Vehicle control device and control method

Abstract

To efficiently implement power supply redundancy and execution redundancy in a vehicle control device.SOLUTION: A vehicle control device comprises: a first arithmetic unit which is supplied with power from a first power supply system and has a first environment being a first execution environment in which an application can be executed; and a second arithmetic unit which is supplied with power from a second power supply system and has a second environment being a second execution environment in which an application can be executed. The first arithmetic unit comprises a first redundant execution control unit which controls execution of the application in the first environment, and the second arithmetic unit comprises a second redundant execution control unit which controls execution of the application in the second environment, and the first redundant execution control unit and the second redundant execution control unit cause a specific application being an application satisfying a prescribed condition to be executed in the first environment and the second environment at the same time.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a vehicle control device and a control method. [Background technology]

[0002] In the field of automobiles, electronic control devices that use microcomputers and software to control sensors, actuators, and the like for managing the driving state of a vehicle are widely used. With the recent development of technologies such as autonomous driving and electrification, the functions required of electronic control devices are increasing. In addition, as the number of electronic control devices mounted on automobiles increases, the reliability required of electronic control devices is also increasing. For example, in an autonomous driving system, when the autonomous driving level for which the system is responsible is "3" or higher, it is required to have fault tolerance that allows control to continue even in the event of a power supply failure. Patent Document 1 discloses a redundant system that is mounted on an autonomously driving vehicle and has at least a first power supply system and a second power supply system different from the first power supply system, the redundant system comprising a main control device for driving control that executes processing for driving the vehicle autonomously, and a sub-control device for driving control that is used in place of the main control device for driving control when an abnormality is detected in the main control device for driving control, the main control device for driving control is connected to the first power supply system and not connected to the second power supply system, and the sub-control device for driving control is connected to the second power supply system and not connected to the first power supply system. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] International Publication No. 2022 / 118459 Summary of the Invention [Problem to be solved by the invention]

[0004] The invention described in Patent Document 1 leaves room for improvement in power supply redundancy and execution redundancy. [Means for solving the problem]

[0005] A vehicle control device according to a first aspect of the present invention comprises a first calculation unit that is supplied with power from a first power supply system and has a first environment, which is a first execution environment in which an application can be executed, and a second calculation unit that is supplied with power from a second power supply system and has a second environment, which is a second execution environment in which an application can be executed, wherein the first calculation unit comprises a first application control unit that controls execution of an application in the first environment, and the second calculation unit comprises a second application control unit that controls execution of an application in the second environment, and the first application control unit and the second application control unit cause a specific application, which is an application that satisfies a predetermined condition, to be executed in the first environment and the second environment at the same time. A control method according to a second aspect of the present invention is a control method executed by a vehicle control device including a first calculation unit that is supplied with power from a first power supply system and has a first environment, which is a first execution environment in which an application can be executed, and a second calculation unit that is supplied with power from a second power supply system and has a second environment, which is a second execution environment in which an application can be executed, wherein the first calculation unit includes a first application control unit that controls execution of an application in the first environment, the second calculation unit includes a second application control unit that controls execution of an application in the second environment, and the first application control unit and the second application control unit cause a specific application, which is an application that satisfies a predetermined condition, to be executed in the first environment and the second environment at the same time. Effect of the Invention

[0006] According to the present invention, it is possible to efficiently realize power supply redundancy and execution redundancy in a vehicle control device. Problems, configurations and effects other than those described above will become apparent from the following description of the embodiment. [Brief description of the drawings]

[0007] [Figure 1] ECU configuration diagram [Diagram 2] FIG. 1 shows the configuration of a first application control unit. [Diagram 3] A diagram showing the configuration of a second application control unit. [Figure 4] A diagram showing an example of a first application list and a first request table. [Diagram 5] A diagram showing an example of a first execution schedule and a second execution schedule. [Figure 6] 11 is a flowchart showing the process of the first regular schedule section. [Figure 7] A flowchart showing the process of the first result comparison unit. [Figure 8] Flowchart showing the process of the first other fault determination unit [Figure 9] A flowchart showing the process of the first degeneracy determination unit. [Figure 10] A flowchart showing the process of the first degenerate schedule unit. [Figure 11] Configuration diagram of ECU in modification example 1 DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0008] --Embodiment-- Hereinafter, an embodiment of a vehicle control device and a control method will be described with reference to Figs.

[0009] 1 is a configuration diagram of an ECU 9 (Electronic Control Unit) which is a vehicle control device. A first battery 31 and a second battery 32 are connected to the ECU 9. The ECU 9 includes a first calculation unit 1, a second calculation unit 2, a first power supply IC 311 connected to the first battery 31 and supplying power to the first calculation unit 1, and a second power supply IC 321 connected to the second battery 32 and supplying power to the second calculation unit 2. The first calculation unit 1 and the second calculation unit 2 are, for example, independent SoCs (System on Chip).

[0010] The first calculation unit 1 and the second calculation unit 2 have substantially the same configuration and there is no particular difference in performance, but for convenience of explanation, the first calculation unit 1 may be called the "main" and the second calculation unit 2 may be called the "sub". Both the first battery 31 and the second battery 32 are power sources that supply power to the ECU 9. These two may also be called the "first power supply system" and the "second power supply system".

[0011] The ECU 9 further includes an inter-control calculation unit communication unit 41, a first communication line 42, a second communication line 43, a first in-vehicle communication unit 44, and a second in-vehicle communication unit 45. The inter-control calculation unit communication unit 41 connects the first calculation unit 1 and the second calculation unit 2. The first communication line 42 connects the second calculation unit 2 and the first power supply IC 311. The second communication line 43 connects the first calculation unit 1 and the second power supply IC 321. The first in-vehicle communication unit 44 is supplied with power from the first battery 31, and is a communication path for communicating with other control devices in the vehicle. The second in-vehicle communication unit 45 is supplied with power from the second battery 32, and is a communication path for communicating with other control devices in the vehicle.

[0012] The first calculation unit 1 and the second calculation unit 2 have substantially the same configuration, and components with similar names perform the same operation. In the following, the first calculation unit 1 will be described in detail as a representative of the first calculation unit 1 and the second calculation unit 2, and the differences between the first calculation unit 1 and the second calculation unit 2 will be described. The first calculation unit 1 includes a first main core 16 and a first sub-core 17 that perform calculations, and a first self-fault determination unit 18. The first main core 16 and the first sub-core 17 are simply given different names for the sake of convenience. The first main core 16 and the first sub-core 17 may have the same hardware configuration or different hardware configurations. The first main core 16 and the first sub-core 17 may be different calculation cores included in the same physical package, or may be calculation cores included in different physical packages.

[0013] The first self failure judgment unit 18 operates independently of the first main core 16 and the first sub-core 17, and detects a failure in the first calculation unit 1. The first self failure judgment unit 18 is, for example, a microcomputer. The first self failure judgment unit 18 diagnoses, for example, the normality of the volatile memory and non-volatile memory constituting the first calculation unit 1. When the first self failure judgment unit 18 finds an area that cannot be rewritten or an area where a value different from the written value is read, it determines that a failure has occurred in the first calculation unit 1.

[0014] The first main core 16 and the first sub-core 17 implement a first OS 15, a first hypervisor 14, a first result comparison unit 11, a first application control unit 12, and a first other-side fault determination unit 13 by expanding a program stored in a ROM (not shown) into a RAM (not shown) and executing the program. The OS 15 is an operating system, and the first hypervisor 14, the first result comparison unit 11, the first application control unit 12, and the first other-side fault determination unit 13 are executed on the first OS 15.

[0015] The first hypervisor 14 is an execution environment for a virtual machine (VM). An image of the virtual machine is stored in a storage device (not shown) provided in the first calculation unit 1 or in a storage device in the vehicle connected via the first in-vehicle communication unit 44. Each virtual machine executes one application. Therefore, in this embodiment, each virtual machine is regarded as an application. Therefore, the first hypervisor 14 can also be called an execution environment for the application.

[0016] There are many different types of virtual machines that can run on the first hypervisor 14. In this embodiment, a virtual machine is identified by a combination of "VM" and a number. In FIG. 1, VM1 to VM4 run on the first hypervisor 14, but the present invention is not limited to these. The virtual machines will be described in detail later. The first result comparison unit 11 compares the calculation result of the first calculation unit 1 with the calculation result of the second calculation unit 2. The first application control unit 12 controls the execution of an application in the first calculation unit 1, i.e., a virtual machine. The first other side failure determination unit 13 determines a failure of the second calculation unit 2.

[0017] The second calculation unit 2 includes a second main core 26 and a second sub-core 27 that perform calculations, and a second self-failure determination unit 28. The second self-failure determination unit 28 operates independently of the second main core 26 and the second sub-core 27, and detects a failure of the second calculation unit 2. The second main core 26 and the second sub-core 27 implement a second OS 25, a second hypervisor 24, a second result comparison unit 21, a second application control unit 22, and a second other-side failure determination unit 23 by expanding a program stored in a ROM (not shown) into a RAM (not shown) and executing the program. The second other-side failure determination unit 23 determines a failure of the first calculation unit 1.

[0018] 1, VM1, VM2, VM5, and VM6 are running on the second hypervisor 24. VM1 and VM2 are the same as VM1 and VM2 running on the first hypervisor 14 of the first calculation unit 1. That is, VM1 and VM2 are executed redundantly in the first calculation unit 1 and the second calculation unit 2.

[0019] 2 is a diagram showing a configuration of the first application control unit 12 in the first calculation unit 1. The first application control unit 12 includes, as functions, a first normal schedule unit 121 that creates an application execution schedule in a normal state, a first degeneration determination unit 122 that determines whether or not to shift to degeneration control when an abnormality occurs, and a first degeneration schedule unit 123 that creates an application execution schedule in the degeneration control state. The first application control unit 12 has a first execution schedule 124, a first application list 125, and a first request table 126, which are data. The first application control unit 12 executes an application in the first hypervisor 14 based on the first execution schedule 124.

[0020] The first execution schedule 124 is an execution schedule of applications in the first calculation unit 1. The first execution schedule 124 is created by the first normal schedule unit 121 or the first degenerate schedule unit 123. The first application list 125 is a list of applications to be executed in the first calculation unit 1. The first requirement table 126 stores the level of ASIL (Automotive Safety Integrity Level) required by each application (hereinafter referred to as "required level"). Note that the ASIL level is also referred to as "functional safety level" hereinafter. The first requirement table 126 stores at least the required levels of the applications listed in the first application list 125.

[0021] 3 is a diagram showing a configuration of the second application control unit 22 in the second calculation unit 2. The second application control unit 22 includes a second normal schedule unit 221 that creates an execution schedule for applications in normal times, a second degeneration determination unit 222 that determines whether or not to shift to degeneration control when an abnormality occurs, and a second degeneration schedule unit 223 that controls execution scheduling during degeneration control. The second application control unit 22 has a second execution schedule 224, a second application list 225, and a second request table 226, which are data. The second application control unit 22 executes applications in the second hypervisor 24 based on the second execution schedule 224.

[0022] The second execution schedule 224 is an execution schedule of applications in the second calculation unit 2. The second execution schedule 224 is created by the second normal schedule unit 221 or the second degenerate schedule unit 223. The second application list 225 is a list of applications to be executed in the second calculation unit 2. The second request table 226 stores the request level required by each application. The second request table 226 stores at least the request levels of the applications listed in the second application list 225.

[0023] 4 is a diagram showing an example of first application list 125 and first requirement table 126 in first calculation unit 1. First application list 125 stores VM1 to VM4 and VM7 to VM8. First requirement table 126 lists requirement levels of each of VM1 to VM10 including the applications listed in first application list 125. Only VM1 and VM2 have requirement levels of 6 or higher, and VM3 and onwards have requirement levels of 5 or lower.

[0024] Fig. 5 is a diagram showing two examples of the first execution schedule 124 and the second execution schedule 224. The top two rows of Fig. 5 show a first example of the first execution schedule 124 and the second execution schedule 224, and the bottom two rows of Fig. 5 show a second example of the first execution schedule 124 and the second execution schedule 224. In Fig. 5, the subnumbers 1 and 2 are added to distinguish the first example from the second example.

[0025] The first execution schedule 124 shows the applications to be executed for each time slot (L0, L1, ...) of the calculation period for each of the first main core 16 and the first secondary core 17. The second execution schedule 224 shows the applications to be executed for each time slot for each of the second main core 26 and the second secondary core 27.

[0026] 5, it is described that in timeslot L0, both the first main core 16 and the second main core 26 execute the application VM1. In the same timeslot L0, the first secondary core 17 and the second secondary core 27 execute different applications. In timeslot L2, it is described that all the cores execute different applications.

[0027] 5, the first execution schedule 1241-2 is empty, and the second execution schedule 2241-2 is written to be executed by two cores at the same time. Specifically, in time slot L0, VM1 is assigned to the second main core 26 and the second secondary core 27, and in time slot L1, VM2 is assigned to the second main core 26 and the second secondary core 27.

[0028] 6 is a flowchart showing the process of the first normal scheduler 121 in the first calculation unit 1. In the following explanation, a specific operation will be explained using the values ​​of the first application list 125 and the first request table 126 shown in FIG.

[0029] First, in step S301, the first normal schedule unit 121 initializes a variable i to "1". In the following step S302, the first normal schedule unit 121 reads the i-th item in the first application list 125. For example, at the time of the first execution, the first item, that is, "VM1" in the example of FIG. 4, is read. In the following step S303, the first normal schedule unit 121 refers to the first request table 126 and determines whether or not the request level of the application read in step S302 is greater than 5. If the first normal schedule unit 121 determines that the request level is greater than 5, the process proceeds to step S304, and if the first normal schedule unit 121 determines that the request level is 5 or less, the process proceeds to step S305.

[0030] In step S304, the first normal scheduler 121 registers the application read in step S302 in the first execution schedule 124 so as to execute the application redundantly in coordination with the second calculation unit 2, and proceeds to step S306. Redundant execution means executing the same application by both the first calculation unit 1 and the second calculation unit 2 in the same time slot. For example, since the required level of "VM1" is "9", the first normal scheduler 121 registers it in time slot L0 of the first execution schedule 124 in coordination with the second normal scheduler 221 of the second calculation unit 2 in step S304.

[0031] In step S305, the first normal schedule unit 121 registers the application read in step S302 in the first execution schedule 124 so as to be executed independently, and proceeds to step S306. In this case, simultaneous execution with the second calculation unit 2 is not necessary, so the application read in step S302 is simply registered.

[0032] In step S306, the first normal schedule unit 121 judges whether or not the first application list 125 has been read to the end. If the first normal schedule unit 121 judges that the first application list 125 has been read to the end, it ends the process shown in Fig. 6, and if it judges that the first application list 125 has not been read to the end, it proceeds to step S307. In step S307, the first normal schedule unit 121 increments the variable i, that is, increases it by "1", and returns to step S302. This concludes the explanation of Fig. 6.

[0033] The processing of the second normal scheduler 221 is substantially the same as the processing of the first normal scheduler 121 shown in Fig. 6. There are three differences. The first point is that the target in steps S302 and S306 is the second application list 225 instead of the first application list 125. The second point is that in step S304, adjustment is made with the first calculation unit 1 instead of the second calculation unit 2. The third point is that in steps S304 and S305, registration is made with the second execution schedule 224 instead of the first execution schedule 124.

[0034] Fig. 7 is a flowchart showing the processing of the first result comparison unit 11. For example, immediately after the end of each time slot of the first execution schedule 124, the first result comparison unit 11 is executed for each calculation result in the time slot in which execution was completed immediately before. For example, in the example of the first execution schedule 1241-1 shown in the upper part of Fig. 5, VM1 and VM3 were executed in time slot L0. Therefore, immediately after time slot L0, the first result comparison unit 11 is executed individually for VM1 and VM3 in time slot L0.

[0035] First, in step S311, the first result comparing unit 11 determines whether or not the target application was executed redundantly. This determination can be made, for example, from the name of the executed application and the first request table 126. If the first result comparing unit 11 determines that the target application was executed redundantly, the process proceeds to step S312, and if the first result comparing unit 11 determines that the target application was not executed redundantly, the process ends as shown in Fig. 7. For example, the first result comparing unit 11 executed with VM1 as the target proceeds to step S312, and the first result comparing unit 11 executed with VM3 as the target ends the process shown in Fig. 7.

[0036] In step S312, the first result comparison unit 11 obtains the calculation result of the target application in its own calculation unit, i.e., the first calculation unit 1. In the following step S313, the first result comparison unit 11 obtains the calculation result of the same target application in the other calculation unit, i.e., the second calculation unit 2. In the following step S314, the first result comparison unit 11 judges whether the calculation results of its own calculation unit and the other calculation unit are identical. In other words, it judges whether the calculation results of the application executed by each of the first calculation unit 1 and the second calculation unit 2 are identical. If the first result comparison unit 11 judges that the calculation results are identical, it ends the process shown in FIG. 7, and if it judges that the calculation results are not identical, it proceeds to step S315.

[0037] In step S315, the first result comparison unit 11 operates the first own fault judgment unit 18 to judge the own fault. In the following step S316, the first result comparison unit 11 judges whether or not there is an own fault. If the first result comparison unit 11 judges that there is an own fault, it proceeds to step S317, and if it judges that there is no own fault, it ends the processing shown in FIG. 7. In step S317, the first result comparison unit 11 notifies the other of its own fault and ends the processing shown in FIG. 7. Specifically, it notifies the second calculation unit 2 that there is a fault in the first calculation unit 1.

[0038] The processing of the second result comparison unit 21 is substantially the same as the processing of the first result comparison unit 11 shown in Fig. 7. There are three differences as follows. The first point is that the targets of the self calculation unit and the other calculation unit in steps S312 and S313 are reversed. The second point is that the second self fault judgment unit 28 is operated in step S315. The third point is that the destination to which a fault is notified in step S317 is the first calculation unit 1.

[0039] 8 is a flowchart showing the process of the first other-side fault judgment unit 13. First, in step S321, the first other-side fault judgment unit 13 checks communication with the other power supply IC. Specifically, the first other-side fault judgment unit 13 communicates with the second power supply IC 321 using the second communication line 43 connecting the first calculation unit 1 and the second power supply IC 321. In the following step S322, the first other-side fault judgment unit 13 judges whether or not communication with the other power supply IC has been established. If the first other-side fault judgment unit 13 judges that communication with the second communication line 43 has been established, the process proceeds to step S323, and if the first other-side fault judgment unit 13 judges that communication with the second communication line 43 has not been established, the process proceeds to step S325.

[0040] In step S323, first other-party fault judgment unit 13 judges whether or not a self-fault has been notified from the other party, that is, whether or not a notice corresponding to step S117 in Fig. 7 has been received from second calculation unit 2. If first other-party fault judgment unit 13 judges that a self-fault has been notified from second calculation unit 2, it proceeds to step S325, and if it judges that a self-fault has not been notified from second calculation unit 2, it proceeds to step S324. In step S324, first other-party fault judgment unit 13 judges that second calculation unit 2 is normal and ends the processing shown in Fig. *. In step S325, first other-party fault judgment unit 13 judges that second calculation unit 2 is faulty and ends the processing shown in Fig. *.

[0041] The process of second other-side fault judgment unit 23 is substantially the same as the process of first other-side fault judgment unit 13 shown in Fig. 8. There are three differences. The first point is that the target in steps S321 and S322 is not the second power supply IC 321 but the first power supply IC 311. The second point is that in step S323, it is determined whether or not there has been a notification of an own fault from the first calculation unit 1. The third point is that the target for determining whether or not it is normal in steps S324 and S325 is the first calculation unit 1 but not the second calculation unit 2.

[0042] FIG. 9 is a flowchart showing the process of the first degeneration judgment unit 122. First, in step S331, the first degeneration judgment unit 122 refers to the processing result of the first other-side fault judgment unit 13 and judges whether the second calculation unit 2 is normal or not. If the first degeneration judgment unit 122 judges that the second calculation unit 2 is normal, the process shown in FIG. 9 is terminated, and if the first degeneration judgment unit 122 judges that the second control unit is not normal, the process proceeds to step S332. In step S332, the first degeneration judgment unit 122 shifts the first calculation unit 1 to degeneration control and terminates the process shown in FIG. 9. As described above, when shifting to degeneration control, the first degeneration schedule unit 123 creates the first execution schedule 124 instead of the first normal schedule unit 121.

[0043] The process of the second degeneration judgment unit 222 is substantially the same as the process of the first degeneration judgment unit 122 shown in Fig. 9. There are two differences. The first is that the process result of the second other-side fault judgment unit 23 is referred to in step S331. The second is that the target to be shifted to degeneration control in step S332 is the second calculation unit 2.

[0044] Fig. 10 is a flowchart showing the processing of the first degenerate scheduler 123. The same processing as that of the first normal scheduler 121 shown in Fig. * is assigned the same step number, and the description will be omitted. First, in step S341, the first degenerate scheduler 123 integrates the first application list 125 and the second application list 225 to create an integrated application list. In the following step S301, the variable i is initialized to "1". In the following step S302A, the first degenerate scheduler 123 reads the i-th application in the integrated application list created in step S341.

[0045] In step S304A, which is executed when the determination in step S303 is affirmative, the first degenerate schedule unit 123 registers the application read in step S302A in the first execution schedule 124 so that the application is executed redundantly inside the first calculation unit 1. In this case, a schedule is created so that the first main core 16 and the first sub core 17 execute the application redundantly inside the first calculation unit 1. The process in step S305 is similar to that of the first normal schedule unit 121. In step S306A, the first degenerate schedule unit 123 determines whether the integrated application list has been read to the end. If the first degenerate schedule unit 123 determines that the integrated application list has been read to the end, the process illustrated in FIG. 10 is terminated, and if the first degenerate schedule unit 123 determines that the integrated application list has not been read to the end, the process proceeds to step S307.

[0046] The processing of the second degenerate schedule unit 223 is substantially the same as the processing of the first degenerate schedule unit 123 shown in Fig. 10. The differences are as follows: The first point is that in step S304A, registration is performed so as to perform redundant execution inside the second calculation unit 2. The second point is that the registration target in steps S304A and S305 is not the first execution schedule 124 but the second execution schedule 224.

[0047] According to the above-described first embodiment, the following advantageous effects can be obtained. (1) The ECU 9, which is a vehicle control device, is provided with a first calculation unit 1 having a first hypervisor 14, which is a first execution environment in which applications can be executed, and a second calculation unit 2 having a second hypervisor 24, which is a second execution environment in which applications can be executed, and is supplied with power from a first battery 31, which is a first power supply system. The first calculation unit 1 is provided with a first application control unit 12 that controls the execution of applications in the first hypervisor 14. The second calculation unit 2 is provided with a second application control unit 22 that controls the execution of applications in the second hypervisor 24. The first application control unit 12 and the second application control unit 22 cause the first hypervisor 14 and the second hypervisor 24 to execute a specific application, which is an application that satisfies a predetermined condition, at the same time. In this way, the first calculation unit 1 and the second calculation unit 2 connected to different batteries are provided inside the ECU 9 to execute applications redundantly. Therefore, it is possible to ensure power supply redundancy by a single ECU 9 while ensuring execution redundancy of a specific application.

[0048] (2) The first application control unit 12 includes a first normal scheduler 121 that determines a functional safety level required by an application and creates a first execution schedule 124 so that applications whose functional safety levels are higher than a predetermined threshold are executed at the same time as specific applications. The second application control unit 22 includes a second normal scheduler 221 that determines a functional safety level required by an application and creates a second execution schedule 224 so that applications whose functional safety levels are higher than a predetermined threshold are executed at the same time as specific applications. The first application control unit 12 executes applications in the first hypervisor 14 based on the first execution schedule 124. The second application control unit 22 executes applications in the second hypervisor 24 based on the second execution schedule 224.

[0049] (3) The first calculation unit 1 includes a first other-side fault judgment unit 13 that detects an abnormality in the second calculation unit 2, and a first degeneration schedule unit 123 that causes the first calculation unit 1 to execute degeneration control when the first other-side fault judgment unit 13 detects an abnormality in the second calculation unit 2. The second calculation unit 2 includes a second other-side fault judgment unit 23 that detects an abnormality in the first calculation unit 1, and a second degeneration schedule unit 223 that causes the second calculation unit 2 to execute degeneration control when the second other-side fault judgment unit 23 detects an abnormality in the first calculation unit 1. Therefore, when an abnormality occurs in one of the first calculation unit 1 or the second calculation unit 2, the other performs degeneration control.

[0050] (4) The first calculation unit 1 includes a first own fault judgment unit 18 that detects a fault in the first calculation unit 1 and transmits the fault to the second calculation unit 2. The second calculation unit 2 includes a second own fault judgment unit 28 that detects a fault in the second calculation unit 2 and transmits the fault to the first calculation unit 1. When a fault in the second calculation unit 2 is transmitted from the second own fault judgment unit 28, the first other-side fault judgment unit 13 assumes that an abnormality in the second calculation unit 2 has been detected. When a fault in the first calculation unit 1 is transmitted from the first own fault judgment unit 18, the second other-side fault judgment unit 23 assumes that an abnormality in the first calculation unit 1 has been detected.

[0051] (5) When the calculation result of the specific application in the first calculation unit 1 differs from the calculation result of the specific application in the second calculation unit 2, the first calculation unit 1 causes the first own fault judgment unit 18 to detect a fault in the first calculation unit (S314: NO, S315 in FIG. 7). When the calculation result of the specific application in the first calculation unit 1 differs from the calculation result of the specific application in the second calculation unit 2, the second calculation unit 2 causes the second own fault judgment unit 28 to detect a fault in the second calculation unit 2. Therefore, the self fault can be detected at an appropriate timing.

[0052] (6) The first other-side failure determination unit 13 determines a failure of the second calculation unit 2 based on the communication state with the second power supply IC 321 connected to the second battery 32. The second other-side failure determination unit 23 determines a failure of the first calculation unit 1 based on the communication state with the first power supply IC 311 connected to the first battery 31. Therefore, it is possible to determine a failure based on the communication state.

[0053] (7) The first calculation unit 1 is supplied with power from a first power supply IC 311 connected to the first battery 31. The second calculation unit 2 is supplied with power from a second power supply IC 321 connected to the second battery 32. The ECU 9 includes a first communication line 42 connecting the first power supply IC 311 and the second calculation unit 2, and a second communication line 43 connecting the second power supply IC 321 and the first calculation unit 1. The second other-side fault determination unit 23 determines that there is an abnormality in the first battery 31 when a predetermined response is not obtained from the first power supply IC 311 via the first communication line 42. The first other-side fault determination unit 13 determines that there is an abnormality in the second battery 32 when a predetermined response is not obtained from the second power supply IC 321 via the second communication line 43. Therefore, the failure of the other calculation unit can be determined based on the absence of a response from the power supply IC.

[0054] (8) The first calculation unit 1 includes a first main core 16 and a first sub-core 17 that can execute calculations independently. The second calculation unit 2 includes a second main core 26 and a second sub-core 27 that can execute calculations independently. The degeneration control in the first calculation unit 1 means that the first main core 16 and the first sub-core 17 execute a specific application at the same time in the first calculation unit 1. The degeneration control in the second calculation unit 2 means that the second main core 26 and the second sub-core 27 execute a specific application at the same time in the second calculation unit 2. Therefore, when an abnormality occurs in one of the first calculation unit 1 and the second calculation unit 2, the other executes the specific application redundantly within the calculation unit. That is, by providing the first calculation unit 1 and the second calculation unit 2 connected to different batteries inside the ECU 9 and performing redundant execution according to the functional safety level, it is possible to ensure power supply redundancy by a single ECU 9 while ensuring execution redundancy required for functional safety. This has the effect of ensuring reliability during the operation of the so-called Minimum Risk Manuvor, such as driving to a safe area or stopping the vehicle when one battery system fails.In addition, since control calculations are performed before the occurrence of a failure, there is an effect that there are no issues related to real-time performance, such as switching or starting up apps when transitioning to degenerate control.

[0055] (Variation 1) In the above-described embodiment, one calculation unit, which is an SoC, is connected to each battery. However, multiple SoCs may be connected to one battery, or the number of connected SoCs may vary.

[0056] Fig. 11 is a diagram showing the configuration of an ECU 9A in Modification 1. The ECU 9A differs from the embodiment in that it includes a third calculation unit 3. For convenience of drawing, detailed configurations of the first calculation unit 1 and the second calculation unit 2 are omitted in Fig. 11. Also, the second communication line 43 and the first in-vehicle communication unit 44 are present as in the embodiment. The configuration unique to this modification will be described below.

[0057] The third calculation unit 3 includes a third main core 36 and a third sub-core 37 that perform calculations, and a third self-failure determination unit 38. The third self-failure determination unit 38 operates independently of the third main core 36 and the third sub-core 37, and detects a failure of the third calculation unit 3. The third main core 36 and the third sub-core 37 implement the OS 35, the hypervisor 34, the third result comparison unit 11-2, the third application control unit 12-2, and the third other-side fault determination unit 33 by expanding a program stored in a ROM (not shown) into a RAM (not shown) and executing it. The OS 35 is an operating system, and the hypervisor 34, the third result comparison unit 11-2, the third application control unit 12-2, and the first other-side fault determination unit 13 are executed on the OS 35. The first other-side fault determination unit 13 operates on the second calculation unit 2, and is therefore common to the first calculation unit 1 and the third calculation unit 3.

[0058] The ECU 9A further includes a second control inter-computation unit communication unit 41-2, a third communication line 43T, and a third in-vehicle communication unit 44T. The second control inter-computation unit communication unit 41-2 is a communication path connecting the third computation unit 3 and the second computation unit 2. The third communication line 43T is a communication path connecting the third computation unit 3 and the second power supply IC 321. The third in-vehicle communication unit 44T is supplied with power from the first battery 31, and is a communication path for the third computation unit 3 to communicate with other control devices in the vehicle.

[0059] When the third calculation unit 3 does not detect an abnormality in the second calculation unit 2, it redundantly executes applications with a requirement level of 6 or higher together with the second calculation unit 2. When the third calculation unit 3 detects an abnormality in the second calculation unit 2, it redundantly executes applications with a requirement level of 6 or higher inside the third calculation unit 3 using the third main core 36 and the third secondary core 37.

[0060] According to this variant example 1, in a configuration in which application calculation processing is consolidated into one ECU 9A, even if a great deal of processing performance is required from the calculation unit, it is possible to achieve both reliability and calculation performance by using multiple SoCs and providing redundancy between different batteries.

[0061] (Variation 2) In the above-described embodiment, when the first result comparing unit 11 satisfies a predetermined condition (S314: YES in FIG. 7), the first own fault judgment unit 18 is operated. However, the first own fault judgment unit 18 may be started based on other conditions. For example, the first own fault judgment unit 18 may be operated at predetermined time intervals. The second result comparing unit 21 may also be started at predetermined time intervals like the first result comparing unit 11.

[0062] In each of the above-mentioned embodiments and modifications, the configuration of the functional blocks is merely an example. Some functional configurations shown as separate functional blocks may be integrated, or a configuration shown in one functional block diagram may be divided into two or more functions. In addition, some of the functions of each functional block may be provided by other functional blocks.

[0063] (Variation 3) In the above-described embodiment, the execution environment of the application is a hypervisor, and the application is considered to be equivalent to a virtual machine. However, a different configuration may be used. For example, the execution environment of the application may be Docker, and the application may be considered to be equivalent to a Docker container. Also, the execution environment of the application may be a function call function, and the application may be considered to be equivalent to a function.

[0064] In the above-described embodiments and modifications, the programs are stored in a ROM (not shown), but the programs may be stored in a non-volatile memory (not shown). The ECU 9 may have an input / output interface (not shown), and the programs may be read from another device via the input / output interface and a medium available to the ECU 9 when necessary. The medium here refers to, for example, a storage medium that is detachable from the input / output interface, or a communication medium, i.e., a network such as a wired, wireless, or optical network, or a carrier wave or digital signal that propagates through the network. Some or all of the functions realized by the programs may be realized by a hardware circuit or an FPGA.

[0065] The above-mentioned embodiments and modifications may be combined with each other. Although various embodiments and modifications have been described above, the present invention is not limited to these. Other aspects that are conceivable within the scope of the technical idea of ​​the present invention are also included in the scope of the present invention. [Explanation of symbols]

[0066] 1: 1st calculation section 2: 2nd calculation section 9, 9A: ECU 11: 1st result comparison section 12: First application control section 13:First other failure determination section 14: First hypervisor 16: First main core 17: 1st sub-core 18: 1st self-failure determination section 21:Second result comparison section 22: Second application control section 23:Second other failure determination section 24: Second hypervisor 26: Second main core 27: Secondary core 28:Second self-failure determination section 31: First battery 32: Second battery 121: First Regular Schedule Section 122: First degeneracy judgment unit 123: First degenerate schedule part 124: First execution schedule 126: First requirement table 221: Second Regular Schedule Division 222: Second degeneracy judgment unit 223: Second reduced schedule part 224: Second execution schedule 226: Second requirement table 311: 1st power supply IC 321: 2nd power supply IC

Claims

1. a first computing unit that is supplied with power from a first power supply system and has a first environment that is a first execution environment capable of executing an application; a second computing unit that is supplied with power from a second power supply system and has a second environment that is a second execution environment in which an application can be executed; the first computing unit includes a first application control unit that controls execution of an application in the first environment; the second computing unit includes a second application control unit that controls execution of an application in the second environment; The first application control unit and the second application control unit execute a specific application, which is an application that satisfies a predetermined condition, in the first environment and the second environment at the same time.

2. The vehicle control device according to claim 1, the first application control unit includes a first normal schedule unit that determines a functional safety level required by an application and creates a first execution schedule so that an application having a functional safety level higher than a predetermined threshold is executed at the same time as the specific application; the second application control unit includes a second normal schedule unit that determines the functional safety level required by an application and creates a second execution schedule so as to execute, at the same time, an application having a functional safety level higher than a predetermined threshold as the specific application; The first application control unit executes an application in the first environment based on the first execution schedule; The second application control unit executes an application in the second environment based on the second execution schedule.

3. The vehicle control device according to claim 1, The first calculation unit is a first other-side fault determination unit that detects an abnormality in the second calculation unit; a first degeneration control unit that executes degeneration control in the first calculation unit when the first other-side fault determination unit detects an abnormality in the second calculation unit, The second calculation unit is a second other-side fault determination unit that detects an abnormality in the first calculation unit; a second degeneration control unit that causes the second calculation unit to execute degeneration control when the second other-side fault determination unit detects an abnormality in the first calculation unit.

4. The vehicle control device according to claim 3, The first calculation unit further includes a first self-failure determination unit that detects a failure of the first calculation unit and notifies the second calculation unit of the failure. The second calculation unit further includes a second self-failure determination unit that detects a failure of the second calculation unit and notifies the first calculation unit of the failure. when a failure of the second calculation unit is transmitted from the second self failure determination unit, the first other-failure determination unit determines that an abnormality of the second calculation unit has been detected, The second other-failure determination unit determines that an abnormality in the first calculation unit has been detected when a failure in the first calculation unit is transmitted from the first self failure determination unit.

5. The vehicle control device according to claim 4, When a calculation result of the specific application in the first calculation unit and a calculation result of the specific application in the second calculation unit differ from each other, the first calculation unit causes the first self fault determination unit to detect a fault in the first calculation unit; A vehicle control device, wherein the second calculation unit causes the second self-fault judgment unit to detect a fault in the second calculation unit when the calculation result of the specific application in the first calculation unit differs from the calculation result of the specific application in the second calculation unit.

6. The vehicle control device according to claim 3, the first other-side fault determination unit determines a fault in the second calculation unit based on a state of the second power supply system; The second other-side fault determination unit determines a fault in the first calculation unit based on a state of the first power supply system.

7. 7. The vehicle control device according to claim 6, the first calculation unit is supplied with power from a first power supply IC connected to the first power supply system, the second calculation unit is supplied with power from a second power supply IC connected to the second power supply system, a first communication line connecting the first power supply IC and the second calculation unit; a second communication line connecting the second power supply IC and the first calculation unit; the second other-fault determination unit determines that an abnormality has occurred in the first power supply system when a predetermined response is not received from the first power supply IC via the first communication line, The first other-fault determination unit determines that an abnormality has occurred in the second power supply system when a predetermined response is not obtained from the second power supply IC via the second communication line.

8. The vehicle control device according to claim 3, the first computing unit includes a first main core and a first sub-core capable of independently executing computations; the second computing unit includes a second main core and a second sub-core capable of independently executing computations; the degeneration control in the first computing unit is to execute the specific application in the first main core and the first sub-core at the same time in the first computing unit; A vehicle control device, wherein degeneration control in the second computing unit means that the specific application is executed by the second main core and the second sub-core at the same time in the second computing unit.

9. The vehicle control device according to claim 1, a third computing unit that is supplied with power from the first power supply system and has a third environment that is a third execution environment in which an application can be executed; the third computing unit includes a third application control unit that controls execution of an application in the third environment; The third application control unit and the second application control unit execute the specific application in the third environment and the second environment at the same time.

10. A control method executed by a vehicle control device including a first calculation unit that is supplied with power from a first power supply system and has a first environment that is a first execution environment in which an application can be executed, and a second calculation unit that is supplied with power from a second power supply system and has a second environment that is a second execution environment in which the application can be executed, the first computing unit includes a first application control unit that controls execution of an application in the first environment; the second computing unit includes a second application control unit that controls execution of an application in the second environment; A control method including causing the first application control unit and the second application control unit to execute a specific application, which is an application that satisfies a predetermined condition, in the first environment and the second environment at the same time.

Images