In-vehicle information processing apparatus and in-vehicle information processing method

Abstract

To provide an in-vehicle information processing apparatus and an in-vehicle information processing method which can be expected to contribute to employment of multi-core and shared memory configuration in a device mounted in a vehicle.SOLUTION: The in-vehicle information processing apparatus relating to the present embodiment comprises a plurality of processing units mounted in a vehicle to perform processing in parallel and a plurality of shared storage units accessible from the plurality of processing units, and the plurality of processing units communicate information via at least one shared storage unit and change shared storage units for use in communicating information, at prescribed timing. A detection unit is provided to detect abnormality of the shared storage units, and the prescribed timing is timing at which the detection unit has detected abnormality of the at least one shared storage unit, and the plurality of processing units are allowed to communicate information via another shared storage unit if the detection unit detects abnormality of the at least one shared storage unit.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present disclosure relates to an in-vehicle information processing device and an in-vehicle information processing method for transmitting and receiving information between a plurality of processing units. [Background technology]

[0002] Patent Document 1 describes a multi-core computing device that includes a first core, a second core, and a shared memory, and that communicates with each other via the shared memory. In this multi-core computing device, the first core executes a behavior schedule application that determines a behavior schedule that indicates the order of behavior changes in a vehicle drivetrain device that is the control target, and the second core executes an actuator control application that controls an actuator that operates the vehicle drivetrain device, and a sensing application that acquires and provides physical information. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2018-13843 A Summary of the Invention [Problem to be solved by the invention]

[0004] The multi-core arithmetic device described in Patent Document 1 has a configuration in which multiple cores communicate via a shared memory. In recent years, devices such as ECUs (Electronic Control Units) mounted on vehicles have become more highly functional, and a multi-core and shared memory configuration may be adopted.

[0005] The present disclosure has been made in consideration of the above circumstances, and its purpose is to provide an in-vehicle information processing device and an in-vehicle information processing method that are expected to contribute to the adoption of multi-core and shared memory configurations in devices installed in vehicles. [Means for solving the problem]

[0006] The in-vehicle information processing device of the present embodiment is mounted on a vehicle and comprises a plurality of processing units that perform processing in parallel, and a plurality of shared memory units that can be accessed by the plurality of processing units, and the plurality of processing units exchange information via at least one shared memory unit and change the shared memory unit used to exchange information at a predetermined timing.

[0007] The present application can be realized not only as an apparatus having such a characteristic control unit, but also as a method having such characteristic processes as steps, or as a computer program for causing a computer to execute such steps, as a semiconductor integrated circuit that realizes part or all of these devices, or as other devices or systems that include these devices. Effect of the Invention

[0008] Based on the above, it is expected that the present invention will contribute to the adoption of a multi-core and shared memory configuration in devices mounted on vehicles. [Brief description of the drawings]

[0009] [Figure 1] 1 is a block diagram showing a configuration of an in-vehicle information processing device according to an embodiment of the present invention; [Diagram 2] FIG. 2 is a schematic diagram for explaining a storage area of ​​a RAM. [Diagram 3] 4 is a flowchart showing a procedure of a process performed by an address conversion unit 11 of the vehicle-mounted information processing device according to the present embodiment. [Figure 4] 5 is a flowchart showing a procedure of processes performed by each core of the in-vehicle information processing device according to the present embodiment. [Diagram 5] 10 is a flowchart showing a procedure of a process performed by an address conversion unit 11 of an in-vehicle information processing device according to the second embodiment. [Figure 6] FIG. 11 is a block diagram showing a configuration of an in-vehicle information processing device according to a third embodiment. [Figure 7] 11 is a schematic diagram for explaining storage areas of a first RAM and a second RAM of an in-vehicle information processing device according to embodiment 3. FIG. [Figure 8] FIG. 11 is a block diagram showing a configuration of an in-vehicle information processing device according to a fourth embodiment. [Figure 9] 13 is a flowchart showing a procedure of processing performed by an in-vehicle information processing device according to the fourth embodiment. [Figure 10] 13 is a flowchart showing a procedure of a shared area changing process performed by an in-vehicle information processing device according to the fourth embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] [Description of the embodiment of the present disclosure] First, embodiments of the present disclosure will be described. At least a part of the embodiments described below may be arbitrarily combined.

[0011] (1) The in-vehicle information processing device of the present embodiment is mounted on a vehicle and comprises a plurality of processing units that perform processing in parallel and a plurality of shared memory units that can be accessed by the plurality of processing units, and the plurality of processing units exchange information via at least one shared memory unit and change the shared memory unit used for exchanging information at a predetermined timing.

[0012] In this aspect, the in-vehicle information processing device includes a plurality of processing units that perform processing in parallel, and a plurality of shared storage units that can be accessed by the plurality of processing units. The plurality of processing units exchange information via at least one of the plurality of shared storage units, and change the shared storage unit used for information exchange at a predetermined timing. The in-vehicle information processing device can appropriately use the plurality of shared storage units to perform various processes, such as responding to an abnormality or processing for improving security performance, and is therefore expected to contribute to the adoption of a multi-core and shared memory configuration in devices mounted on vehicles.

[0013] (2) It is preferable that the system is provided with a detection unit that detects an abnormality in the shared memory unit, and the specified timing is the timing when the detection unit detects an abnormality in at least one of the shared memory units, and when the detection unit detects an abnormality in the at least one shared memory unit, the multiple processing units exchange information via another shared memory unit.

[0014] In this embodiment, when an abnormality is detected in at least one shared storage unit used for information exchange, the multiple processing units exchange information via another shared storage unit among the multiple shared storage units. As a result, even if an abnormality occurs in at least one shared storage unit, it is expected that the multiple processing units can continue to exchange information via the other shared storage unit.

[0015] (3) It is preferable that the specified timing includes at least one of the timing when the device is started, the timing when an external attack is detected, the timing when a specified period has elapsed, the timing when the casing of the device is opened, and the timing when a connector connected to the device is removed.

[0016] In this embodiment, the predetermined timing for changing the shared storage unit used for sending and receiving information includes at least one of the timing when the device is started, the timing when an external attack is detected, the timing when a predetermined period has elapsed, the timing when the case of the device is opened, and the timing when a connector connected to the device is removed, etc. By changing the shared storage unit at such timing, it is expected that in the event of, for example, a malicious intrusion or attack on the device from the outside, it will be difficult to identify which shared storage unit is being used by the multiple processing units, and it will be difficult to tamper with information in the shared storage unit.

[0017] (4) It is preferable that the plurality of processing units change the shared storage unit used for transmitting and receiving information to a shared storage unit randomly selected from the plurality of shared storage units.

[0018] In this aspect, when changing the shared storage unit used for sending and receiving information, one or more shared storage units are randomly selected from the multiple shared storage units as the new destination, which is expected to make it difficult for the shared storage unit used by multiple processing units to be identified from the outside.

[0019] (5) It is preferable that an address conversion unit is provided between the multiple processing units and the multiple shared memory units, converting a virtual address used by the processing units when accessing stored information and a physical address of the shared memory unit, and the address conversion unit changes the correspondence between the virtual address and the physical address at the specified timing to switch the shared memory unit between which the multiple processing units exchange information.

[0020] In this aspect, an address conversion unit is interposed between the multiple processing units and the multiple shared storage units, and converts between the virtual addresses used by the processing units and the physical addresses of the shared storage units. The in-vehicle information processing device changes the correspondence between the virtual addresses and the physical addresses at a predetermined timing, thereby switching the shared storage units used by the multiple processing units for information exchange. This allows the processing units to access information without considering the physical addresses of the shared storage units.

[0021] (6) It is preferable to further include a memory unit that stores an address conversion table in which the correspondence between the virtual address and the physical address is stored, and the address conversion unit performs address conversion based on the address conversion table stored in the memory unit and changes the correspondence stored in the address conversion table at the predetermined timing.

[0022] In this aspect, an address conversion table that stores the correspondence between virtual addresses and the physical addresses is stored in a storage unit, and the address conversion unit reads the address conversion table from the storage unit to perform address conversion. The in-vehicle information processing device changes the correspondence in the address conversion table at a predetermined timing to change the address conversion by the address conversion unit. This makes it possible to easily change the address conversion by the address conversion unit.

[0023] (7) It is preferable that the address conversion unit obtains the address conversion table stored in the memory unit when the device is started, and at the specified timing, changes the correspondence stored in the address conversion table stored in the memory unit and restarts the device.

[0024] In this aspect, when the in-vehicle information processing device is started, the address conversion unit acquires the address conversion table stored in the storage unit, and performs address conversion according to the contents of the acquired address conversion table. The in-vehicle information processing device changes the correspondence of the address conversion table at a predetermined timing and restarts the device. In this way, the in-vehicle information processing device can easily reflect the change in address conversion made by the address conversion unit by restarting the device.

[0025] (8) It is preferable that, in response to a request to write information from the processing unit, each of the multiple shared storage units stores the same information.

[0026] In this aspect, in response to a request from a processing unit to write information, the multiple shared storage units each store the same information. This allows information to be backed up in the multiple shared storage units. Even if the multiple processing units change the shared storage unit used for information exchange in response to an abnormality detection or the like, the multiple processing units can easily continue processing because the same information is stored in the changed shared storage unit.

[0027] (9) It is preferable that the plurality of shared storage units are a plurality of storage areas provided in a single memory element accessible by the plurality of processing units.

[0028] In this embodiment, multiple storage areas provided in one memory device are used as multiple shared storage units, which is expected to enable multiple shared storage units to be provided at low cost.

[0029] (10) It is preferable that the plurality of shared storage units are a plurality of memory elements accessible by the plurality of processing units.

[0030] In this embodiment, multiple memory devices are used as multiple shared storage units. This allows, for example, when storing the same information in multiple shared storage units as backups, to write information in parallel, which is expected to speed up processing.

[0031] (11) The in-vehicle information processing device of the present embodiment is mounted on a vehicle and comprises a plurality of processing units that perform processing in parallel, a plurality of shared memory units that are accessible by the plurality of processing units, and a detection unit that detects abnormalities in the shared memory units, and the plurality of processing units exchange information via at least one shared memory unit, and when the detection unit detects an abnormality in the at least one shared memory unit, exchange information via another shared memory unit.

[0032] In this embodiment, as in embodiment (2), even if an abnormality occurs in at least one shared memory unit, it is expected that the multiple processing units will be able to continue to exchange information via another shared memory unit.

[0033] (12) The in-vehicle information processing method of the present embodiment includes an in-vehicle information processing device having a plurality of processing units that perform processing in parallel and a plurality of shared memory units that can be accessed by the plurality of processing units, which exchanges information between the plurality of processing units via at least one shared memory unit and changes the shared memory unit used for exchanging information at a predetermined timing.

[0034] In this aspect, similar to the aspect (1), it is expected that the present aspect will contribute to the adoption of a multi-core and shared memory configuration in a device mounted on a vehicle.

[0035] [Details of the embodiment of the present disclosure] Specific examples of the in-vehicle information processing device according to the embodiment of the present disclosure will be described below with reference to the drawings. The present disclosure is not limited to these examples, but is defined by the claims, and is intended to include all modifications within the meaning and scope of the claims.

[0036] <Embodiment 1> <Device configuration> 1 is a block diagram showing a configuration of an on-vehicle information processing device according to the present embodiment. The on-vehicle information processing device 10 according to the present embodiment may be various devices such as an ECU (Electronic Control Unit) or a GW (Gateway) mounted on a vehicle 100. The on-vehicle information processing device 10 includes a plurality of processing units such as a CPU (Central Processing Unit) or an MPU (Micro-Processing Unit) that executes various arithmetic processing by executing a program. In the present embodiment, the on-vehicle information processing device 10 includes three processing units, which are referred to as cores 1 to 3.

[0037] The in-vehicle information processing device 10 according to the present embodiment is configured to include the above-mentioned cores 1 to 3, an address conversion unit 11, a non-volatile storage unit 12, and a RAM (Random Access Memory) 20. The address conversion unit 11 is provided between the cores 1 to 3 and the non-volatile storage unit 12 and the RAM 20, and mediates access from the cores 1 to 3 to the non-volatile storage unit 12 and the RAM 20. When accessing a memory such as the RAM 20 (writing data and reading data), the cores 1 to 3 specify an address indicating a storage area to be accessed. The cores 1 to 3 handle data in their respective individual address spaces for processing, and the address conversion unit 11 converts between an address (virtual address) in this address space and an address (physical address) in the RAM 20.

[0038] The non-volatile storage unit 12 is configured using a data-rewritable non-volatile memory element such as a flash memory or an EEPROM (Electrically Erasable Programmable Read Only Memory). The non-volatile storage unit 12 can store, for example, programs executed by the cores 1 to 3 or data used in the processing of the cores 1 to 3 in advance. In this embodiment, the non-volatile storage unit 12 stores, in advance, an address conversion table 13 used in the processing of the address conversion unit 11. The address conversion table 13 is a table in which, for example, the correspondence between virtual addresses used by the cores 1 to 3 and physical addresses of the RAM 20 is stored.

[0039] The RAM 20 is configured using a large-capacity rewritable memory element such as a static random access memory (SRAM) or a dynamic random access memory (DRAM). The in-vehicle information processing device 10 may include a storage unit using a non-volatile memory element such as a flash memory instead of the RAM 20. The RAM 20 temporarily stores data generated during the various processes performed by the cores 1 to 3. In this embodiment, the storage area of ​​the RAM 20 is divided into a plurality of areas for use.

[0040] 2 is a schematic diagram for explaining the storage area of ​​the RAM 20. The storage area of ​​the RAM 20 of the in-vehicle information processing device 10 according to this embodiment is roughly divided into three storage areas, a shared memory 30, a memory 21 for core 1, a memory 22 for core 2, and a memory 23 for core 3. The shared memory 30 is further divided into N storage areas, a first shared area, a second shared area, a third shared area, ..., an Nth shared area (N=1, 2, 3, ...).

[0041] The memory 21 for core 1 in the RAM 20 is a dedicated storage area in which the core 1 stores data, and is a storage area that cannot be accessed by the core 2 and the core 3. The address conversion unit 11 converts a virtual address into a physical address of the memory 21 for core 1 in response to an access request from the core 1 to the RAM 20. Similarly, the memory 22 for core 2 in the RAM 20 is a dedicated storage area in which the core 2 stores data, and is a storage area that cannot be accessed by the core 3 and the core 1. The address conversion unit 11 converts a virtual address into a physical address of the memory 22 for core 2 in response to an access request from the core 2 to the RAM 20. The memory 23 for core 3 in the RAM 20 is a dedicated storage area in which the core 3 stores data, and is a storage area that cannot be accessed by the core 1 and the core 2. The address conversion unit 11 converts a virtual address into a physical address of the memory 23 for core 3 in response to an access request from the core 3 to the RAM 20.

[0042] The shared memory 30 is a storage area that the cores 1 to 3 can access. The cores 1 to 3 of the in-vehicle information processing device 10 write and read data to and from the shared memory 30 of the RAM 20, thereby realizing data exchange, i.e., communication, between the multiple cores 1 to 3. In the present embodiment, the cores 1 to 3 attach a checksum or the like as information for error detection to the data stored in the shared memory 30 of the RAM 20. When the cores 1 to 3 read data from the shared memory 30 of the RAM 20, they perform error detection based on the checksum attached to the data. Note that the information for error detection attached to the data stored in the shared memory 30 is not limited to a checksum, and may be, for example, a parity code or a cyclic code. The addition of information for error detection to the data and / or the process of error detection based on this information may be performed by the address conversion unit 11, not by the cores 1 to 3.

[0043] Although the shared memory 30 can be accessed by the multiple cores 1 to 3, the multiple cores 1 to 3 cannot simultaneously access at least the same address. For this reason, the address conversion unit 11 performs an exclusive process (exclusive control, mutual exclusion, mutual exclusion) that prohibits the multiple cores 1 to 3 from simultaneously accessing the shared memory 30. The exclusive process is performed using existing technology such as a semaphore or a monitor.

[0044] In this embodiment, the shared memory 30 of the RAM 20 is divided into N areas from the first shared area to the Nth shared area. For example, when the in-vehicle information processing device 10 is manufactured and operated for the first time, data is exchanged between the cores 1 to 3 using the first shared area of ​​the shared memory 30 of the RAM 20, and the second shared area to the Nth shared area are not used. At this time, when a request for writing or reading data to the shared memory 30 is given from the cores 1 to 3, the address conversion unit 11 converts the virtual address designated by the cores 1 to 3 into the physical address of the first shared area of ​​the shared memory 30. The in-vehicle information processing device 10 continues to use the first shared area for data exchange between the cores 1 to 3 until an abnormality or the like occurs in data exchange using the first shared area.

[0045] When an abnormality or the like is detected in data exchange using the first shared area, the in-vehicle information processing device 10 according to this embodiment changes the shared area used for data exchange among the cores 1 to 3 from the first shared area to the second shared area. When a request for writing or reading data to the shared memory 30 is given from the cores 1 to 3, the address conversion unit 11 converts the virtual address specified by the cores 1 to 3 into a physical address of the second shared area of ​​the shared memory 30. The in-vehicle information processing device 10 continues to use the second shared area for data exchange among the cores 1 to 3 until an abnormality or the like occurs in data exchange using the second shared area.

[0046] In this way, the in-vehicle information processing device 10 uses one of the first to Nth shared areas, which are obtained by dividing the storage area of ​​the shared memory 30, for data exchange between the cores 1 to 3, and continues to use this shared area until an abnormality or the like occurs in the shared area being used. If an abnormality or the like occurs thereafter in the shared area being used for data exchange between the cores 1 to 3, the in-vehicle information processing device 10 uses another (next) shared area. Note that in this embodiment, the in-vehicle information processing device 10 determines whether an abnormality or the like has occurred in the shared area by whether a data error has been detected based on the checksum attached to the data read from the shared area.

[0047] The address conversion unit 11 reads out the address conversion table 13 stored in advance in the non-volatile storage unit 12, stores the conversion rules and the like set in this address conversion table 13 in its own storage unit such as a register, and converts the virtual addresses of the cores 1 to 3 into physical addresses of the RAM 20 according to the stored conversion rules and the like. The address conversion table 13 is created in advance, for example, by a designer of the in-vehicle information processing device 10, and written into the non-volatile storage unit 12 during the manufacturing stage of the in-vehicle information processing device 10, etc. The address conversion unit 11 reads out the address conversion table 13 from the non-volatile storage unit 12, stores it in its own storage unit, and starts the address conversion process, for example, when the in-vehicle information processing device 10 is started up.

[0048] As described above, the in-vehicle information processing device 10 according to the present embodiment uses one of the shared areas of the shared memory 30 of the RAM 20 to exchange data between the cores 1 to 3, and when an abnormality or the like occurs in the shared area, the shared area is switched to another shared area. At this time, the in-vehicle information processing device 10 needs to change the rule of subsequent address conversion by the address conversion unit 11. When an abnormality or the like occurs in the shared area, the in-vehicle information processing device 10 according to the present embodiment changes the address conversion by the address conversion unit 11 by changing the address conversion table 13 stored in the non-volatile storage unit 12. For example, the in-vehicle information processing device 10 changes the conversion rule of the address conversion table 13 in which a conversion rule for converting a virtual address related to an access to the shared memory 30 of the cores 1 to 3 into a physical address of a first shared area of ​​the shared memory 30 of the RAM 20 is set, so that the virtual address is converted into a physical address of a second shared area. After completing the change of the address conversion table 13 in the non-volatile storage unit 12, the in-vehicle information processing device 10 restarts the device by resetting, rebooting, or the like. This restart causes the address conversion unit 11 to read the changed address conversion table 13 from the non-volatile storage unit 12 and start the address conversion process, thereby realizing the change in the contents of the address conversion.

[0049] The in-vehicle information processing device 10 may change the address conversion table 13 by directly rewriting the conversion rules set in the address conversion table 13. Alternatively, for example, a plurality of address conversion tables 13 may be stored in the non-volatile memory unit 12, and the address conversion table 13 may be changed by rewriting information such as a flag indicating which address conversion table 13 the address conversion unit 11 is to read and use.

[0050] Furthermore, the process of changing the address conversion table 13 may be performed by any of the cores 1 to 3 (for example, the core that detected the abnormality in the shared area), by the address conversion unit 11, or by a functional unit other than these. In the in-vehicle information processing device 10 according to this embodiment, the cores 1 to 3 detect an abnormality in the shared area of ​​the shared memory 30 in the RAM 20 based on a checksum added to data read from the shared area, and if an abnormality is detected, the cores 1 to 3 notify the address conversion unit 11, and the address conversion unit 11 performs a process of changing the address conversion table 13 in the non-volatile storage unit 12.

[0051] <Flowchart> 3 is a flowchart showing the procedure of the process performed by the address conversion unit 11 of the in-vehicle information processing device 10 according to the present embodiment. Note that this flowchart shows the procedure when the cores 1 to 3 access the shared memory 30 of the RAM 20, and does not show the access to the memory 21 for core 1, the memory 22 for core 2, or the memory 23 for core 3 of the RAM 20. The address conversion unit 11 of the in-vehicle information processing device 10 according to the present embodiment performs a startup process such as initialization of its own registers when the device is started (step S1). After the startup process is completed, the address conversion unit 11 reads out the address conversion table 13 stored in the non-volatile storage unit 12 (step S2), and starts the process of address conversion based on the settings of the address conversion table 13.

[0052] The address translation unit 11 judges whether an access request such as writing or reading data to the shared memory 30 of the RAM 20 is given from the cores 1 to 3 (step S3). If an access request is not given (S3: NO), the address translation unit 11 waits until an access request is given. If an access request is given (S3: YES), the address translation unit 11 performs an exclusive process to restrict access from other cores 1 to 3 to the shared area of ​​the shared memory 30 of the RAM 20 (step S4). The address translation unit 11 converts the virtual address designated by the cores 1 to 3 that have made the access request into a physical address, and performs access to write or read data to the shared area that is the target of the access request (step S5). Thereafter, the address translation unit 11 performs an exclusive end process to release the restriction on access to this shared area (step S6).

[0053] The address conversion unit 11 judges whether or not a notice of abnormality has been given from the cores 1 to 3 that have accessed the shared area (step S7). If a notice of abnormality has not been given (S7: NO), the address conversion unit 11 returns the process to step S3. If a notice of abnormality has been given (S7: YES), the address conversion unit 11 changes the setting contents of the address conversion table 13 stored in the non-volatile storage unit 12 so as to switch from the currently accessed shared area to another shared area (step S8). After the change of the address conversion table 13 is completed, the address conversion unit 11 performs a process of resetting the in-vehicle information processing device 10 (step S9) and ends the process. Note that this reset process restarts the in-vehicle information processing device 10, and the process of step S1 in the illustrated flowchart is started.

[0054] 4 is a flowchart showing the procedure of processing performed by each of the cores 1 to 3 of the in-vehicle information processing device 10 according to the present embodiment. Note that this flowchart shows the procedure of processing when the cores 1 to 3 access the shared memory 30 of the RAM 20, and does not show the access to the memory 21 for core 1, the memory 22 for core 2, or the memory 23 for core 3 of the RAM 20.

[0055] The cores 1 to 3 of the in-vehicle information processing device 10 according to this embodiment determine whether or not it is necessary to write data to the shared memory 30 of the RAM 20 (step S21). If it is necessary to write data (S21: YES), the cores 1 to 3 attach a checksum to the data to be written (step S22). The cores 1 to 3 output a write request including an address to write the data and the data with the checksum to the address conversion unit 11 (step S23), and return the process to step S21.

[0056] If it is not necessary to write data (S21: NO), the cores 1 to 3 determine whether or not it is necessary to read data from the shared memory 30 of the RAM 20 (step S24). If it is not necessary to read data (S24: NO), the cores 1 to 3 return the process to step S21. If it is necessary to read data (S24: YES), the cores 1 to 3 output a read request including an address from which data is read to the address conversion unit 11 (step S25). The cores 1 to 3 acquire the data read from the shared memory 30 of the RAM 20 in response to the read request (step S26). The cores 1 to 3 perform a process of checking the checksum attached to the read data (step S27). The cores 1 to 3 determine whether or not there is an abnormality in the shared memory 30 of the RAM 20 based on the checksum checking result (step S28). If there is no abnormality (S28: NO), the cores 1 to 3 return the process to step S21. If an abnormality is detected (S28: YES), the cores 1 to 3 notify the address conversion unit 11 of the abnormality (step S29), and the process returns to step S21.

[0057] <Summary> The in-vehicle information processing device 10 according to the present embodiment configured as described above includes multiple cores 1 to 3 that perform processing in parallel, and a shared memory 30 including multiple shared areas accessible to the cores 1 to 3. The multiple cores 1 to 3 exchange information via at least one of the multiple shared areas. If an abnormality is detected in at least one shared area used for information exchange, the multiple cores 1 to 3 exchange information via another shared area. As a result, even if an abnormality occurs in at least one shared area, it is expected that the multiple cores 1 to 3 will continue to exchange information via another shared area.

[0058] Furthermore, in the in-vehicle information processing device 10 according to this embodiment, an address conversion unit 11 is interposed between the multiple cores 1 to 3 and the RAM 20 having multiple shared areas, and the address conversion unit 11 converts between virtual addresses used by the cores 1 to 3 and physical addresses of the RAM 20. When an abnormality is detected in at least one shared area used by the multiple cores 1 to 3 for information exchange, the address conversion unit 11 changes the correspondence between the virtual address and the physical address, thereby switching the shared area used by the multiple cores 1 to 3 for information exchange. This allows the cores 1 to 3 to access information without considering the physical address of the shared area.

[0059] Furthermore, in the in-vehicle information processing device 10 according to this embodiment, an address conversion table 13 that stores the correspondence between virtual addresses and physical addresses is stored in the non-volatile storage unit 12, and the address conversion unit 11 performs address conversion by reading the address conversion table 13 from the non-volatile storage unit 12. When the in-vehicle information processing device 10 detects an abnormality in at least one shared area used by the multiple cores 1 to 3 for transmitting and receiving information, the in-vehicle information processing device 10 changes the correspondence in the address conversion table 13, thereby changing the address conversion by the address conversion unit 11. This makes it possible to easily change the address conversion by the address conversion unit 11.

[0060] Furthermore, in the in-vehicle information processing device 10 according to this embodiment, the address conversion unit 11 acquires the address conversion table 13 stored in the non-volatile storage unit 12 when the in-vehicle information processing device 10 is started, and performs address conversion according to the contents of the acquired address conversion table 13. When the in-vehicle information processing device 10 detects an abnormality in at least one shared area used by the multiple cores 1 to 3 for transmitting and receiving information, the in-vehicle information processing device 10 changes the contents of the address conversion table 13 in the non-volatile storage unit 12 and then restarts the in-vehicle information processing device 10. In this way, the change in address conversion made by the address conversion unit 11 can be easily reflected by restarting the in-vehicle information processing device 10.

[0061] Furthermore, in the in-vehicle information processing device 10 according to this embodiment, a plurality of areas provided in the shared memory 30 of one RAM 20 are used as a plurality of shared areas used by the cores 1 to 3 for sending and receiving information. This makes it possible to realize a plurality of shared areas used by the cores 1 to 3 for sending and receiving information at low cost.

[0062] In this embodiment, the address conversion table 13 in the address conversion unit 11 is updated by restarting the in-vehicle information processing device 10, but this is not limited thereto, and the address conversion table 13 in the address conversion unit 11 may be updated by a method other than restarting. For example, when an abnormality is detected, the address conversion table 13 in the non-volatile storage unit 12 may be changed, and after the change is completed, the address conversion unit 11 may obtain the address conversion table 13 from the non-volatile storage unit 12 without restarting and use it for subsequent address conversion processing.

[0063] In this embodiment, when data is read from the shared area, the presence or absence of an abnormality in the shared area is judged, but this is not limited thereto, and for example, the presence or absence of an abnormality may be judged when data is written to the shared area. Furthermore, when an abnormality in the shared area is detected, the process of changing the address conversion table 13 and restarting the in-vehicle information processing device 10 may be performed by any of the cores 1 to 3, rather than by the address conversion unit 11.

[0064] <Embodiment 2> The in-vehicle information processing device 10 according to the second embodiment writes the same data to a plurality of shared areas of the shared memory 30 of the RAM 20. When the address conversion unit 11 of the in-vehicle information processing device 10 according to the second embodiment receives a request from the cores 1 to 3 to write data to the shared memory 30, the address conversion unit 11 writes the same data, for example, to a first shared area and a second shared area of ​​the shared memory 30. After that, when a request to read this data is received from the cores 1 to 3, the address conversion unit 11 reads the data written in the first shared area and provides it to the requesting cores 1 to 3.

[0065] If it is determined that an abnormality has occurred in the first shared area based on the checksum added to the read data, the in-vehicle information processing device 10 switches the shared area for writing and reading data from the first shared area to the second shared area by changing the address conversion table 13 of the address conversion unit 11. Thereafter, the address conversion unit 11 of the in-vehicle information processing device 10 writes the same data to the second shared area and the third shared area in response to a write request from the cores 1 to 3. Also, in response to a read request from the cores 1 to 3, the address conversion unit 11 reads the data written in the second shared area and provides it to the cores 1 to 3.

[0066] That is, the in-vehicle information processing device 10 according to the second embodiment writes the same data to the i-th shared area and the i+1-th shared area (i=1, 2, ..., N-1) of the multiple shared areas of the RAM 20. Writing the same data to the multiple shared areas may be performed in parallel or sequentially. When reading data, the in-vehicle information processing device 10 reads data stored in the i-th shared area. However, the in-vehicle information processing device 10 may read data from the i+1-th shared area. The in-vehicle information processing device 10 may also read data from two shared areas, confirm that the data match, and provide the data to the requesting cores 1 to 3. In this case, if the data read from the two shared areas do not match, the in-vehicle information processing device 10 may determine that an abnormality has occurred in the shared area.

[0067] In addition, in the in-vehicle information processing device 10 according to the second embodiment, when the RAM 20 is configured using a volatile memory element such as SRAM or DRAM, it is preferable that after detecting an abnormality in the shared area and changing the address conversion table 13 in the non-volatile storage unit 12, the address conversion unit 11 acquires the address conversion table 13 from the non-volatile storage unit 12 and changes the correspondence between the virtual address and the physical address without restarting the device. Alternatively, it is preferable that the data stored in the RAM 20 is not initialized when the device is restarted. This makes it possible to expect that the cores 1 to 3 will continue to perform processing using the data written in the (i+1)th shared area. Note that in the in-vehicle information processing device 10, when the RAM 20 is configured using a non-volatile memory element, the device may or may not be restarted.

[0068] 5 is a flowchart showing the procedure of processing performed by the address conversion unit 11 of the in-vehicle information processing device 10 according to the embodiment 2. Note that this flowchart shows the procedure when the cores 1 to 3 access the shared memory 30 of the RAM 20, and does not show the access to the memory 21 for core 1, the memory 22 for core 2, or the memory 23 for core 3 of the RAM 20.

[0069] The address conversion unit 11 of the in-vehicle information processing device 10 according to the second embodiment judges whether or not a write request for data to the shared memory 30 of the RAM 20 is given from the cores 1 to 3 (step S41). When a write request is given (S41: YES), the address conversion unit 11 performs an exclusive process to restrict access from other cores 1 to 3 to the shared area of ​​the shared memory 30 of the RAM 20 (step S42). The address conversion unit 11 converts the virtual address designated by the cores 1 to 3 that have issued the write request into a physical address and writes data to the shared area that is the target of the write request (step S43). Furthermore, the address conversion unit 11 writes the same data to the shared area next to the shared area to which the data was written in step S43 (step S44). Thereafter, the address conversion unit 11 performs an exclusive end process to release the restriction on access to this shared area (step S45), and returns the process to step S41.

[0070] If no write request is given from the cores 1 to 3 (S41: NO), the address translation unit 11 judges whether or not a data read request for the shared memory 30 of the RAM 20 is given from the cores 1 to 3 (step S46). If no read request is given (S46: NO), the address translation unit 11 returns the process to step S41. If a read request is given (S46: YES), the address translation unit 11 performs an exclusive process to restrict access from other cores 1 to 3 to the shared area of ​​the shared memory 30 of the RAM 20 (step S47). The address translation unit 11 converts the virtual address designated by the cores 1 to 3 that issued the read request into a physical address, and reads data from the shared area that is the target of the read request (step S48). Thereafter, the address translation unit 11 performs an exclusive end process to release the restriction on access to this shared area (step S49).

[0071] The address conversion unit 11 judges whether or not a notice of abnormality has been given from the cores 1 to 3 that have read data from the shared area (step S50). If a notice of abnormality has not been given (S50: NO), the address conversion unit 11 returns the process to step S41. If a notice of abnormality has been given (S50: YES), the address conversion unit 11 changes the setting contents of the address conversion table 13 stored in the non-volatile storage unit 12 so as to switch from the currently accessed shared area to another shared area (step S51). Thereafter, the address conversion unit 11 acquires the address conversion table 13 from the non-volatile storage unit 12 (step S52), starts address conversion reflecting the changed setting of the address conversion table 13, and returns the process to step S41.

[0072] The in-vehicle information processing device 10 according to the second embodiment configured as described above writes the same data to each of the multiple shared areas in response to a data write request from the cores 1 to 3. This allows data to be backed up in the multiple shared areas. Even if the multiple cores 1 to 3 change the shared area used for information exchange in response to abnormality detection, the cores 1 to 3 can easily continue processing because the same data is stored in the new shared area.

[0073] In embodiment 2, the in-vehicle information processing device 10 writes the same data to two of the multiple shared areas, but this is not limited to this, and the same data may be written to three or more shared areas, or the same data may be written to all shared areas.

[0074] Moreover, other configurations of the in-vehicle information processing device according to the second embodiment are similar to those of the in-vehicle information processing device according to the first embodiment, so the same reference numerals are used for the same parts and detailed description is omitted.

[0075] <Embodiment 3> 6 is a block diagram showing a configuration of an in-vehicle information processing device 10 according to embodiment 3. The in-vehicle information processing device 10 according to embodiment 3 includes a plurality of RAMs accessible by the cores 1 to 3. In the illustrated example, the in-vehicle information processing device 10 includes two RAMs, a first RAM 121 and a second RAM 122. It is preferable that the first RAM 121 and the second RAM 122 have the same capacity, but this is not limited thereto, and the capacities may be different.

[0076] FIG. 7 is a schematic diagram for explaining the storage areas of the first RAM 121 and the second RAM 122 of the in-vehicle information processing device 10 according to the third embodiment. The storage area of ​​the first RAM 121 of the in-vehicle information processing device 10 according to the third embodiment is roughly divided into three storage areas, namely, the shared memory 30, the memory 21 for core 1, the memory 22 for core 2, and the memory 23 for core 3. Similarly, the storage area of ​​the second RAM 122 is roughly divided into three storage areas, namely, the shared memory 30, the memory 21 for core 1, the memory 22 for core 2, and the memory 23 for core 3. The memory 21 for core 1 of the first RAM 121 and the second RAM 122 is a dedicated storage area in which the core 1 stores data, and is a storage area that cannot be accessed by the core 2 and the core 3. Similarly, the memory 22 for core 2 is a dedicated storage area in which the core 2 stores data, and is a storage area that cannot be accessed by the core 3 and the core 1. The memory 23 for core 3 is a dedicated storage area in which core 3 stores data, and is a storage area which core 1 and core 2 cannot access.

[0077] The shared memory 30 of the first RAM 121 and the second RAM 122 is a storage area that can be accessed by the cores 1 to 3. The shared memory 30 according to the third embodiment is not divided into a plurality of shared areas as in the shared memory shown in FIG. 2, but the entire shared memory 30 is used as one shared area. For example, when the in-vehicle information processing device 10 is manufactured and operated for the first time, the writing and reading of data by the cores 1 to 3 and the transfer of data between the cores 1 to 3 are performed using the first RAM 121, and the second RAM 122 is not used. At this time, when a request for writing or reading data is given from the cores 1 to 3, the address conversion unit 11 converts the virtual address designated by the cores 1 to 3 into the physical address of the first RAM 121. The in-vehicle information processing device 10 continues to use the first RAM 121 for writing and reading data by the cores 1 to 3 until an abnormality occurs in writing or reading data using the first RAM 121.

[0078] When an abnormality or the like is detected in writing and reading data using the first RAM 121, the in-vehicle information processing device 10 according to the third embodiment changes the RAM used for writing and reading data for the cores 1 to 3 from the first RAM 121 to the second RAM 122. When a data writing or reading request is given from the cores 1 to 3, the address conversion unit 11 converts the virtual address specified by the cores 1 to 3 into the physical address of the second RAM 122.

[0079] The in-vehicle information processing device 10 according to the third embodiment performs data transfer between the cores 1 to 3 using the shared memory 30 in the first RAM 121. When an abnormality or the like occurs in the shared memory 30 in the first RAM 121, the in-vehicle information processing device 10 switches to the second RAM 122. At this time, the in-vehicle information processing device 10 changes the address conversion by the address conversion unit 11 by changing the address conversion table 13 stored in the non-volatile storage unit 12. For example, the in-vehicle information processing device 10 changes the conversion rule of the address conversion table 13, in which a conversion rule for converting a virtual address related to an access to the shared memory 30 of the cores 1 to 3 into a physical address of the shared memory 30 in the first RAM 121 is set, to convert the virtual address into a physical address of the shared memory 30 in the second RAM 122.

[0080] The in-vehicle information processing device 10 according to the third embodiment configured as above includes a plurality of memory elements as the first RAM 121 and the second RAM 122, and the cores 1 to 3 exchange data via the first RAM 121. If an abnormality occurs in the first RAM 121, the first RAM 121 is switched to the second RAM 122, and the cores 1 to 3 exchange data via the second RAM 122. As a result, even if an abnormality occurs in the first RAM 121, the multiple cores 1 to 3 can be expected to continue to exchange data via the second RAM 122.

[0081] In the third embodiment, the in-vehicle information processing device 10 has two RAMs, the first RAM 121 and the second RAM 122. However, the present invention is not limited to this. The in-vehicle information processing device 10 may have three or more RAMs and switch the RAM to be used in sequence depending on the detection of an abnormality. The in-vehicle information processing device 10 according to the third embodiment may switch from the first RAM 121 to the second RAM 122 not only when an abnormality is detected in the shared memory 30 of the first RAM 121, but also when an abnormality is detected in the memory 21 for core 1, the memory 22 for core 2, or the memory 23 for core 3. In this case, information for error detection such as a checksum is added to the data stored in the memory 21 for core 1, the memory 22 for core 2, and the memory 23 for core 3. In addition, the second RAM 122 of the in-vehicle information processing device 10 is configured to have memory 21 for core 1, memory 22 for core 2, and memory 23 for core 3, but this is not limited to this, and the second RAM 122 may be configured to have only shared memory, in which case the capacity of the second RAM 122 may be smaller than the capacity of the first RAM 121.

[0082] 2 in the shared memory 30 of the first RAM 121 and the second RAM 122. In this case, the in-vehicle information processing device 10 switches between the first shared area to the Nth shared area of ​​the shared memory 30 of the first RAM 121 in order, and when an abnormality is detected in the Nth shared area of ​​the shared memory 30 of the first RAM 121, the in-vehicle information processing device 10 switches to the first shared area of ​​the shared memory 30 of the second RAM 122. The in-vehicle information processing device 10 according to the third embodiment may write the same data to both the first RAM 121 and the second RAM 122, like the in-vehicle information processing device 10 according to the second embodiment.

[0083] Moreover, other configurations of the in-vehicle information processing device according to embodiment 3 are similar to those of the in-vehicle information processing device according to embodiment 1, so the same reference numerals are used for the same parts and detailed description is omitted.

[0084] <Fourth embodiment> The in-vehicle information processing devices according to the first to third embodiments are configured to eliminate adverse effects of an abnormality by switching the first to Nth shared areas of the shared memory 30 in response to the detection of an abnormality. In contrast, the invention according to the fourth embodiment is configured to prevent any malicious intrusion or attack from the outside from identifying which of the first to Nth shared areas of the shared memory 30 is being used, and to prevent unauthorized rewriting of data in the shared memory 30.

[0085] Fig. 8 is a block diagram showing the configuration of an in-vehicle information processing device according to embodiment 4. The in-vehicle information processing device according to embodiment 4 is configured to include cores 1 to 3, an address conversion unit 11, a non-volatile storage unit 12, a RAM 20, a communication unit 415, a connector detection unit 416, and a case open detection unit 417. The cores 1 to 3, the address conversion unit 11, the non-volatile storage unit 12, and the RAM 20 are similar to those included in the in-vehicle information processing device according to embodiment 1 shown in Fig. 1, and therefore description thereof will be omitted.

[0086] The communication unit 415 communicates with other devices via an in-vehicle network provided in the vehicle 100. The communication unit 415 communicates based on a communication protocol such as CAN (Controller Area Network) or Ethernet (registered trademark). The in-vehicle information processing device 10 is connected to a communication line constituting the in-vehicle network, and the communication unit 415 transmits data by converting data for transmission provided from the cores 1 to 3 into an electric signal and outputting the electric signal to the communication line. The communication unit 415 converts the electric signal on the communication line into digital data by sampling and acquiring the electric potential of the communication line, and provides the converted data to the cores 1 to 3 as received data.

[0087] The connector detection unit 416 detects the connection state of a connector provided on a communication line, a power line, or the like, to one or more connectors provided in the in-vehicle information processing device. The connector detection unit 416 detects whether a connector such as a communication line is connected to its own connector by detecting, for example, the amount of current flowing through its own connector and its change, etc. When a connector such as a communication line is connected to its own connector, or when a connected connector is disconnected, the connector detection unit 416 notifies the cores 1 to 3, etc. to that effect.

[0088] The housing opening detection unit 417 detects that the housing of the in-vehicle information processing device 10 has been opened. The in-vehicle information processing device 10 has a configuration in which a circuit board on which circuit elements such as the cores 1 to 3 are mounted is housed in a housing made of, for example, synthetic resin or metal. The housing has, for example, a rectangular parallelepiped shape, one side of which is a removable lid. The housing opening detection unit 417 is connected to, for example, a switch that is switched on / off depending on whether the lid is attached or detached, and detects whether the housing has been opened by detecting the on / off state of this switch, and notifies the cores 1 to 3, etc. of the detection result.

[0089] In the in-vehicle information processing device, the multiple cores 1 to 3 write and read data using one (or multiple) of the first shared area to the Nth shared area included in the shared memory 30 of the RAM 20, and transmit and receive data among the cores 1 to 3. The in-vehicle information processing device according to the fourth embodiment performs a process of changing the first shared area to the Nth shared area of ​​the shared memory 30 used by the cores 1 to 3 at a predetermined timing, making it difficult for an external party to identify which shared area is being used by the cores 1 to 3.

[0090] In the fourth embodiment, the predetermined timing for the in-vehicle information processing device to change the shared area may be, for example, any of the following (1) to (5). However, the predetermined timing for the shared area change may be any timing other than the following (1) to (5). (1) The shared area is changed every time the in-vehicle information processing device is started. (2) If any kind of external attack on the in-vehicle information processing device is detected, the shared area is changed. (3) The shared area is repeatedly changed at a predetermined period. (4) When the housing of the in-vehicle information processing device is opened, the shared area is changed. (5) The shared area is changed when the connector connected to the vehicle-mounted information processing device is removed.

[0091] (1) At device startup The in-vehicle information processing device according to the fourth embodiment is started up by power supplied from a battery or the like when, for example, the ignition switch of the vehicle 100 is switched from an off state to an on state. The in-vehicle information processing device starts a process of changing the shared area of ​​the shared memory 30 in the RAM 20 after performing a start-up process including a process of initializing the registers in the cores 1 to 3 and the RAM 20.

[0092] The in-vehicle information processing device randomly selects one shared area from N shared areas, for example, the first shared area to the Nth shared area. The method of selecting a shared area may be a method other than random. The selection of a shared area may be performed, for example, by any one of the cores 1 to 3 of the in-vehicle information processing device 10, by the address conversion unit 11, or by a control circuit or the like other than these. The in-vehicle information processing device changes the address conversion table 13 of the non-volatile storage unit 12 so that one shared area randomly selected from the N shared areas becomes a storage area shared by the cores 1 to 3. The address conversion unit 11 of the in-vehicle information processing device acquires the changed address conversion table 13 from the non-volatile storage unit 12, and performs access control of the cores 1 to 3 to the RAM 20 according to the acquired address conversion table 13.

[0093] (2) When an attack is detected The in-vehicle information processing device 10 communicates with other devices mounted on the vehicle 100 through the in-vehicle network by the communication unit 415. The communication unit 415 of the in-vehicle information processing device 10 according to the fourth embodiment has a function of detecting an attack from the outside to the in-vehicle information processing device 10 through the in-vehicle network. The communication unit 415 can detect an attack on the in-vehicle information processing device 10, for example, when data with unregistered identification information (such as CAN-ID) is received, when the amount of data transmitted to the in-vehicle network in a certain period of time exceeds a threshold, or when data that should be transmitted in a predetermined cycle is received at a timing different from this cycle. The communication unit 415 that detects the attack notifies the cores 1 to 3, etc. to that effect. When the communication unit 415 detects an attack, the in-vehicle information processing device 10 randomly selects one of the N shared regions and changes to the selected shared region.

[0094] (3) Predetermined period The in-vehicle information processing device 10 according to the fourth embodiment changes the shared areas used by the cores 1 to 3 at a predetermined cycle. The predetermined cycle for changing the shared areas may be set to an appropriate period such as several minutes to several tens of minutes, or several hours to several days. After changing the shared area, the in-vehicle information processing device 10 starts measuring time using its own timer function or the like, and when the elapsed time measured by the timer reaches a time set as the predetermined cycle, the in-vehicle information processing device 10 randomly selects one of the N shared areas and changes to the selected shared area.

[0095] (4) Opening the case As described above, the in-vehicle information processing device 10 according to the fourth embodiment includes the case-open detection unit 417. When the case-open detection unit 417 detects that the case of the in-vehicle information processing device 10 has been opened (the cover of the case has been removed), the in-vehicle information processing device 10 randomly selects one of the N shared areas and changes to the selected shared area.

[0096] (5) Disconnect the connector As described above, the in-vehicle information processing device 10 according to the fourth embodiment includes the connector detection unit 416. When the connector detection unit 416 detects that the connector of the communication line has been removed from the connector of the in-vehicle information processing device 10, the in-vehicle information processing device 10 randomly selects one of the N shared areas and changes to the selected shared area.

[0097] 9 is a flowchart showing the procedure of the process performed by the in-vehicle information processing device 10 according to the fourth embodiment. The process shown in the figure is performed by any one of the cores 1 to 3 of the in-vehicle information processing device 10 or the address conversion unit 11. However, the in-vehicle information processing device 10 may be provided with another functional unit or circuit that performs this process. In the following description, it is described that the core 1 performs the process.

[0098] Core 1 of the in-vehicle information processing device according to the fourth embodiment performs a startup process such as initializing its own registers when the in-vehicle information processing device 10 is started (step S61). After the startup process is completed, core 1 performs a process to change the shared area used by cores 1 to 3 for data exchange among a plurality of shared areas in the shared memory 30 of the RAM 20 (step S62). After the shared area change process is completed, core 1 starts time measurement using its own timer (step S63). This timer is used to determine the period for executing the shared area change process.

[0099] Based on whether the elapsed time measured by the timer exceeds a preset time, core 1 determines whether a predetermined period has elapsed since the previous execution of the shared area change process (step S64). If the predetermined period has elapsed (S64: YES), core 1 performs the shared area change process (step S68), resets the timer (step S69), and returns the process to step S64.

[0100] If the predetermined period has not elapsed (S64: NO), core 1 determines whether there has been an external attack (step S65) based on the presence or absence of a notification from communication unit 415. If there has been an external attack (S65: YES), core 1 performs a shared area change process (step S68), resets the timer (step S69), and returns the process to step S64.

[0101] If there is no external attack (S65: NO), the core 1 determines whether the housing of the in-vehicle information processing device 10 has been opened (step S66) based on the presence or absence of a notification from the housing open detection unit 417. If the housing has been opened (S66: YES), the core 1 performs a shared area change process (step S68), resets the timer (step S69), and returns the process to step S64.

[0102] If the case is not opened (S66: NO), the core 1 determines whether or not the connector of the communication line connected to the connector of the in-vehicle information processing device 10 has been disconnected based on the notification from the connector detection unit 416 (step S67). If the connector has been disconnected (S67: YES), the core 1 performs a shared area change process (step S68), resets the timer (step S69), and returns the process to step S64. If the connector has not been disconnected (S67: NO), the core 1 returns the process to step S64.

[0103] 10 is a flowchart showing the procedure of the shared area change process performed by the in-vehicle information processing device 10 according to embodiment 4. The shared area change process shown in this figure is the process performed in steps S62 and S68 of the flowchart shown in FIG.

[0104] The core 1 of the in-vehicle information processing device according to the fourth embodiment notifies the other cores 2 and 3 of the start of a shared area change process (step S81). Upon receiving this notification, the other cores 2 and 3 can, for example, temporarily stop their own processing and wait until the shared area change process is completed.

[0105] Core 1 randomly selects one or more shared areas to be used by cores 1 to 3 from the multiple shared areas (first shared area to Nth shared area) in the shared memory 30 of RAM 20 (step S82). Core 1 changes the address translation table 13 in the non-volatile storage unit 12 so that the selected shared area is used by cores 1 to 3 (step S83).

[0106] The core 1 instructs the address conversion unit 11 to read the address conversion table 13 from the non-volatile storage unit 12 (step S84). In response to this instruction, the address conversion unit 11 reads the changed address conversion table 13 and performs subsequent address conversion according to the read address conversion table 13.

[0107] The core 1 notifies the other cores 2 and 3 of the end of the shared area change process (step S85), and ends the shared area change process. In response to this notification, the other cores 2 and 3 can resume the processes that were paused until the end of the shared area change process.

[0108] The in-vehicle information processing device 10 according to the fourth embodiment configured as described above changes the shared area of ​​the shared memory 30 in the RAM 20 used by the multiple cores 1 to 3 for sending and receiving information at a predetermined timing. This is expected to improve the security performance of the in-vehicle information processing device 10, and is expected to contribute to the adoption of a multi-core and shared memory configuration in devices mounted on vehicles.

[0109] The predetermined timing for changing the shared area in the in-vehicle information processing device 10 according to the fourth embodiment includes at least one of the timing when the in-vehicle information processing device 10 is started, the timing when the communication unit 415 detects an attack from the outside, the timing when a predetermined period has elapsed, the timing when the housing opening detection unit 417 detects that the housing of the in-vehicle information processing device 10 has been opened, and the timing when the connector of the communication line connected to the connector of the in-vehicle information processing device 10 is removed. By changing the shared area at such timing, it is expected that the in-vehicle information processing device 10 makes it difficult to identify which shared area is being used by the multiple cores 1 to 3 in the event of, for example, a malicious intrusion or attack on the device from the outside, and makes it difficult to tamper with information in the shared area.

[0110] The in-vehicle information processing device 10 according to the fourth embodiment randomly selects one or more shared areas to be used by the cores 1 to 3 from among the multiple shared areas (first shared area to Nth shared area) in the shared memory 30 of the RAM 20. This is expected to make it difficult for the in-vehicle information processing device 10 to identify from the outside the shared areas used by the multiple cores 1 to 3.

[0111] In the fourth embodiment, the timing when the in-vehicle information processing device 10 changes the shared area is given as five timings: when the device is started, when an external attack is detected, when a predetermined period has elapsed, when the housing is opened, and when a connector is removed, but these are only examples. The in-vehicle information processing device 10 may change the shared area at various timings other than the above five timings.

[0112] The in-vehicle information processing device 10 according to the fourth embodiment has a configuration in which a plurality of shared areas are provided in one RAM 20, but is not limited to this. The in-vehicle information processing device 10 may have a configuration including a plurality of RAMs, similar to the in-vehicle information processing device 10 according to the third embodiment, and may be configured to change the RAM shared by the cores 1 to 3.

[0113] Moreover, other configurations of the in-vehicle information processing device according to embodiment 4 are similar to those of the in-vehicle information processing device according to embodiments 1 to 3, so the same reference numerals are used for the same parts and detailed description is omitted.

[0114] The in-vehicle information processing device includes a computer including a microprocessor, a ROM, a RAM, etc. An arithmetic processing unit such as a microprocessor may read out and execute a computer program including some or all of the steps of sequence diagrams or flowcharts such as those shown in Figures 3 to 5 from a storage unit such as a ROM or RAM. Each of the computer programs of these multiple devices can be installed from an external server device or the like. Furthermore, each of these computer programs is distributed in a state of being stored on a recording medium such as a CD-ROM, a DVD-ROM, or a semiconductor memory.

[0115] The embodiments disclosed herein are illustrative in all respects and should not be considered as limiting. The scope of the present disclosure is defined by the claims, not by the above meaning, and is intended to include all modifications within the scope and meaning equivalent to the claims.

[0116] (Additional Note) (Appendix 1) It is mounted on the vehicle, A plurality of processing units that perform processing in parallel; a plurality of shared storage units accessible by the plurality of processing units; a detection unit for detecting an abnormality in the shared storage unit; Equipped with The plurality of processing units include Sending and receiving information via at least one shared storage unit; when the detection unit detects an abnormality in the at least one shared storage unit, information is exchanged via another shared storage unit. In-vehicle information processing device. (Appendix 2) an address conversion unit provided between the plurality of processing units and the plurality of shared storage units, converting a virtual address used when the processing units access stored information and a physical address of the shared storage unit; the address conversion unit, when the detection unit detects an abnormality, changes the correspondence between the virtual address and the physical address, and switches the shared storage unit between which the plurality of processing units exchange information. 2. An in-vehicle information processing device according to claim 1. (Appendix 3) a storage unit that stores an address conversion table that stores the correspondence between the virtual address and the physical address; The address conversion unit performs address conversion based on the address conversion table stored in the storage unit, When the detection unit detects an abnormality, the correspondence stored in the address conversion table is changed. 3. An in-vehicle information processing device according to claim 2. (Appendix 4) The address conversion unit acquires the address conversion table stored in the storage unit when the device is started up, When the detection unit detects an abnormality, the correspondence stored in the address conversion table stored in the storage unit is changed and the device is restarted. 4. The vehicle-mounted information processing device according to claim 3. (Appendix 5) In response to a write request for information from the processing unit, each of the plurality of shared storage units stores the same information. 5. An in-vehicle information processing device according to claim 1, (Appendix 6) The plurality of shared storage units are a plurality of storage areas provided in one memory element accessible by the plurality of processing units. 6. An in-vehicle information processing device according to any one of Supplementary Note 1 to Supplementary Note 5. (Appendix 7) The plurality of shared storage units are a plurality of memory elements accessible by the plurality of processing units. 6. An in-vehicle information processing device according to any one of Supplementary Note 1 to Supplementary Note 5. (Appendix 8) An in-vehicle information processing device including a plurality of processing units that perform processing in parallel and a plurality of shared storage units that can be accessed by the plurality of processing units, transmitting and receiving information between the plurality of processing units via at least one shared storage unit; Detecting an abnormality in the shared storage unit; when an abnormality is detected in at least one of the shared storage units, information is exchanged among the plurality of processing units via another shared storage unit. In-vehicle information processing method. [Explanation of symbols]

[0117] 1~3 Core (processing section, detection section) 10. In-vehicle information processing device 11 Address translation unit 12 Non-volatile memory unit (memory unit) 13 Address Translation Table 20 RAM 21 Memory for Core 1 22 Memory for Core 2 23 Memory for Core 3 30 Shared memory (shared storage) 100 vehicles 121 1st RAM 122 2nd RAM 415 Communications Department 416 Connector detection unit 417 Housing opening detection unit

Claims

1. Mounted on the vehicle, A plurality of processing units that perform processing in parallel; a plurality of shared storage units accessible by the plurality of processing units; Equipped with The plurality of processing units include Sending and receiving information via at least one shared storage unit; At a predetermined timing, the shared storage unit used for transmitting and receiving information is changed. In-vehicle information processing device.

2. a detection unit for detecting an abnormality in the shared storage unit, the predetermined timing is a timing when the detection unit detects an abnormality in the at least one shared storage unit, when the detection unit detects an abnormality in the at least one shared storage unit, the plurality of processing units transmit and receive information via another shared storage unit. The in-vehicle information processing device according to claim 1 .

3. The predetermined timing includes at least one of a timing when the device is started, a timing when an external attack is detected, a timing when a predetermined period has elapsed, a timing when a case of the device is opened, and a timing when a connector connected to the device is removed. The in-vehicle information processing device according to claim 1 or 2.

4. the plurality of processing units change the shared storage unit used for transmitting and receiving information to a shared storage unit randomly selected from the plurality of shared storage units; The vehicle-mounted information processing device according to claim 3 .

5. an address conversion unit provided between the plurality of processing units and the plurality of shared storage units, converting a virtual address used when the processing units access stored information and a physical address of the shared storage unit; the address conversion unit changes the correspondence between the virtual address and the physical address at the predetermined timing, and switches the shared storage unit between which the plurality of processing units exchange information; 5. The vehicle-mounted information processing device according to claim 1.

6. a storage unit that stores an address conversion table that stores the correspondence between the virtual address and the physical address; The address conversion unit performs address conversion based on the address conversion table stored in the storage unit, At the predetermined timing, the correspondence stored in the address conversion table is changed. The vehicle-mounted information processing device according to claim 5 .

7. The address conversion unit acquires the address conversion table stored in the storage unit when the device is started up, At the predetermined timing, the correspondence stored in the address conversion table stored in the storage unit is changed, and the device is restarted. The vehicle-mounted information processing device according to claim 6.

8. In response to a write request for information from the processing unit, each of the plurality of shared storage units stores the same information. The vehicle-mounted information processing device according to any one of claims 1 to 7.

9. The plurality of shared storage units are a plurality of storage areas provided in a single memory element accessible by the plurality of processing units. The vehicle-mounted information processing device according to any one of claims 1 to 8.

10. The plurality of shared storage units are a plurality of memory elements accessible by the plurality of processing units. The vehicle-mounted information processing device according to any one of claims 1 to 8.

11. Mounted on the vehicle, A plurality of processing units that perform processing in parallel; a plurality of shared storage units accessible by the plurality of processing units; a detection unit for detecting an abnormality in the shared storage unit; Equipped with The plurality of processing units include Sending and receiving information via at least one shared storage unit; when the detection unit detects an abnormality in the at least one shared storage unit, information is exchanged via another shared storage unit. In-vehicle information processing device.

12. An in-vehicle information processing device including a plurality of processing units that perform processing in parallel and a plurality of shared storage units that can be accessed by the plurality of processing units, transmitting and receiving information between the plurality of processing units via at least one shared storage unit; At a predetermined timing, the shared storage unit used for transmitting and receiving information is changed. In-vehicle information processing method.

Images