subcore 17. The second execution plan 224 specifies an application to be executed for each time slot for each of the second main core 26 and the second subcore 27.

[0026] In the first example of Fig. Section 5 describes that both the first main core 16 and the second main core 26 execute the application VM1 in timeslot L0. In the same timeslot L0, the first subcore 17 and the second subcore 27 execute different applications. Furthermore, it describes that all cores execute different applications in timeslot L2.

[0027] In the second example of Fig. In section 5, a first execution plan 1241-2 is empty, and a second execution plan 2241-2 describes simultaneous execution by two cores. Specifically, VM1 is assigned to the second main core 26 and the second subcore 27 in timeslot L0, and VM2 is assigned to the second main core 26 and the second subcore 27 in timeslot L1.

[0028] Fig. Figure 6 is a flowchart illustrating the processing of the first normal planning unit 121 in the first calculation unit 1. The following description also details specific operations using values ​​from the first application list 125 and the first requirements table 126, which are located in Fig. 4 are shown and described.

[0029] First, in step S301, the first normal planning unit 121 initializes a variable i to "1". In the subsequent step S302, the first normal planning unit 121 reads the i-th element in the first application list 125. For example, during the first execution, the first element, that is, "VM1", is read in the example of Fig. 4. Read. In the subsequent step S303, the first normal planning unit 121 refers to the first requirements table 126 and determines whether a requirement level of the application read in step S302 is higher than 5 or not. The first normal planning unit 121 proceeds to step S304 if it determines that the requirement level is higher than 5, and proceeds to step S305 if it determines that the requirement level is 5 or lower.

[0030] In step S304, the first normal planning unit 121 registers the application read in step S302 in the first execution plan 124 to perform redundant execution in coordination with the second compute unit 2, and then proceeds to step S306. Redundant execution means that both the first compute unit 1 and the second compute unit 2 execute the same application in the same time slot. For example, in step S304, since the request level of "VM1" is "9", the first normal planning unit 121 coordinates with the second normal planning unit 221 of the second compute unit 2 and performs the registration in time slot L0 of the first execution plan 124.

[0031] In step S305, the first normal planning unit 121 registers the application read in step S302 in the first execution plan 124 to perform a single execution and proceeds to step S306. In this case, the application read in step S302 is simply registered, as simultaneous execution with the second calculation unit 2 is not required.

[0032] In step S306, the first normal planning unit 121 determines whether the first application list 125 has been read to the end or not. The first normal planning unit 121 terminates the process in Fig. The processing described in step 6 occurs when it determines that the first application list 125 has been read to the end, and proceeds to step S307 if it determines that the first application list 125 has not been read to the end. In step S307, the first normal planning unit 121 increments the variable i by "1" and returns to step S302. The above is a description of Fig. 6.

[0033] Note that the processing of the second normal planning unit 221 is essentially the same as that in Fig. Figure 6 shows the processing of the first normal planning unit 121. The differences lie in the following three points. The first point is that in steps S302 and S306, the target is not the first application list 125, but the second application list 225. The second point is that in step S304, the coordination is not with the second calculation unit 2, but with the first calculation unit 1. The third point is that in steps S304 and S305, the second execution plan 224 is registered, not the first execution plan 124.

[0034] Fig. Figure 7 is a flowchart illustrating the processing of the first result comparison unit 11. For example, immediately after the end of each time slot of the first execution plan 124, the first result comparison unit 11 is executed for each computation result in the immediately preceding time slot whose execution is complete. For example, in the upper part of Fig. In the example shown in Figure 5, a first execution plan 1241-1 executes VM1 and VM3 in time slot L0. Therefore, immediately after time slot L0, the first result comparison unit 11 for VM1 and VM3 of time slot L0 is executed individually.

[0035] First, in step S311, the first result comparison unit 11 determines whether a target application was executed redundantly or not. This determination can be made, for example, based on the name of the executed application and the first requirements table 126. The first result comparison unit 11 proceeds to step S312 if it determines that the target application was executed redundantly and terminates the process in Fig. 7. Processing shown, when it determines that the target application was not executed redundantly. For example, the first result comparison unit 11 that was executed for VM1 proceeds to step S312, and the first result comparison unit 11 that was executed for VM3 terminates the processing shown in Fig. 7 processing shown.

[0036] In step S312, the first result comparison unit 11 captures a calculation result of the target application in its own calculation unit, that is, the first calculation unit 1. In the subsequent step S313, the first result comparison unit 11 captures a calculation result of the same target application in the other calculation unit, that is, the second calculation unit 2. In the subsequent step S314, the first result comparison unit 11 determines whether the calculation results of its own calculation unit and the other calculation unit are the same or not. In other words, it determines whether the calculation results of the application executed by the first calculation unit 1 and the second calculation unit 2 are the same or not. The first result comparison unit 11 then completes the process in Fig. 7. Processing shown, if it finds that the calculation results are the same, and proceeds to step S315 if it finds that the calculation results are not the same.

[0037] In step S315, the first result comparison unit 11 activates the first intrinsic defect determination unit 18 to detect an intrinsic defect. In the subsequent step S316, the first result comparison unit 11 determines the presence or absence of an intrinsic defect. The first result comparison unit 11 proceeds to step S317 if it determines that an intrinsic defect is present and terminates the process. Fig. The processing described in section 7 occurs when it determines that no intrinsic error exists. In step S317, the first result comparison unit 11 notifies the other about the intrinsic error and terminates the processing described in section 7. Fig. 7. Processing shown. In particular, the second processing unit 2 is informed of the fact that the first processing unit 1 has failed.

[0038] Note that the processing of the second result comparison unit 21 is essentially the same as in Fig. 7. Processing of the first result comparison unit 11 is shown. The differences lie in the following three points. The first point is that the targets of the own calculation unit and the other calculation unit are swapped in steps S312 and S313. The second point is that the second own error determination unit 28 is activated in step S315. The third point is that a target to which an error is reported in step S317 is the first calculation unit 1.

[0039] Fig. Figure 8 is a flowchart illustrating the processing of the first other fault detection unit 13. First, in step S321, the first other fault detection unit 13 confirms communication with the other power supply IC. Specifically, the first other fault detection unit 13 communicates with the second power supply IC 321 using the second communication path 43, which connects the first compute unit 1 and the second power supply IC 321. In the subsequent step S322, the first other fault detection unit 13 determines whether the communication with the other power supply IC was successful.The first other error detection unit 13 proceeds to step S323 if it determines that communication with the second communication path 43 was successful, and proceeds to step S325 if it determines that communication with the second communication path 43 was not successful.

[0040] In step S323, the first other fault detection unit 13 determines whether an internal fault has been reported by the other, that is, whether the message according to step S117 in Fig. 7 was received from the second computing unit 2 or not. The first other error detection unit 13 proceeds to step S325 if it determines that the intrinsic error was reported by the second computing unit 2, and proceeds to step S324 if it determines that the intrinsic error was not reported by the second computing unit 2. In step S324, the first other error detection unit 13 determines that the second computing unit 2 is normal and terminates the process. Fig. 8 processing shown. In step S325, the first other fault detection unit 13 determines that the second calculation unit 2 has failed and terminates the process shown. Fig. 8 processing shown.

[0041] Note that the processing of the second other fault detection unit 23 is essentially the same as that in Fig. 8. Processing of the first other fault detection unit 13. The differences lie in the following three points. The first point is that a target in steps S321 and S322 is not the second power supply IC 321, but the first power supply IC 311. The second point is that in step S323, the presence or absence of a notification of an intrinsic fault from the first computational unit 1 is determined. The third point is that a target for determining normality and anomaly in steps S324 and S325 is not the second computational unit 2, but the first computational unit 1.

[0042] Fig. Figure 9 is a flowchart illustrating the processing of the first degeneration determination unit 122. Initially, in step S331, the first degeneration determination unit 122 references a processing result of the first other error determination unit 13 and determines whether the second calculation unit 2 is normal or not. The first degeneration determination unit 122 then completes the processing in Fig. The processing described in step 9 is completed if it determines that the second computing unit 2 is normal, and proceeds to step S332 if it determines that the second control unit is not normal. In step S332, the first degeneration determination unit 122 causes the first computing unit 1 to switch to degeneration control, and terminates the processing shown in Fig. 9. Processing shown. As described above, when switching to degeneration control, the first degeneration planning unit 123 creates the first execution plan 124 instead of the first normal planning unit 121.

[0043] Note that the processing of the second degeneration determination unit 222 is essentially the same as that in Fig. Figure 9 shows the processing of the first degeneration determination unit 122. The differences lie in the following two points. The first point is that in step S331, a processing result of the second other fault determination unit 23 is referenced. The second point is that the item to be switched to degeneration control in step S332 is the second calculation unit 2.

[0044] Fig. Figure 10 is a flowchart illustrating the processing of the first degeneration planning unit 123. The same process as that in Fig. The first normal planning unit 121, shown in Figure 6, is designated by the same step number, and its description is omitted. In step S341, the first degeneration planning unit 123 integrates the first application list 125 and the second application list 225 into an integrated application list. In the subsequent step S301, the variable i is initialized to "1". In the following step S302A, the first degeneration planning unit 123 reads the i-th application from the integrated application list created in step S341.

[0045] In step S304A, which is executed if a positive decision is made in step S303, the first degradation planning unit 123 registers the application read in step S302A in the first execution plan 124 so that it is executed redundantly within the first compute unit 1. In this case, a schedule is created such that the first main core 16 and the first subcore 17 perform redundant execution within the first compute unit 1. The process of step S305 is similar to that of the first normal planning unit 121. In step S306A, the first degradation planning unit 123 determines whether the integrated application list has been read to completion. The first degradation planning unit 123 then completes the process in Fig. 10. Processing shown if it determines that the integrated application list has been read to the end, and proceeds to step S307 if it determines that the integrated application list has not been read to the end.

[0046] Note that the processing of the second degeneration planning unit 223 is essentially the same as that in Fig. Figure 10 shows the processing of the first degeneration planning unit 123. The differences lie in the following two points. The first point is that the registration is carried out in such a way that redundant execution is performed within the second computation unit 2 in step S304A. The second point is that the registration target in steps S304A and S305 is not the first execution plan 124 but the second execution plan 224.

[0047] According to the embodiment described above, the following operational effects can be achieved. (1) The ECU 9, which is a vehicle control unit, comprises: the first computing unit 1, which is powered by the first battery 31, which is a first power supply system, and contains the first hypervisor 14, which is a first execution environment capable of running applications; and the second computing unit 2, which is powered by a second power supply system and contains the second hypervisor 24, which is a second execution environment capable of running applications. The first computing unit 1 comprises the first application control unit 12, which controls the execution of applications in the first hypervisor 14. The second computing unit 2 comprises the second application control unit 22, which controls the execution of applications in the second hypervisor 24.The first application control unit 12 and the second application control unit 22 cause the first hypervisor 14 and the second hypervisor 24 to simultaneously execute a specific application that meets a predefined condition. In this way, the first compute unit 1 and the second compute unit 2, which are connected to different batteries, are provided within the ECU 9 to execute the application redundantly. Therefore, execution redundancy of the specific application can be ensured, while power supply redundancy is ensured by the individual ECU 9. (2) The first application control unit 12 contains the first normal scheduling unit 121, which determines a functional safety level requested by each of the applications and creates the first execution plan 124 such that the application with the functional safety level higher than a predefined threshold is executed concurrently with the specific application. The second application control unit 22 contains the second normal scheduling unit 221, which determines the functional safety level requested by each of the applications and creates the second execution plan 224 such that the application with the functional safety level higher than a predefined threshold is executed concurrently with the specific application. The first application control unit 12 executes an application on the first hypervisor 14 based on the first execution plan 124.The second application control unit 22 runs an application on the second hypervisor 24 based on the second execution plan 224. (3) The first computational unit 1 contains the first other fault detection unit 13, which detects an anomaly in the second computational unit 2, and the first degeneration planning unit 123, which causes the first computational unit 1 to execute degeneration control when the first other fault detection unit 13 detects the anomaly in the second computational unit 2. The second computational unit 2 contains the second other fault detection unit 23, which detects an anomaly in the first computational unit 1, and the second degeneration planning unit 223, which causes the second computational unit 2 to execute degeneration control when the second other fault detection unit 23 detects the anomaly in the first computational unit 1. Thus, if the anomaly occurs in one of the first computational unit 1 and the second computational unit 2, the other performs the degeneration control. (4) The first computational unit 1 contains the first intrinsic error detection unit 18, which detects an error in the first computational unit 1 and notifies the second computational unit 2 of the error. The second computational unit 2 contains the second intrinsic error detection unit 28, which detects an error in the second computational unit 2 and notifies the first computational unit 1 of the error. When the error in the second computational unit 2 is reported by the second intrinsic error detection unit 28, the first other error detection unit 13 assumes that the anomaly in the second computational unit 2 has been detected. When the error in the first computational unit 1 is reported by the first intrinsic error detection unit 18, the second other error detection unit 23 assumes that the anomaly in the first computational unit 1 has been detected. (5) If a calculation result of the specific application in the first computing unit 1 differs from a calculation result of the specific application in the second computing unit 2, the first computing unit 1 causes the first intrinsic error determination unit 18 to determine the error of the first computing unit (S314 in Fig. 7: NO, p. 315). If the calculation result of the specific application in the first computing unit 1 differs from the calculation result of the specific application in the second computing unit 2, the second computing unit 2 causes the second intrinsic error determination unit 28 to determine the error of the second computing unit 2. Therefore, the intrinsic error can be determined at a suitable time. (6) The first other fault determination unit 13 determines the fault of the second computing unit 2 based on a communication state with the second power supply IC 321 connected to the second battery 32. The second other fault determination unit 23 determines the fault of the first computing unit 1 based on a communication state with the first power supply IC 311 connected to the first battery 31. Therefore, the fault can be determined based on the communication state. (7) The first computation unit 1 is powered by the first power supply IC 311, which is connected to the first battery 31. The second computation unit 2 is powered by the second power supply IC 321, which is connected to the second battery 32. The ECU 9 includes the first communication path 42, which connects the first power supply IC 311 and the second computation unit 2, and the second communication path 43, which connects the second power supply IC 321 and the first computation unit 1. The second fault detection unit 23 determines that the first battery 31 is abnormal if no predefined response can be received from the first power supply IC 311 via the first communication path 42.The first other error detection unit 13 determines that the second battery 32 is abnormal if no predefined response can be received from the second power supply IC 321 via the second communication path 43. Therefore, it is possible to determine the error of the other calculation unit due to the lack of a response from the power supply IC. (8) The first compute unit 1 contains the first main kernel 16 and the first subkernel 17, which can perform computations independently. The second compute unit 2 contains the second main kernel 26 and the second subkernel 27, which can perform computations independently. Degradation control in the first compute unit 1 consists of the specific application being executed concurrently by the first main kernel 16 and the first subkernel 17 in the first compute unit 1. Degradation control in the second compute unit 2 consists of the specific application being executed concurrently by the second main kernel 26 and the second subkernel 27 in the second compute unit 2. Thus, if an anomaly occurs in either the first compute unit 1 or the second compute unit 2, the other compute unit executes the specific application redundantly.This means that since the first computing unit 1 and the second computing unit 2, which are connected to different batteries, are provided within the ECU 9 to perform redundant operation according to the functional safety level, it is possible to ensure the execution redundancy required for functional safety while simultaneously ensuring power supply redundancy through the individual ECU 9. This has the effect of guaranteeing reliability during a so-called minimum risk maneuver operation, such as driving to a safety zone or stopping, if the battery in one system fails.Since the control calculation was performed before the error occurred, this also has the effect that no problem arises with regard to real-time properties such as switching and starting an application at the time of switching to degeneration control. (First modification)

[0048] In the embodiment described above, a processing unit, which is a SoC, is connected to each battery. However, multiple SoCs can be connected to one battery, or the number of SoCs to be connected can vary.

[0049] Fig. Figure 11 is a diagram illustrating a configuration of an ECU 9A according to a first modification. The ECU 9A differs from that of the embodiment in that the ECU 9A contains a third processing unit 3. In Fig. For the sake of simplicity, detailed configurations of the first computing unit 1 and the second computing unit 2 have been omitted from Figure 11. Furthermore, the second communication path 43 and the first onboard communication unit 44 are also present, similar to the embodiment. A configuration unique to this modification is described below.

[0050] The third processing unit 3 contains a third main core 36 and a third subcore 37, which perform calculations, as well as a third intrinsic error detection unit 38. The third intrinsic error detection unit 38 operates independently of the third main core 36 and the third subcore 37 and detects an error in the third processing unit 3. The third main core 36 and the third subcore 37 load a program stored in a ROM (not shown) into a RAM (not shown) and execute the program, thereby implementing an OS 35, a hypervisor 34, a third result comparison unit 11-2, a third application control unit 12-2, and a third other error detection unit 33. The OS 35 is an operating system, and the hypervisor 34, the third result comparison unit 11-2, the third application control unit 12-2, and the first other error detection unit 13 run on the OS 35.The first other error determination unit 13 works with the second calculation unit 2 as its target and is thus used jointly by the first calculation unit 1 and the third calculation unit 3.

[0051] The ECU 9A further includes a second intermediate control unit communication unit 41-2, a third communication path 43T, and a third onboard communication unit 44T. The second intermediate control unit communication unit 41-2 is a communication path that connects the third control unit 3 and the second control unit 2. The third communication path 43T is a communication path that connects the third control unit 3 and the second power supply IC 321. The third onboard communication unit 44T is a communication path powered by the first battery 31 and enables the third control unit 3 to communicate with other control devices in the vehicle.

[0052] If no anomaly is detected in the second compute unit 2, the third compute unit 3 redundantly executes an application with a requirement level of 6 or higher together with the second compute unit 2. If an anomaly is detected in the second compute unit 2, the third compute unit 3 redundantly executes the application with a requirement level of 6 or higher in the third compute unit 3 using the third main core 36 and the third subcore 37.

[0053] According to the first modification, in a configuration where the computing processing of applications is aggregated in an ECU 9A, even if high processing power of a computing unit is required, it is possible to achieve both reliability and computing power by using multiple SoCs and creating redundancy between different batteries. (Second modification)

[0054] In the embodiment described above, the first intrinsic error determination unit 18 operates when the first result comparison unit 11 fulfills the specified condition (S314: YES in Fig. 7) However, the first intrinsic error determination unit 18 can also be activated based on other conditions. For example, the first intrinsic error determination unit 18 can operate at any predefined time. The second result comparison unit 21 can also be activated at predefined time intervals, similar to the first result comparison unit 11.

[0055] In the embodiment and modifications described above, the functional block configurations are merely examples. Some functional configurations represented as separate functional blocks may be integrally configured, or a configuration shown in a functional block diagram may be subdivided into two or more functions. Furthermore, some of the functions of each functional block may be contained within another functional block. (Third modification)

[0056] In the embodiment described above, an application's execution environment is a hypervisor, and the application is equated with a virtual machine. However, other configurations are also possible. For example, the application's execution environment can be Docker, and the application can be equated with a Docker container. Furthermore, the application's execution environment can be a function call function, and the application can be considered a function.

[0057] Although the program, in the embodiment and modifications described above, is stored in the ROM (not shown), the program can also be stored in non-volatile memory (not shown). Furthermore, the ECU 9 can include an input / output interface (not shown), and the program can be read by another device, if required, via a medium accessible through the input / output interface and the ECU 9. Here, "medium" refers, for example, to a storage medium that can be attached to and detached from the input / output interface, or to a communication medium, such as a wired, wireless, or optical network, or a carrier wave, or a digital signal propagating through the network. Additionally, some or all of the functions implemented by the program can be implemented by a hardware circuit or an FPGA.

[0058] Each of the embodiments and modifications described above can be combined. Although various embodiments and modifications have been described above, the present invention is not limited to these. Other aspects that may be considered within the scope of the technical ideas of the present invention are also included within its scope. Reference symbol list 1 first calculation unit 2 second calculation unit 9, 9A ECU 11 first result comparison unit 12 first application control unit 13 first other fault detection unit 14 first hypervisor 16 first main nucleus 17 first subcore 18 first unit of determination of intrinsic defects 21 second result comparison unit 22 second application control unit 23 second other fault detection unit 24 second hypervisor 26 second main nucleus 27 second subcore 28 second unit of determination of intrinsic errors 31 first battery 32 second battery 121 first normal planning unit 122 first degeneration determination unit 123 first degeneration planning unit 124 first execution plan 126 first requirements table 221 second normal planning unit 222 second degeneration determination unit 223 second degeneration planning unit 224 second execution plan 226 second requirements table 311 first power supply IC 321 second power supply IC QUOTES INCLUDED IN THE DESCRIPTION

[0000] This list of documents cited by the applicant was automatically generated and is included solely for the reader's convenience. The list is not part of the German patent or utility model application. The DPMA accepts no liability for any errors or omissions. Cited patent literature

[0000] WO 2022 / 118459 A

[0003]

Claims

[1] Vehicle control device comprising: a first computing unit powered by a first power supply system and comprising a first environment, which is a first execution environment capable of running applications; and a second computing unit powered by a second power supply system and featuring a second environment, which is a second execution environment capable of running applications, wherein the first computing unit contains a first application control unit that controls the execution of the applications in the first environment, the second computing unit contains a second application control unit that controls the execution of applications in the second environment, and The first application control unit and the second application control unit execute a specific application that meets a predefined condition simultaneously in the first environment and the second environment. [2] Vehicle control device according to claim 1, wherein The first application control unit contains a first normal planning unit that determines a functional safety level requested by each of the applications and creates a first execution plan such that the application with the functional safety level higher than a predefined threshold is executed simultaneously as the specific application. The second application control unit contains a second normal planning unit that determines a functional safety level requested by each of the applications and creates a second execution plan so that the application with the functional safety level higher than a predefined threshold is executed simultaneously with the specific application. the first application control unit executes the application in the first environment based on the first execution plan, and The second application control unit executes the application in the second environment based on the second execution plan. [3] Vehicle control device according to claim 1, wherein the first calculation unit contains: a first other error detection unit that detects an anomaly in the second calculation unit, a first degeneration control unit that causes the first computational unit to execute a degeneration control when the first other fault detection unit detects the anomaly in the second computational unit, and the second calculation unit contains: a second, different error detection unit that detects an anomaly in the first calculation unit, and a second degeneration control unit that causes the second computation unit to perform degeneration control when the second other fault detection unit detects the anomaly in the first computation unit. [4] Vehicle control device according to claim 3, wherein the first computing unit still contains a first intrinsic error determination unit, which detects an error of the first computing unit and notifies the second computing unit of the error, the second computing unit also contains a second intrinsic error determination unit, which detects an error of the second computing unit and notifies the first computing unit of the error, the first other error determination unit considers the anomaly of the second computation unit to be determined when the error of the second computation unit is reported by the second intrinsic error determination unit, and The second other error determination unit considers the anomaly of the first computation unit to be determined when the error of the first computation unit is reported by the first intrinsic error determination unit. [5] Vehicle control device according to claim 4, wherein the first computational unit causes the first intrinsic error determination unit to determine the error of the first computational unit if a computational result of the specific application in the first computational unit differs from a computational result of the specific application in the second computational unit, and The second calculation unit causes the second intrinsic error determination unit to determine the error of the second calculation unit if the calculation result of the specific application in the first calculation unit differs from the calculation result of the specific application in the second calculation unit. [6] Vehicle control device according to claim 3, wherein the first other error determination unit determines the error of the second calculation unit based on a state of the second power supply system, and The second other error determination unit determines the error of the first calculation unit based on a state of the first power supply system. [7] Vehicle control device according to claim 6, wherein the first computing unit is supplied with power by a first power supply IC connected to the first power supply system, the second computing unit is supplied with power from a second power supply IC connected to the second power supply system, a first communication path that connects the first power supply IC and the second processing unit; and a second communication path that connects the second power supply IC and the first computing unit, the second other fault detection unit determines that the first power supply system is abnormal if no predefined response is received from the first power supply IC via the first communication path, and The first other fault detection unit determines that the second power supply system is abnormal if no predefined response is received from the second power supply IC via the second communication path. [8] Vehicle control device according to claim 3, wherein the first computing unit contains a first main kernel and a first sub-kernel, which can perform calculations independently of each other, the second computing unit contains a second main kernel and a second sub-kernel, which can perform calculations independently of each other, The degeneration control in the first computing unit consists of the specific application being executed simultaneously by the first main core and by the first subcore in the first computing unit, and The degeneration control in the second computing unit consists of the specific application being executed simultaneously by the second main core and by the second sub-core in the second computing unit. [9] Vehicle control device according to claim 1, further comprising a third computing unit which is powered by the first power supply system and has a third environment which is a third execution environment capable of executing applications, wherein the third computing unit includes a third application control unit that controls the execution of the applications in the third environment, and The third application control unit and the second application control unit run the specific application in the third environment and the second environment simultaneously. [10] Control method performed by a vehicle control device comprising a first computing unit powered by a first power supply system and comprising a first environment which is a first execution environment capable of executing applications, and a second computing unit powered by a second power supply system and comprising a second environment which is a second execution environment capable of executing applications, wherein the first computing unit includes a first application control unit that controls the execution of the applications in the first environment, and The second computing unit contains a second application control unit that controls the execution of applications in the second environment. wherein the control method involves the execution of a specific application that satisfies a given condition simultaneously in the first environment and the second environment by the first application control unit and the second application control unit.

Images