Operation control device, operation control program, and electronic control device

Abstract

To provide an operation control device capable of preventing processing which has to be executed continuously from being interrupted by switching processing.SOLUTION: A first processing unit 21 is configured to execute switching processing which switches between operating machines VM10 and VM11, whichever is currently in operation. The operating machine transmits a prohibition request when starting specific processing which has to be executed continuously, and transmits a permission request upon completion of specific processing. A second processing unit 22 executes, upon receiving the prohibition request, determination processing for determining whether the remaining time, which is the time from that point of time until the operating time elapses, is equal to or greater than a predetermined set time. If the remaining time is equal to or greater than the set time as a result of the determination processing, the second processing unit executes prohibition processing to prohibit execution of switching processing. If the remaining time is less than the set time, the second processing unit executes permission processing to allow execution of switching processing without executing prohibition processing upon receiving the permission request. The operating machine executes specific processing during the prohibition period in which prohibition processing is being executed.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present invention relates to an operation control device that controls the operation of each of a plurality of virtual machines by time-division operation for each operation cycle by an operation time assigned in advance, an operation control program to be executed by the operation control device, and an electronic control device including the operation control device.

Background Art

[0002] For example, a vehicle such as an automobile is equipped with a plurality of electronic control units, and these plurality of electronic control units communicate with each other and cooperate to perform various processes. In this specification, an electronic control unit may be abbreviated as an ECU. In recent years, since the number of ECUs mounted on a vehicle has been increasing, a method of integrating a plurality of ECUs into one has been implemented. In an integrated ECU, which is an ECU integrated in this way, the functions of a plurality of ECUs that conventionally operated independently are mounted as a plurality of virtual machines on one microcomputer via a hypervisor. In this specification, a microcomputer may be abbreviated as a microcontroller.

[0003] In a conventional ECU, the resources of one microcontroller could be occupied by the function of one ECU, but in an integrated ECU, each of a plurality of virtual machines uses the resources of one microcontroller. Therefore, in an integrated ECU, control by time-division scheduling that assigns a fixed operation time to a plurality of virtual machines is performed. By time-division scheduling, each of the plurality of virtual machines operates individually with the operation time assigned in advance, so there is no need to allocate resources in cooperation among the virtual machines.

[0004] In the above configuration, when a predetermined virtual machine operates, a switching process for switching the virtual machine in operation is executed at the stage when the operation time is consumed. That is, in the above configuration, there is a possibility that the switching process is executed regardless of whether the process in operation has been completed. Therefore, in the above configuration, during the execution of a process that must be continuously executed, that is, a non-interruptible process or an atomic process, the switching process is executed, and as a result, a problem occurs in that a non-interruptible process or the like is interrupted.

[0005] As prior arts related to such problems, the techniques disclosed in Patent Documents 1 and 2 can be cited. First, Patent Document 1 discloses a method of dividing tasks into several groups and adaptively time-sharing the processing times of those groups. Subsequently, Patent Document 2 discloses a method of guaranteeing a non-interruptible process by detecting an interrupt task when an interrupt task occurs during a non-interruptible process, invalidating the interrupt task, and executing the interrupt task after the non-interruptible process is completed.

Prior Art Documents

Patent Documents

[0006]

Patent Document 1

Patent Document 2

Summary of the Invention

Problems to be Solved by the Invention

[0007] However, in the prior art disclosed in Patent Document 1, non-interruptible processing is not considered. Further, in the prior art disclosed in Patent Document 2, it is not possible to consider that there is a possibility that a task cannot be executed without completing a process where an interrupt is known to occur in advance, such as a switching process for switching a virtual machine in operation, and a non-interruptible process. For these reasons, it has been difficult to solve the above-described problems in the prior art.

[0008] The present invention has been made in view of the above circumstances, and an object thereof is to provide an operation control device, an operation control program, and an electronic control device that can prevent a process that must be continuously executed from being interrupted by a switching process.

Means for Solving the Problems

[0009] The operation control device according to claim 1 performs control for operating each of a plurality of virtual machines (10, 11) in a time-sharing manner for operation times assigned in advance for each operation cycle. In this case, a virtual machine that is operating among the plurality of virtual machines is set as an operation machine. The operation control device includes a first processing unit (21) that can execute a switching process for switching the operation machine, and a second processing unit (22) that can execute a prohibition process for prohibiting execution of the switching process and a permission process for permitting execution of the switching process. When starting a specific process that is a process that must be continuously executed, that is, a non-interruptible process or an atomic process, the operation machine transmits a prohibition request, and transmits a permission request when the specific process is completed.

[0010] When the second processing unit receives the prohibition request, it executes a determination process to determine whether the remaining time, which is the time from that point until the operation time elapses, is equal to or longer than a predetermined set time. When the result of the determination process indicates that the remaining time is equal to or longer than the set time, the second processing unit executes the prohibition process. When the remaining time is less than the set time, the second processing unit does not execute the prohibition process. Further, when the second processing unit receives the permission request, it executes the permission process. The operating machine executes the specific process during the prohibition period, which is the period during which the prohibition process is being executed.

[0011] According to the above configuration, it is possible to prevent a switching process for switching the operating machine from occurring while the operating machine is executing the specific process. In this way, it is possible to guarantee consistent operation until the specific process is completed. Further, according to the above configuration, by the second processing unit executing the determination process, when the remaining time is less than the set time, in other words, when it is extremely unlikely that the specific process that is about to start can be completed before the operation time elapses, the prohibition process is not executed, and accordingly, the specific process is not executed either. In this way, a specific process that is not expected to be completed in its operation cycle can be executed in the next operation cycle. As described above, according to the above configuration, an excellent effect can be obtained in that it is possible to prevent the specific process, which is a process that must be executed continuously, from being interrupted by the switching process.

Brief Description of the Drawings

[0012]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

Figure 12

Figure 13

Figure 14

Figure 15

Figure 16

Figure 17

Figure 18

Figure 19

Figure 20

Figure 21

Figure 22

Figure 23

Figure 24

Figure 25

Figure 26

Mode for Carrying Out the Invention

[0013] Hereinafter, a plurality of embodiments of the present invention will be described with reference to the drawings. In each embodiment, substantially the same configurations are denoted by the same reference numerals and the description thereof is omitted. (First Embodiment) Hereinafter, the first embodiment will be described with reference to FIGS. 1 to 22.

[0014] As shown in FIG. 1, the integrated ECU 1 of the present embodiment is mounted on a vehicle such as an automobile, and the functions of a plurality of ECUs that conventionally operated independently are mounted on a single microcomputer 3 chip via a hypervisor 2. Specific examples of the plurality of ECUs include, for example, an engine ECU, an air conditioner ECU, a central gateway ECU, and a body ECU. In this case, the functions of the plurality of ECUs are mounted in units of virtual machines. In this specification, the hypervisor may be abbreviated as HV, and the virtual machine may be abbreviated as VM.

[0015] The integrated ECU 1 has functions corresponding to two ECUs, namely ECU-A and ECU-B. The integrated ECU 1 may have functions corresponding to three or more ECUs. The ECU 4 is provided independently in the same way as a conventional ECU without being integrated as the integrated ECU 1. The integrated ECU 1 and the ECU 4 are connected via the bus communication line 5, enabling them to communicate with each other.

[0016] The ECU 4 includes a microcomputer 6. The microcomputer 6 includes a CPU (not shown), various storage devices, and various peripherals as its hardware. The various peripherals include communication hardware 7 for communication. In this specification, the hardware may be abbreviated as HW. The ECU 4 includes an ECU-0 application A0 for realizing its main function. In this specification, the application may be abbreviated as app. Also, in the following description and drawings, the ECU-0 application A0 may be abbreviated as application A0.

[0017] The ECU 4 includes a communication driver 8. The communication driver 8 controls the communication HW 7 to perform data communication via the bus communication line 5 with other ECUs including the integrated ECU 1. Both the application A0 and the communication driver 8 are realized by executing a computer program stored in a non-transitory tangible storage medium by the CPU included in the microcomputer 6 to execute the processing corresponding to the computer program, that is, realized by software.

[0018] The integrated ECU1 includes two VMs, VM10 and VM11. In this case, the functions of ECU-A are realized by VM10, and the functions of ECU-B are realized by VM11. VM10 includes an ECU-A application A1 for realizing the main functions of ECU-A. VM11 includes an ECU-B application A2 for realizing the main functions of ECU-B. In the following descriptions and drawings, the ECU-A application A1 and the ECU-B application A2 may be abbreviated as application A1 and application A2, respectively.

[0019] HV2 is for operating VM10 and VM11 on the microcomputer 3. The microcomputer 3 is an example of a computer and includes a CPU (not shown in the figure), various storage devices, and various peripherals as its hardware. The various peripherals include a communication HW12 for communication. The various storage devices include a register 13. The register 13 is a register to be protected, that is, a register capable of performing protection settings regarding writing. VM10 includes a communication driver 14. VM11 includes a communication driver 15. The communication drivers 14 and 15 control the communication HW12 to perform data communication via the bus communication line 5 with other ECUs including ECU4.

[0020] In this case, HV2 functions as an operation control device for controlling the operation of each of the plurality of VMs, VM10 and VM11, in a time-division manner for the operation time allocated in advance for each operation cycle. That is, in the integrated ECU1, control in time-division scheduling for allocating fixed operation time to the plurality of VMs, VM10 and VM11, is performed. Also, in this case, the integrated ECU1 is an example of an electronic control device including the microcomputer 3, the plurality of VMs, VM10 and VM11 operating on the microcomputer 3, and HV2 functioning as an operation control device. In this specification, those of the plurality of VMs, VM10 and VM11 that are operating may be referred to as operation machines.

[0021] HV2, VM10, and VM11 are all realized by a CPU of the microcomputer 3 executing a computer program stored in a non-transitory tangible storage medium and performing a process corresponding to the computer program, that is, realized by software. Note that the program executed by HV2 among the above-described computer programs corresponds to an operation control program.

[0022] HV2 includes two functional blocks such as a first processing unit 21 and a second processing unit 22. The first processing unit 21 can execute a switching process for switching an operation machine. Each process executed by the first processing unit 21 corresponds to a first process. The second processing unit 22 can execute a prohibition process for prohibiting the execution of the switching process and a permission process for permitting the execution of the switching process. Each process executed by the second processing unit 22 corresponds to a second process.

[0023] In this case, when starting a specific process that is a process that must be continuously executed, that is, a non-interruptible process or an atomic process, the operation machine sends a prohibition request and sends a permission request when the specific process is completed. In this specification, the "process that must be continuously executed" includes not only a process that fails if it is not continuously executed, but also a process in which a processing result at a level desired by the user cannot be obtained if it is not continuously executed, that is, a process that is preferably continuously executed.

[0024] When the second processing unit 22 receives a prohibition request, it executes a determination process to determine whether the remaining time, which is the time from that point until the point in time when the operation time has elapsed, is equal to or longer than a predetermined set time. Based on the result of the determination process, when the remaining time is equal to or longer than the set time, the second processing unit 22 executes a prohibition process, and when the remaining time is less than the set time, the second processing unit 22 does not execute the prohibition process. When the second processing unit 22 receives a permission request, it executes a permission process. The operating machine is configured to execute a specific process during a prohibition period, which is a period during which the prohibition process is being executed.

[0025] The first processing unit 21 is capable of extending the operation time by a predetermined margin time during the prohibition period. When the above extension is performed by the first processing unit 21, the second processing unit 22 executes the determination process using, as the remaining time, the time from the point in time when the prohibition request was received until the point in time when the extended operation time has elapsed. In the present embodiment, an available time that can be used as the margin time is set for each operation cycle. The first processing unit 21 extends the operation time in such a way as to consume the required margin time from the available time. That is, the margin time is allocated and used from the available time.

[0026] When there is a remainder in the available time when the operation of the operation machine that operates last in the operation cycle is started, the first processing unit 21 can allocate at least a part of the remainder to the operation time of the operation machine that operates last. When the specific process has not been completed at the point in time when the operation time has elapsed during the prohibition period, the first processing unit 21 determines that an abnormality has occurred and can execute one or both of a switching process and a notification process for notifying the outside of the abnormality. When the specific process has not been completed at the point in time when the operation time has elapsed during the prohibition period, the first processing unit 21 determines that an abnormality has occurred and can execute a notification process for notifying the outside of the abnormality when a permission request is received in a subsequent operation cycle.

[0027] If the prohibition process is not executed after the operation machine has sent a prohibition request, the first processing unit 21 can repeatedly execute the transmission of the prohibition request to the operation machine until the prohibition process is executed. If the prohibition process is not executed after the operation machine has sent a prohibition request, the first processing unit 21 can put the operation machine in a standby state or in a state where it can execute another process different from the specific process for the period until the switching process is executed. If the prohibition process is not executed after the operation machine has sent a prohibition request, the first processing unit 21 can execute the switching process before the operation time assigned to the operation machine elapses.

[0028] The set time can be set by the following first setting method or second setting method. In the first setting method, the set time is set in advance for each of a plurality of virtual machines. In this case, the set time can be set based on the time required for a specific process that the virtual machine to be set may execute. When there is one specific process that the virtual machine may execute, the set time can be set to a time corresponding to the time required for that specific process. Note that the time corresponding to the time required for the specific process includes not only the same time as the time required for the specific process but also a time with a predetermined margin with respect to that time.

[0029] Also, when there are a plurality of specific processes that the virtual machine may execute, the set time can be set to a time corresponding to the longest time among the times required for each of the plurality of specific processes. Note that the longest time among the times required for each of the plurality of specific processes includes not only the same time as the longest time among the times required for each of the plurality of specific processes but also a time with a predetermined margin with respect to that time.

[0030] In the second method, when the second processing unit 22 receives a prohibition request, it sets a set time based on the time required for a specific process started by the operation machine that sent the prohibition request. The set time can be set to a time corresponding to the time required for the specific process started by the operation machine that sent the prohibition request. Note that the time corresponding to the time required for the specific process includes not only the same time as the time required for the specific process but also a time with a predetermined margin with respect to that time.

[0031] Next, the operation of the above configuration will be described with reference to FIGS. 2 to 21. In the following description, each term may be described in another way as follows. Specific process → Task The start of the switching process → VM switching Operation cycle → HV cycle Available time → Total margin time

[0032] In this case, assume that the HV cycle is 1000 μs and the total margin time is 50 μs. In FIGS. 2 to 17 and the like, the period during which the operation machine is VM10 is represented as "VM10", the period during which the operation machine is VM11 is represented as "VM11", the period during which the first processing unit 21 is executing the switching process is represented as "HV", the period during which the operation machine is executing a task is represented as "Task", the period during which the microcomputer 3 is transitioning to a mode of reducing power consumption is represented as "Halt", and the period during which the prohibition process is being executed is represented as "disable".

[0033] In the following description, for comparison with this embodiment, in addition to the description of the operation example according to this embodiment, the description of a comparative operation example, which is an operation example according to a comparative example corresponding to the prior art, will also be given. Note that the comparative example is obtained by omitting the second processing unit 22 and the processes related to each process executed by the second processing unit 22 with respect to this embodiment.

[0034] [1-1] First comparative operation example The first comparison operation example shown in FIG. 2 assumes a case where VM10 starts executing a task during the operation time and can complete the task without interruption within the operation time. In this case, VM10 starts executing the task when a predetermined time has elapsed since the time when it was switched to the operation machine. In this case, the task executed by VM10 is completed at a time before the end of the operation time. Then, when the operation time assigned to VM10 has elapsed, the first processing unit 21 performs a switching process.

[0035] [1-2] Second comparison operation example The second comparison operation example shown in FIG. 3 assumes a case where VM10 starts executing a task during the operation time and cannot complete the task within the operation time. In this case, VM10 starts executing the task when a predetermined time has elapsed since the time when it was switched to the operation machine. In this case, the task executed by VM10 is not completed even when the operation time assigned to VM10 has elapsed, but since the switching process is performed by the first processing unit 21 at this time, the task is interrupted.

[0036] The task interrupted in this way is resumed in the next HV cycle. That is, in the next HV cycle, VM10 resumes executing the task from the time when it was switched to the operation machine. In this case, the task executed by VM10 is completed when a predetermined time has elapsed since the time when VM10 was switched to the operation machine. In this way, in the comparative example, when VM switching occurs during the execution of a task, it is considered that the task is interrupted and the expected function does not operate. On the other hand, in the present embodiment, a function is introduced in which VM switching does not occur during the execution of a task, thereby solving such problems.

[0037] [2-1] First operation example The first operation example shown in FIG. 4 assumes a case where VM10 starts executing a task during its operation time and can complete the task without interruption. In this case, VM10 sends a prohibition request to HV2 when a predetermined time has elapsed since the time it was switched to the operating machine. When HV2 receives the prohibition request sent from VM10, it executes a determination process.

[0038] In this case, it is assumed that the time obtained by adding 50 μs, which is the time not yet used out of the total margin time with respect to the remaining time, is longer than the set time. Then, HV2 executes a prohibition process when it receives the prohibition request. In accordance with the start of the prohibition process, VM10, which is the operating machine, starts executing a task. In this case, the task does not complete when the initial operation time assigned to VM10 has elapsed. Therefore, the first processing unit 21 extends the operation time until the task being executed by VM10 is completed. In this case, the operation time is extended by consuming 20 μs from the total margin time.

[0039] According to such a first operation example, VM10 can continuously complete a task, which is a non-interruptible process, by having its operation time extended by 20 μs. When VM10 completes the task, it sends a permission request. When HV2 receives the permission request, it ends the prohibition process and executes a permission process. As a result, the first processing unit 21 executes a switching process. In this way, even when the operation time is extended, real-time performance can be ensured by immediately performing VM switching after task completion.

[0040] [2-2] Second operation example The second operation example shown in FIG. 5 assumes a case where VM10 and VM11 start executing a task during their operation time and can complete the task without interruption. In this case, the operation during the operation time of VM10 is the same as that in the first operation example. And in this case, VM11 sends a prohibition request to HV2 at the point in time when a predetermined time has elapsed since it was switched to the operation machine. When HV2 receives the prohibition request sent from VM11, it executes a determination process.

[0041] In this case, assume that the time obtained by adding 30 μs, which is the time in the overall margin time that has not yet been used with respect to the remaining time, is longer than the set time. Then, HV2 executes a prohibition process at the point in time when it receives the prohibition request. In accordance with the start of the prohibition process, VM11, which is the operation machine, starts executing the task. In this case, the task does not complete at the point in time when the initial operation time assigned to VM11 has elapsed.

[0042] Therefore, the first processing unit 21 extends the operation time until the task being executed by VM11 is completed. In this case, the operation time is extended by consuming 10 μs from the overall margin time. According to such a second operation example, VM11 can continuously complete a task that is an uninterruptible process by having its operation time extended by 10 μs. VM11 sends a permission request when the task is completed. When HV2 receives the permission request, it ends the prohibition process and executes a permission process. Thereby, the first processing unit 21 executes a switching process.

[0043] In this way, even when the operation time is extended, real-time performance can be ensured by immediately performing VM switching after the task is completed. As can be seen from the second operation example, according to the configuration of this embodiment, as long as there is still unused time in the overall margin time, the margin time can be allocated by the amount requested from multiple VMs. By setting the margin time throughout the HV cycle as in this embodiment, the margin time required for each VM can be adaptively allocated.

[0044] [2-3] Third operation example The third operation example shown in FIG. 6 assumes a case where VM10 starts executing a task during the operation time and the task is not completed. In this case, VM10 sends a prohibition request to HV2 at the time when a predetermined time has elapsed since the time when it was switched to the operation machine. When HV2 receives the prohibition request sent from VM10, it executes a determination process.

[0045] In this case, assume that the time obtained by adding 50 μs, which is the time still unused in the overall margin time, to the remaining time is longer than the set time. Then, HV2 executes a prohibition process at the time when it receives the prohibition request. In accordance with the start of the prohibition process, VM10, which is the operation machine, starts executing the task. In this case, the task is not completed when the initial operation time allocated to VM10 has elapsed. Therefore, the first processing unit 21 extends the operation time until the task being executed by VM10 is completed.

[0046] However, in this case, assume that for some reason such as an abnormality or a failure, even if the operation time is extended by consuming all 50 μs of the overall margin time, the task is not completed. Then, the first processing unit 21 determines that an abnormality has occurred and executes a notification process. In the notification process, a stuck error indicating that it has been detected that the prohibition period, during which VM switching is prohibited, has become fixed is issued. Also, at this time, the first processing unit 21 performs a switching process while the state where VM switching is prohibited remains as such.

[0047] And in this case, when a predetermined time has elapsed since VM11 was switched to the operating machine, VM11 transmits a prohibition request to HV2. When HV2 receives the prohibition request transmitted from VM11, it executes a determination process. In this case, it is assumed that the remaining time is shorter than the set time due to all of the overall margin time being used by VM10. Therefore, HV2 does not execute the prohibition process, and as a result, VM11 cannot start executing the task in this HV cycle.

[0048] Thus, when the prohibition process is not executed after the operating machine VM11 transmits the prohibition request, the first processing unit 21 sets VM11, which is the operating machine, to a standby state during the period until the switching process is executed. In this case, the first processing unit 21 can also set VM11, which is the operating machine, to a state in which it can execute a process different from the task during the period until the switching process is executed. Then, when the operation time assigned to VM11 has elapsed, the first processing unit 21 performs the switching process.

[0049] In the next HV cycle, VM10 resumes task execution from the time when it was switched to the operating machine. In this case, the task executed by VM10 is completed at the time when a predetermined time has elapsed since VM10 was switched to the operating machine. When VM10 completes the task, it transmits a permission request. When HV2 receives the permission request, it ends the prohibition process and executes the permission process. Also, at this time, HV2 performs a notification process, whereby a stuck error is issued. In this way, in the integrated ECU1, it is possible to make determinations such as restarting the VM or interrupting the process.

[0050] After the operation time assigned to VM10 has elapsed, the first processing unit 21 performs a switching process. When VM11 is switched to the operating machine, it sends a prohibition request to HV2. When HV2 receives the prohibition request sent from VM11, it executes a determination process. In this case, assume that the time obtained by adding 50 μs, which is the time of the overall margin time that has not yet been used with respect to the remaining time, is longer than the set time. Then, HV2 executes a prohibition process at the time when it receives the prohibition request. In accordance with the start of the prohibition process, VM11, which is the operating machine, starts executing a task.

[0051] In this case, the task executed by VM11 is completed at the time when a predetermined time has elapsed since VM11 was switched to the operating machine. When VM11 completes the task, it sends a permission request. When HV2 receives the permission request, it ends the prohibition process and executes a permission process. After that, when the operation time assigned to VM11 has elapsed, the first processing unit 21 performs a switching process. As can be seen from the third operation example, according to the configuration of the present embodiment, by operating VMs with high priority in order from the beginning of the HV cycle, it is possible to preferentially allocate margin time to VMs with high priority.

[0052] [2-4] Fourth operation example The fourth operation example shown in FIG. 7 differs from the third operation example in the following point. That is, in the fourth operation example, when the prohibition process is not executed after VM11, which is the operating machine, sends a prohibition request, the first processing unit 21 repeatedly executes the sending of a prohibition request to VM11, which is the operating machine, until the prohibition process is executed. In FIG. 7, the repeatedly sent prohibition requests are represented by simple arrows.

[0053] [2-5] Fifth operation example The fifth operation example shown in FIG. 8 is different from the third operation example in terms of the operations related to VM11. That is, in the fifth operation example, VM11 transmits a prohibition request to HV2 when a predetermined time has elapsed since it was switched to the operating machine. When HV2 receives the prohibition request transmitted from VM11, it executes a determination process. In this case, since all of the overall margin time is used by VM10 and the operation time of VM11 cannot be extended, it is assumed that the remaining time from that point until the time when the operation time without extension has elapsed is shorter than the set time.

[0054] Then, HV2 executes a prohibition process at the time when it receives the prohibition request. In accordance with the start of the prohibition process, VM11, which is the operating machine, starts executing a task. In this case, the task executed by VM11 is completed when a predetermined time has elapsed since the start of the prohibition process. When VM11 completes the task, it transmits a permission request. When HV2 receives the permission request, it ends the prohibition process and executes a permission process. After that, when the operation time assigned to VM11 has elapsed, the first processing unit 21 performs a switching process.

[0055] As can be seen from the fifth operation example, according to the configuration of the present embodiment, since all of the overall margin time is used and a prohibition process is performed when it is possible to secure the time until the task is completed even when there is no margin time, as a result, the task can be continuously completed during the operation time.

[0056] [2-6] Sixth operation example The sixth operation example shown in FIG. 9 assumes a case where VM10 starts executing a task during the operation time and can complete the task without extending or interrupting the operation time. In this case, VM10 transmits a prohibition request to HV2 when a predetermined time has elapsed since it was switched to the operating machine. When HV2 receives the prohibition request transmitted from VM10, it executes a determination process.

[0057] In this case, assume that the time obtained by adding 50 μs, which is the time of the overall margin time that has not yet been used with respect to the remaining time, is longer than the set time. Then, HV2 executes a prohibition process when it receives a prohibition request. In accordance with the start of the prohibition process, VM10, which is the operating machine, starts executing a task. In this case, the task executed by VM10 is completed when a predetermined time has elapsed since the start of the prohibition process. When VM10 completes the task, it sends a permission request. When HV2 receives the permission request, it ends the prohibition process and executes a permission process. Then, when the operating time assigned to VM10 has elapsed, the first processing unit 21 performs a switching process.

[0058] [2-7] Seventh operation example The seventh operation example shown in FIG. 10 assumes a case where VM10 attempts to start executing a task in the middle of the operating time, but the task execution in the operating time in that HV cycle cannot be performed and the task execution in the operating time in the next HV cycle is performed. In this case, VM10 sends a prohibition request to HV2 when a predetermined time has elapsed since the time when it was switched to the operating machine. When HV2 receives the prohibition request sent from VM10, it executes a determination process.

[0059] In this case, assume that the time obtained by adding 50 μs, which is the time of the overall margin time that has not yet been used with respect to the remaining time, is shorter than the set time. Therefore, HV2 does not execute a prohibition process, and as a result, VM10 cannot start executing a task in this HV cycle. Then, in the next HV cycle, VM10 sends a prohibition request to HV2 when it is switched to the operating machine. When HV2 receives the prohibition request sent from VM10, it executes a determination process. In this case, assume that the time obtained by adding 50 μs, which is the time of the overall margin time that has not yet been used with respect to the remaining time, is longer than the set time.

[0060] Then, when HV2 receives a prohibition request, it executes a prohibition process. In accordance with the start of the prohibition process, VM10, which is an operating machine, starts executing a task. In this case, the task executed by VM10 is completed at the time when a predetermined time has elapsed since the time when VM10 was switched to the operating machine. When VM10 completes the task, it sends a permission request. When HV2 receives the permission request, it ends the prohibition process and executes a permission process. Then, when the operation time allocated to VM10 has elapsed, the first processing unit 21 performs a switching process.

[0061] As can be seen from the seventh operation example, according to the configuration of the present embodiment, when a prohibition request is sent from the operating machine to the HV, if HV2 determines that the remaining time is less than the set time, it does not execute the prohibition process. Therefore, a task that is not expected to be completed within the operation time in that HV cycle can be executed within the operation time in the next HV cycle. Thus, according to the configuration of the present embodiment, since the time until VM switching is known in advance, real-time performance can be ensured without unnecessarily extending the operation time or affecting other VMs.

[0062] [2-8]Eighth operation example The eighth operation example shown in FIG. 11 assumes a case where there is a remainder in the overall margin time when the operation of the operating machine that operates last in the HV cycle starts. In this case, since neither VM10 nor VM11 has executed a task, it is assumed that the overall margin time has not been consumed and 50 μs remains as it is when the operation of VM11 starts. The first processing unit 21 is configured to allocate at least a part of such a remainder of the overall margin time to the operation time of VM11, which is the operating machine that operates last. In this way, the resources of the microcomputer 3 can be effectively utilized, and the time during which no processing operates can be eliminated.

[0063] [2-9]Ninth operation example The ninth operation example shown in FIG. 12 is different from the seventh operation example in the following points. Note that, in the upper part of FIG. 12, for comparison of each operation example, a figure similar to FIG. 10 used when explaining the seventh operation example is also described. That is, as shown in the lower part of FIG. 12, in the ninth operation example, when the prohibition process is not executed after the operation machine VM10 transmits a prohibition request, the first processing unit 21 executes a switching process before the operation time assigned to the operation machine VM10 elapses.

[0064] According to such a ninth operation example, when the prohibition process is not executed after the operation machine VM10 transmits a prohibition request, the remaining time of the operation time assigned to VM10 is allocated to another VM11. In this way, when there is no other operable process in VM10, it is possible to allocate that amount of time as the operation time of another VM11 without consuming wasteful time in VM10, and as a result, the resources of the microcomputer 3 can be effectively utilized.

[0065] [1-3] Third Comparative Operation Example The third comparative operation example shown in FIG. 13 is different from the second comparative operation example in that the content of the task is specified. In this case, the communication performed between the integrated ECU1 and ECU4 is divided into a plurality, and it is assumed that all communication data needs to be transmitted or received from VM10 to ECU4 within a predetermined time, for example, 100 μs. VM10 is configured to perform the above-described communication as a task. It is assumed that the communication performed by VM10 is divided into two times.

[0066] In this case, when a predetermined time has elapsed since VM10 was switched to the operating machine, VM10 executes the transmission or reception of the first communication data to ECU4. After that, since the operation time allocated to VM10 ends before VM10 executes the transmission or reception of the second communication data to ECU4, the switching process is performed by the first processing unit 21. That is, at this point, the communication process is interrupted. Then, in the next HV cycle, VM10 executes the transmission or reception of the second communication data to ECU4 at the time when it is switched to the operating machine.

[0067] As described above, in the third comparison operation example, VM switching occurs after the transmission or reception of the first communication data, and the transmission or reception of the second communication data is performed in the next HV cycle. Therefore, not all communication data is transmitted or received within 100 μs. However, in this case, since the communication process has been completed normally for VM10, there is no need to retransmit or receive the communication data, and there is a possibility that the communication between the integrated ECU1 and ECU4 will remain failed.

[0068] [2-10] Tenth operation example The tenth operation example shown in FIG. 14 is different from the first operation example in that the content of the task is specified. The specific content of the task is the same as that of the third comparison operation example. In this case, when a predetermined time has elapsed since VM10 was switched to the operating machine, VM10 transmits a prohibition request to HV2. When HV2 receives the prohibition request transmitted from VM10, it executes a determination process.

[0069] In this case, assume that the time obtained by adding 50 μs, which is the time within the total margin time that has not been used yet with respect to the remaining time, is longer than the set time. Then, HV2 executes the prohibition process when it receives the prohibition request. In accordance with the start of the prohibition process, the operating machine VM10 executes the transmission or reception of the first communication data to / from ECU4. Also in this case, similar to the third comparison operation example, the initial operation time assigned to VM10 ends at a point in time before VM10 executes the transmission or reception of the second communication data to / from ECU4. However, in this case, the first processing unit 21 extends the operation time until the task being executed by VM10 is completed.

[0070] Therefore, in the HV cycle, after VM10 executes the transmission or reception of the first communication data to / from ECU4, it can subsequently execute the transmission or reception of the second communication data to / from ECU4 continuously. Thus, according to the tenth operation example, all communication data can be transmitted or received within 100 μs. That is, according to the tenth operation example, the communication process can be completed continuously without being interrupted by VM switching.

[0071] [1-4] Fourth comparison operation example The fourth comparison operation example shown in FIG. 15 assumes, as the specific content of the task, write control for register 13. The write control for register 13 includes three processes: "protection release" to release the protection setting of register 13, "writing" to write to register 13, and "protection re - setting" to perform the protection setting of register 13 again.

[0072] In this case, VM10 starts the write control when a predetermined time has elapsed since it was switched to the operating machine. That is, VM10 first performs the process of releasing the protection, and then starts the write process. After that, since the operation time assigned to VM10 ends before VM10 completes the write process, the switching process is performed by the first processing unit 21. That is, in this case, VM switching occurs during the write process, and thereby the write control is interrupted.

[0073] At this time, the protection setting of the register 13 remains released. Therefore, there is a possibility that VM11, which is switched to the operating machine later, writes to the register 13, and if so, the content of the register 13 will be rewritten by another VM11. After that, in the next HV cycle, VM10 will resume the write process when it is switched to the operating machine, but since the content of the register 13 was rewritten by VM11 in the previous HV cycle, there is a possibility that an error will occur in the setting of the register 13.

[0074] [1-5] Fifth Comparative Operation Example The fifth comparative operation example shown in FIG. 16 is different from the fourth comparative operation example in the timing at which VM switching occurs. That is, in the fifth comparative operation example, since the operation time assigned to VM10 ends after the execution of the process of releasing the protection and before the start of the write process, the switching process is performed by the first processing unit 21. That is, in this case, VM switching occurs after the execution of the process of releasing the protection, and thereby the write control is interrupted.

[0075] Then, there is a possibility that the VM 11 that is switched to the operating machine after this will control writing to the register 13, and if this happens, the other VM 11 will reset the protection for the register 13. After that, in the next HV cycle, the VM 10 attempts to start a write process at the time when it is switched to the operating machine, but since the register 13 is set to be protected, writing cannot be performed, and as a result, the write control of the register 13 by the VM 10 cannot be completed normally.

[0076] [2-11] 11th operation example The eleventh operation example shown in FIG. 17 assumes, as the specific content of the task, write control to the register 13, as in the fourth and fifth comparative operation examples. In this case, the VM 10 transmits a prohibition request to the HV 2 when a predetermined time has elapsed since the VM 10 itself was switched to the operating machine. When the HV 2 receives the prohibition request transmitted from the VM 10, it executes a judgment process. In this case, it is assumed that the time obtained by adding 50 μs, which is the unused time of the total margin time, to the remaining time, is longer than the set time. Then, the HV 2 executes the prohibition process at the time when the prohibition request is received.

[0077] In response to the start of the prohibition process, the VM10, which is an operating machine, starts write control. That is, the VM10 first performs a protection release process, and then starts a write process. Thereafter, the initial operating time allocated to the VM10 ends before the VM10 completes the write process. In this case, however, the first processing unit 21 extends the operating time until the task being executed by the VM10 is completed.

[0078] Therefore, in the HV cycle, VM10 can continuously execute all processes in the write control. Thus, according to the configuration of this embodiment, a series of processes in the write control can be normally completed without the problems occurring in the fourth comparison operation example and the fifth comparison operation example. In addition, in the eleventh operation example, if the result is obtained that the time obtained by adding the margin time to the remaining time is shorter than the set time in the determination process, similar to the seventh operation example, the write control will be executed with the operation time in the next HV cycle.

[0079] [3] Allocation of the overall margin time As shown in FIG. 18, various cases can be considered regarding how the overall margin time set for each HV cycle is allocated and consumed by each of the VMs 10 and 11. In Case 1, 30 μs is consumed as the margin time in VM10, and the remaining 20 μs remains unconsumed as a remainder. In Case 2, 30 μs is consumed as the margin time in VM10 and 20 μs is consumed as the margin time in VM11. That is, in Case 2, the overall margin time is shared between VM10 and VM11, and there is no remainder in the overall margin time.

[0080] In Case 3, 20 μs is consumed as the margin time in VM10 and 25 μs is consumed as the margin time in VM11. That is, in Case 3, the overall margin time is shared between VM10 and VM11, and there is a remainder of 5 μs in the overall margin time. In Case 4, 40 μs is consumed as the margin time in VM10, and the remaining 10 μs remains unconsumed as a remainder.

[0081] In Case 5, 50 μs is consumed as the margin time in VM10, and there is no excess in the overall margin time. In Case 6, 50 μs is consumed as the margin time in VM11, and there is no excess in the overall margin time. In Case 7, no margin time is consumed in either VM10 or VM11, and there is an excess of 50 μs, which is all of the overall margin time. The number of such cases regarding the allocation of the overall margin time will further increase according to the number of VMs installed in the integrated ECU1.

[0082] [4-1] Specific content of each process executed when a prohibition request is received Each process executed when HV2 receives a prohibition request can specifically be the content as shown in FIG. 19. The second processing unit 22 is configured to execute the process with the content as shown in FIG. 19 each time a prohibition request is received. In step S101, it is determined whether a time T1, which is the time obtained by adding the available margin time to the time from when the prohibition request is received until the time when the operation time has elapsed, is equal to or greater than a set time T2.

[0083] Here, when the time T1 is equal to or greater than the time T2, "YES" is obtained in step S101, and the process proceeds to step S102. In step S102, the prohibition process is executed. After the execution of step S102, this process ends. On the other hand, when the time T1 is less than the time T2, "NO" is obtained in step S101, and this process ends without executing the prohibition process in step S102. According to such a process, since the time until VM switching can be known in advance, real-time performance can be ensured without extending the operation time unnecessarily or affecting other VMs.

[0084] [4-2] Specific content of each process executed during the prohibition period Specifically, each process executed by the first processing unit 21 of HV2 during the prohibition period can be as shown in FIG. 20. The first processing unit 21 is configured to execute a process with the content as shown in FIG. 20 at a predetermined cycle during the prohibition period. In step S201, it is determined whether the time T3, which is the margin time consumed during the prohibition period, is equal to or greater than the time T4, which is the set margin time.

[0085] Here, if the time T3 is equal to or greater than the time T4, the result in step S201 is "YES", and the process proceeds to step S202. In step S202, a stuck error is issued and notified. Step S202 corresponds to the notification process. After the execution of step S202, the process proceeds to step S203, where the stuck error flag is set. After the execution of step S203, the process proceeds to step S204, where the switching process is performed. After the execution of step S204, this process ends. On the other hand, if the time T3 is less than the time T4, the result in step S201 is "NO", and this process ends without executing the processes of steps S202 to S204, that is, processes such as the notification process and the switching process.

[0086] According to such a process, when the consumed margin time becomes the same as the set margin time, a stuck error is issued, the stuck error flag is set, and then the VM switching is performed. Therefore, the real-time performance of the entire HV2 is guaranteed. Also, according to the above process, by issuing a stuck error, it is possible to cause the VM to execute the process again or to serve as a basis for determining to restart the VM.

[0087] Note that instead of the processes according to the present embodiment shown in FIG. 20, the first processing unit 21 can perform the processes according to a modification example with the content shown in FIG. 21. Each process according to the modification example shown in FIG. 21 is executed when the operation time obtained by adding the margin time set at the initial operation time assigned to the VM, that is, the operation time including the margin, has ended. The difference from each process according to the present embodiment shown in FIG. 20 is that step S211 is provided instead of step S201. In step S211, it is determined whether or not it is in a prohibited state where the execution of the switching process is prohibited.

[0088] Here, if it is in the prohibited state, it becomes "YES" in step S211 and proceeds to step S202. On the other hand, if it is not in the prohibited state, it becomes "NO" in step S211, proceeds to step S204, and this process ends after the switching process is performed. According to such a modification example, if it is in a prohibited state where the execution of the switching process is prohibited when the operation time obtained by adding the set margin time has ended, the stuck error flag is set, that is, it is determined as VM stuck.

[0089] [4-3] Specific content of each process executed when a permission request is received Specifically, each process executed when HV2 receives a permission request can be the content shown in FIG. 22. The second processing unit 22 is configured to execute the process with the content shown in FIG. 22 every time it receives a permission request. In step S301, it is determined whether the stuck error flag is set, in other words, whether the stuck error flag is on. Note that in FIG. 22, the state where the stuck error flag is on is referred to as the error flag "on". Here, if the stuck error flag is on, it becomes "YES" in step S301 and proceeds to step S302. In step S302, a stuck error is issued and notified.

[0090] Step S302 corresponds to the notification process. After the execution of step S302, the process proceeds to step S303, where the permission process is executed. After the execution of step S303, this process ends. On the other hand, if the stuck error flag is not set, in step S301, it becomes "NO", and without executing the process of step S302, that is, the notification process, the process proceeds to step S303, where the permission process is executed. According to such a process, by issuing a stuck error even when the permission process is executed, it is possible to clarify that the execution of the specific process has ended after the stuck during the prohibited period.

[0091] According to the present embodiment described above, the following effects can be obtained. The HV2 included in the integrated ECU1 of the present embodiment performs control for operating each of the plurality of VMs 10 and 11 in a time-division manner for the operation time assigned in advance for each HV cycle, and includes a first processing unit 21 capable of executing a switching process for switching the operating machine, and a second processing unit 22 capable of executing a prohibition process for prohibiting the execution of the switching process and a permission process for permitting the execution of the switching process. The VMs 10 and 11 are configured to transmit a prohibition request when starting a specific process and to transmit a permission request when completing the specific process.

[0092] When the second processing unit 22 receives a prohibition request, it executes a determination process for determining whether the remaining time, which is the time from that point until the time when the operation time has elapsed, is equal to or longer than a predetermined set time. As a result, when the remaining time is equal to or longer than the set time, the prohibition process is executed, and when the remaining time is less than the set time, the prohibition process is not executed. Also, when the second processing unit 22 receives a permission request, it executes the permission process. The operating machine executes a specific process during the prohibited period, which is the period during which the prohibition process is being executed.

[0093] According to the above configuration, it is possible to prevent a switching process for switching the operating machine from occurring while the operating machine is executing a specific process. In this way, it is possible to guarantee a consistent operation until the specific process is completed. Further, according to the above configuration, when the second processing unit 22 executes a determination process and the remaining time is less than the set time, in other words, when the possibility that the specific process to be started can be completed before the operation time elapses is extremely low, the prohibition process is not executed, and accordingly, the specific process is not executed either. In this way, a specific process that is not expected to be completed in that HV cycle can be executed in the next HV cycle. Thus, according to the configuration of the present embodiment, an excellent effect can be obtained in that it is possible to prevent a specific process, which is a process that must be continuously executed, from being interrupted by a switching process.

[0094] In the present embodiment, during a prohibited period in which the execution of the switching process is prohibited, it is possible to extend the originally set operation time by the margin time, and the execution of the specific process by the operating machine continues until the extended operation time elapses. In this way, it is possible to more surely complete the specific process continuously without interruption. Further, in the present embodiment, when the specific process is not completed until the extended operation time elapses, a notification process and a switching process are performed.

[0095] In this way, it is possible to prevent the operation time from being extended beyond the set margin time, and prevent a situation in which only a specific VM operates for an unreasonably long time, and no adverse effects such as a reduction in the operation time of other VMs occur, thereby ensuring real-time performance. Further, according to the present embodiment, by performing a notification process for notifying a stuck error, it is possible to perform a restart or re-execution of the specific process on the operating machine for which the specific process was not completed.

[0096] In this embodiment, the overall margin time is set for each HV cycle, and the first processing unit 21 extends the operation time in such a way as to consume the required margin time from the overall margin time. By doing so, the margin time can be set for the entire HV2, and the setting can be made simple. Also, by doing so, the margin time required by each VM can be adaptively distributed within the HV cycle. Furthermore, by operating the VMs with higher priorities among the plurality of VMs in order from the head of the HV cycle, the margin time can be preferentially given to the VMs with relatively higher priorities.

[0097] When there is a remainder in the overall margin time when the operation of the operation machine that operates last in the HV cycle starts, the first processing unit 21 allocates at least a part of the remainder to the operation time of the operation machine that operates last. By doing so, the wasted margin time can be eliminated. When the specific process has not been completed when the operation time has elapsed during the prohibited period, the first processing unit 21 determines that an abnormality has occurred and executes a switching process and a notification process for notifying the outside of the abnormality. By doing so, it is possible to prevent the prohibited process from affecting the operation time of other VMs while the specific process is not completed normally, ensuring real-time performance, and it is possible to determine the restart of the VM and the interruption of the specific process.

[0098] When the specific process has not been completed when the operation time has elapsed during the prohibited period, the first processing unit 21 determines that an abnormality has occurred and executes a notification process for notifying the outside of the abnormality when a permission request is received in the HV cycle after the next time. By doing so, it is possible to determine the restart of the VM and the interruption of the specific process by notifying through the notification process that the operation continues with the prohibited period fixed.

[0099] The setting time can be set in advance for each of the plurality of VMs 10 and 11. In this way, the operating time of each VM can be uniformly managed. Alternatively, when the second processing unit 22 receives a prohibition request, the setting time can be set based on the time required for the specific process that the operation machine that sent the prohibition request will start. In this way, in the case where the specific process cannot be completed normally for some reason, etc., it is possible to minimize the time for extending the operation time, and as a result, real-time performance can be ensured.

[0100] If the prohibition process is not executed after the operation machine has sent a prohibition request, the first processing unit 21 can repeatedly execute the transmission of the prohibition request to the operation machine until the prohibition process is executed. In this way, the process can be completed only by the VM without requiring time until VM switching from HV2. If the prohibition process is not executed after the operation machine has sent a prohibition request, the first processing unit 21 can set the operation machine to a standby state during the period until the switching process is executed. In this way, the microcomputer 3 can be transitioned to sleep or the like to reduce power consumption.

[0101] If the prohibition process is not executed after the operation machine has sent a prohibition request, the first processing unit 21 can set the operation machine to a state where it can execute another process different from the specific process during the period until the switching process is executed. In this way, it becomes possible to execute other processes within the time until VM switching, and as a result, the resources of the microcomputer 3 can be effectively utilized. If the prohibition process is not executed after the operation machine has sent a prohibition request, the first processing unit 21 can execute the switching process before the operation time assigned to the operation machine elapses. In this way, when there is no process that can be executed other than the specific process in the operation machine, it becomes possible to operate other VMs, and as a result, the resources of the microcomputer 3 can be effectively utilized.

[0102] (Second Embodiment) Hereinafter, the second embodiment will be described with reference to FIGS. 23 to 25. In this embodiment, compared with the first embodiment, a change has been made to the setting of the available time. In this embodiment, the available time is set for each of the plurality of VMs 10 and 11. Moreover, the first processing unit 21 extends the operation time in such a way as to consume the required margin time from the available time corresponding to the operation machine. That is, the margin time is allocated and used from the available time corresponding to the operation machine.

[0103] Next, the operation of the above configuration will be described. In the following description, the available time may be referred to as the margin time per VM. In this case, assume that the margin time per VM is 20 μs for both VMs 10 and 11.

[0104] [2-12] The 12th operation example The 12th operation example shown in FIG. 23 assumes a case where VM10 starts executing a task during the operation time and can complete the task without interruption. In this case, VM10 sends a prohibition request to HV2 at the time when a predetermined time has elapsed since the time when it was switched to the operation machine. When HV2 receives the prohibition request sent from VM10, it executes a determination process.

[0105] In this case, assume that the time obtained by adding 20 μs, which is the margin time per VM corresponding to VM10, to the remaining time is longer than the set time. Then, HV2 executes a prohibition process at the time when it receives the prohibition request. In accordance with the start of the prohibition process, VM10, which is the operation machine, starts executing a task. In this case, the task does not complete when the initial operation time allocated to VM10 has elapsed. Therefore, the first processing unit 21 extends the operation time until the task being executed by VM10 is completed. In this case, the operation time is extended by consuming all 20 μs of the margin time per VM.

[0106] According to such a 12th operation example, VM10 can extend its operation time until the margin time per VM, and can continuously complete tasks that are non-interruptible processes. When VM10 completes a task, it sends a permission request. When HV2 receives the permission request, it ends the prohibition process and executes the permission process. As a result, the first processing unit 21 executes the switching process. In this way, even when the operation time is extended, real-time performance can be ensured by performing VM switching immediately after task completion.

[0107] [2-13] 13th operation example The 13th operation example shown in FIG. 24 assumes a case where VM10 and VM11 start executing a task during their operation time and can complete the task without interruption. In this case, the operation during the operation time of VM10 is the same as that in the 12th operation example. And in this case, when a predetermined time has elapsed since the time when VM11 was switched to the operation machine, VM11 sends a prohibition request to HV2. When HV2 receives the prohibition request sent from VM11, it executes a determination process.

[0108] In this case, assume that the time obtained by adding 20 μs, which is the margin time per VM corresponding to VM11, to the remaining time is longer than the set time. Then, HV2 executes the prohibition process at the time when it receives the prohibition request. In accordance with the start of the prohibition process, VM11, which is the operation machine, starts executing the task. In this case, the task is not completed when the initial operation time assigned to VM11 has elapsed.

[0109] Therefore, the first processing unit 21 extends the operation time until the task being executed by VM11 is completed. In this case, the operation time is extended by consuming all 20 μs, which is the margin time per VM. According to such a 13th operation example, VM11 can extend its operation time up to the margin time per VM and can continuously complete a task that is an uninterruptible process. VM11 sends a permission request when the task is completed. When HV2 receives the permission request, it ends the prohibition process and executes the permission process. Thereby, the first processing unit 21 executes the switching process.

[0110] In this way, even when the operation time is extended, real-time performance can be ensured by immediately performing VM switching after task completion. As can be seen from the 13th operation example, according to the configuration of the present embodiment, since a margin time is given for each VM, a VM with a relatively high priority does not occupy the margin time. As a result, it is possible to secure a similar margin time for a VM with a relatively low priority.

[0111] [2-14] 14th operation example The 14th operation example shown in FIG. 25 assumes a case where VM10 starts executing a task during the operation time and the task is not completed. In this case, VM10 sends a prohibition request to HV2 at the point in time when a predetermined time has elapsed since the time when it was switched to the operation machine. When HV2 receives the prohibition request sent from VM10, it executes a determination process.

[0112] In this case, assume that the time obtained by adding 20 μs, which is the per-VM margin time corresponding to VM10, to the remaining time is longer than the set time. Then, HV2 executes a prohibition process when it receives a prohibition request. In accordance with the start of the prohibition process, VM10, which is the operating machine, starts executing a task. In this case, the task does not complete when the initial operation time assigned to VM10 has elapsed. Therefore, the first processing unit 21 extends the operation time until the task being executed by VM10 is completed.

[0113] However, in this case, assume that for some reason such as an abnormality or a failure, even if the operation time is extended by consuming all 20 μs, which is the total per-VM margin time, the task does not complete. Then, the first processing unit 21 determines that an abnormality has occurred and executes a notification process. In the notification process, a stuck error indicating that it has been detected that the prohibition period during which VM switching is prohibited has become stuck is issued. Also, at this time, the first processing unit 21 performs a switching process while the state in which VM switching is prohibited remains as it is.

[0114] And in this case, when a predetermined time has elapsed since VM11 was switched to the operating machine, VM11 transmits a prohibition request to HV2. When HV2 receives the prohibition request transmitted from VM11, it executes a determination process. In this case, assume that the time obtained by adding 20 μs, which is the per-VM margin time corresponding to VM11, to the remaining time is longer than the set time. Then, HV2 executes a prohibition process when it receives the prohibition request. In accordance with the start of the prohibition process, VM11, which is the operating machine, starts executing a task.

[0115] In this case, the task is not completed when the initial operation time assigned to VM11 has elapsed. Therefore, the first processing unit 21 extends the operation time until the task being executed by VM11 is completed. In this case, the operation time is extended by consuming all of the 20 μs, which is the margin time for each VM. When VM11 completes the task, it sends a permission request. When HV2 receives the permission request, it ends the prohibition process and executes the permission process. As a result, the first processing unit 21 executes the switching process.

[0116] In the next HV cycle, VM10 resumes task execution from the time it was switched to the operating machine. In this case, the task executed by VM10 is completed when a predetermined time has elapsed since VM10 was switched to the operating machine. When VM10 completes the task, it sends a permission request. When HV2 receives the permission request, it ends the prohibition process and executes the permission process. Also, at this time, HV2 performs a notification process, thereby issuing a stuck error. After that, when the operation time assigned to VM10 has elapsed, the first processing unit 21 performs a switching process.

[0117] According to such a fourteenth operation example, since the margin time for each VM is set for each of the plurality of VMs VM10 and VM11, even if one of VM10 and VM11 consumes the margin time for each VM, if the other of VM10 and VM11 sends a prohibition request, the operation time can be extended up to the upper limit of the margin time for each VM assigned to that VM, and the prohibition process can be performed.

[0118] According to the present embodiment described above, a margin time per VM is set for each of the plurality of VMs 10 and 11, and the first processing unit 21 extends the operation time in such a way as to consume the required margin time from the margin time per VM corresponding to the operating machine. In this way, regardless of the priority level, all of the VMs 10 and 11 can use 20 μs, which is the margin time per VM, as the margin time. That is, according to the present embodiment, since the margin time is given for each VM, it is possible to secure the margin time for the VMs with relatively low priority without the VMs with relatively high priority occupying the margin time.

[0119] (Third Embodiment) Hereinafter, the second embodiment will be described with reference to FIG. 26. In the present embodiment, the processing content of the first processing unit 21 is changed with respect to the first embodiment. In the present embodiment, the first processing unit 21 does not extend the operation time during the prohibited period. That is, in the present embodiment, the margin time such as the overall margin time or the margin time per VM is not set.

[0120] Next, the operation of the above configuration will be described. [2-15] 15th operation example The 15th operation example shown in FIG. 26 assumes a case where VM10 starts executing a task during the operation time and the task is not completed. In this case, VM10 transmits a prohibition request to HV2 at the time when a predetermined time has elapsed since the time when it was switched to the operating machine. When HV2 receives the prohibition request transmitted from VM10, it executes a determination process.

[0121] In this case, assume that the remaining time is longer than the set time. Then, HV2 executes a prohibition process when it receives a prohibition request. In accordance with the start of the prohibition process, the operation machine VM10 starts executing a task. In this case, assume that the task has not been completed even when the operation time assigned to VM10 has elapsed due to some reason such as an abnormality or a failure. Then, the first processing unit 21 determines that an abnormality has occurred and executes a notification process. In the notification process, a stuck error indicating that it has been detected that the prohibition period during which VM switching is prohibited has become stuck is issued. Also, at this time, the first processing unit 21 performs a switching process while the VM switching is prohibited in this way.

[0122] And in this case, when a predetermined time has elapsed since VM11 was switched to the operation machine, VM11 transmits a prohibition request to HV2. When HV2 receives the prohibition request transmitted from VM11, it executes a determination process. In this case, assume that the remaining time is longer than the set time. Then, HV2 executes a prohibition process when it receives the prohibition request. In accordance with the start of the prohibition process, the operation machine VM11 starts executing a task. In this case, the task has been completed before the operation time assigned to VM11 has elapsed. When VM11 completes the task, it transmits a permission request. When HV2 receives the permission request, it ends the prohibition process and executes a permission process. As a result, the first processing unit 21 executes a switching process.

[0123] In the next HV cycle, VM10 resumes task execution from the point in time when it is switched to the operating machine. In this case, the task executed by VM10 is completed at the point in time when a predetermined time has elapsed since the point in time when VM10 was switched to the operating machine. When VM10 completes the task, it sends a permission request. When HV2 receives the permission request, it ends the prohibition process and executes the permission process. Also, at this time, HV2 performs a notification process, and as a result, a stuck error is issued. Then, when the operation time allocated to VM10 has elapsed, the first processing unit 21 performs a switching process.

[0124] According to the present embodiment described above, no margin time such as the overall margin time or the per-VM margin time is set. According to such a present embodiment, compared with each of the above embodiments in which the margin time is set, more operation time can be allocated to all of the VMs 10 and 11. In each of the above embodiments, there is a possibility that the time not used among the set overall margin time or the per-VM margin time becomes wasted time, but in this embodiment, such wasted time is not generated. Also, according to the present embodiment, similar to each of the above embodiments, it is possible to detect sticking during the prohibition period, and it is possible to operate a specific process with no expectation of completion in the next HV cycle.

[0125] (Other Embodiments) Note that the present invention is not limited to the embodiments described above and shown in the drawings, and can be arbitrarily modified, combined, or extended without departing from the gist thereof. The numerical values and the like shown in each of the above embodiments are examples and are not limited thereto.

[0126] The present invention is not limited to HV2 that controls each of a plurality of VMs operating on a microcomputer 3 that constitutes an integrated ECU1 mounted on a vehicle by time-division scheduling, but is applicable to an operation control device in general that performs control for operating each of a plurality of VMs operating on a computer by time-division with operation time allocated in advance for each operation cycle.

[0127] Although this disclosure has been described in accordance with the embodiments, it is understood that this disclosure is not limited to these embodiments or structures. This disclosure also encompasses various modifications and variations within the equivalent scope. In addition, various combinations and forms, as well as other combinations and forms that include only one, more than one, or less than one element thereof, also fall within the scope and spirit of this disclosure.

[0128] The control unit and its method described in this disclosure may be implemented by a dedicated computer provided by configuring a processor and a memory programmed to execute one or more functions embodied by a computer program. Alternatively, the control unit and its method described in this disclosure may be implemented by a dedicated computer provided by configuring a processor with one or more dedicated hardware logic circuits. Or, the control unit and its method described in this disclosure may be implemented by one or more dedicated computers constituted by a combination of a processor programmed to execute one or more functions and a memory and a processor constituted by one or more hardware logic circuits. Also, the computer program may be stored in a computer-readable non-transitory tangible recording medium as instructions to be executed by a computer.

[0129] This disclosure includes the following inventions in addition to the inventions described in the claims. [1] An operation control device for performing control to operate each of a plurality of virtual machines (10, 11) in a time-sharing manner by an operation time assigned in advance for each operation cycle, When one of the plurality of virtual machines that is operating is defined as an operating machine, A first processing unit (21) capable of executing a switching process for switching the operating machine, A second processing unit (22) capable of executing a prohibiting process for prohibiting the execution of the switching process and a permitting process for permitting the execution of the switching process, comprising When starting a specific process that is a process that must be continuously executed, the operation machine transmits a prohibition request and, when the specific process is completed, transmits a permission request. The second processing unit When receiving the prohibition request, executes a determination process for determining whether a remaining time, which is a time from that point until the point in time when the operation time has elapsed, is equal to or longer than a predetermined set time. As a result of the determination process, when the remaining time is equal to or longer than the set time, the prohibition process is executed, and when the remaining time is less than the set time, the prohibition process is not executed. When receiving the permission request, the permission process is executed. The operation machine is an operation control device that executes the specific process during a prohibition period, which is a period during which the prohibition process is being executed. [2] The first processing unit can extend the operation time by a predetermined margin time during the prohibition period. The second processing unit executes the determination process using, as the remaining time, a time from the point in time when the prohibition request is received until the point in time when the extended operation time has elapsed, as in the operation control device described in [1]. [3] An available time is set for each operation cycle. The first processing unit extends the operation time in a form that consumes the required margin time from the available time, as in the operation control device described in [2]. [4] An available time is set for each of the plurality of virtual machines. The first processing unit extends the operation time in a form that consumes the required margin time from the available time corresponding to the operation machine, as in the operation control device described in [2]. [5] The operation control device according to [3], wherein when there is a remainder in the available time when the operation of the operation machine that operates last in the operation cycle is started, at least a part of the remainder is allocated to the operation time of the operation machine that operates last. [6] The operation control device according to any one of [1] to [5], wherein when the specific process is not completed at the time when the operation time has elapsed during the prohibition period, the first processing unit determines that an abnormality has occurred and executes one or both of the switching process and the notification process for notifying the outside of the abnormality. [7] The operation control device according to any one of [1] to [6], wherein when the specific process is not completed at the time when the operation time has elapsed during the prohibition period, the first processing unit determines that an abnormality has occurred and executes a notification process for notifying the outside of the abnormality when the permission request is received in the subsequent operation cycles. [8] The operation control device according to any one of [1] to [7], wherein the set time is set in advance for each of the plurality of virtual machines. [9] The operation control device according to any one of [1] to [7], wherein when the second processing unit receives the prohibition request, it sets the set time based on the time required for the specific process to be started by the operation machine that transmitted the prohibition request.

[10] The operation control device according to any one of [1] to [9], wherein when the prohibition process is not executed after the operation machine transmits the prohibition request, the first processing unit repeatedly causes the operation machine to transmit the prohibition request until the prohibition process is executed.

[11] When the prohibition process is not executed after the operation machine has sent the prohibition request, the first processing unit puts the operation machine in a standby state or in a state where the operation machine can execute another process different from the specific process until the switching process is executed, for the operation control device according to any one of [1] to [9].

[12] When the prohibition process is not executed after the operation machine has sent the prohibition request, the first processing unit executes the switching process before the operation time assigned to the operation machine elapses, for the operation control device according to any one of [1] to [9].

[13] An operation control program to be executed by an operation control device (2) that controls each of a plurality of virtual machines (VM10, VM11) to operate in time division by an operation time assigned in advance for each operation cycle, When an operating one of the plurality of virtual machines is set as the operation machine, a first process that can execute a switching process for switching the operation machine, a second process that can execute a prohibition process for prohibiting the execution of the switching process and a permission process for permitting the execution of the switching process, including The operation machine sends a prohibition request when starting a specific process that is a process that must be continuously executed, and sends a permission request when completing the specific process, In the second process, when receiving the prohibition request, an adjudication process is executed to determine whether a remaining time, which is a time from that point until the operation time elapses, is equal to or longer than a predetermined set time, as a result of the adjudication process, when the remaining time is equal to or longer than the set time, the prohibition process is executed, and when the remaining time is less than the set time, the prohibition process is not executed, when receiving the permission request, the permission process is executed, The operation machine is an operation control program that executes the specific process during a prohibited period which is a period in which the prohibition process is being executed.

[14] An electronic control device comprising: a computer (3); a plurality of virtual machines (VM10, VM11) operating on the computer; and an operation control device (2) for performing control to operate each of the plurality of virtual machines in time division by an operation time assigned in advance for each operation cycle, When one of the plurality of virtual machines that is operating is set as the operation machine, the operation control device, a first processing unit (21) capable of executing a switching process for switching the operation machine; a second processing unit (22) capable of executing a prohibition process for prohibiting the execution of the switching process and a permission process for permitting the execution of the switching process; is provided with, when the operation machine starts a specific process which is a process that must be executed continuously, it transmits a prohibition request and, when the specific process is completed, it transmits a permission request, the second processing unit, when receiving the prohibition request, executes a determination process for determining whether a remaining time which is a time from that point until the time when the operation time has elapsed is a time equal to or longer than a predetermined set time, as a result of the determination process, when the remaining time is a time equal to or longer than the set time, it executes the prohibition process, and when the remaining time is a time less than the set time, it does not execute the prohibition process, when receiving the permission request, executes the permission process, the operation machine is an electronic control device that executes the specific process during a prohibited period which is a period in which the prohibition process is being executed.

Description of Signs

[0130] 1... integrated ECU, 2... hypervisor, 3... microcomputer, 10, 11... virtual machines, 21... first processing unit, 22... second processing unit.

Claims

1. An operation control device that controls each of multiple virtual machines (10, 11) to operate in a time-division manner for a predetermined operating time for each operating cycle, If we consider the one currently running among the aforementioned multiple virtual machines as the operating machine, A first processing unit (21) capable of performing a switching process to switch the aforementioned operating machine, A second processing unit (22) that can execute a prohibition process to prohibit the execution of the aforementioned switching process and a permission process to permit the execution of the aforementioned switching process, Equipped with, The aforementioned operating machine sends a prohibition request when starting a specific process that must be executed consecutively, and sends a permission request when it has completed the specific process. The second processing unit is, When the aforementioned prohibition request is received, a determination process is executed to determine whether the remaining time, which is the time from that point until the end of the aforementioned operation time, is equal to or greater than a predetermined set time. As a result of the aforementioned determination process, if the remaining time is equal to or greater than the set time, the prohibition process is executed; however, if the remaining time is less than the set time, the prohibition process is not executed. When the aforementioned permission request is received, the permission process is executed. The first processing unit is configured to extend the operation time by a predetermined margin time during the prohibition period. The second processing unit executes the decision process using the time from the time the prohibition request is received until the extended operating time has elapsed as the remaining time. A usable time is set for each of the aforementioned operating cycles. The first processing unit is capable of extending the operating time by consuming the required margin time from the available time. The first processing unit is an operation control device that, if there is remaining time in the available time when the operation of the last operating machine in the operation cycle is started, can allocate at least a portion of that remaining time to the operation time of the last operating machine.

2. The operation control device according to claim 1, wherein the first processing unit determines that an abnormality has occurred if the specific processing has not been completed when the operating time has elapsed during the prohibition period, and executes either the switching process or the notification process for notifying an external party of the abnormality.

3. The operation control device according to claim 1, wherein the first processing unit determines that an abnormality has occurred if the specific processing has not been completed when the operation time has elapsed during the prohibition period, and when it receives the permission request in the next operation cycle, it executes a notification process to notify the external party of the abnormality.

4. The operation control device according to claim 1, wherein the setting time is set in advance for each of the plurality of virtual machines.

5. The operation control device according to claim 1, wherein the second processing unit, upon receiving the prohibition request, sets the setting time based on the time required for the specific processing initiated by the operation machine that sent the prohibition request.

6. The operation control device according to claim 1, wherein the first processing unit, if the prohibition process is not executed after the operation machine has transmitted the prohibition request, puts the operation machine into a standby state or puts the operation machine into a state in which it can execute a process other than the specific process for a period of time until the switching process is executed.

7. An operation control device that controls each of multiple virtual machines (10, 11) to operate in a time-division manner for a predetermined operating time for each operating cycle, If we consider the one currently running among the aforementioned multiple virtual machines as the operating machine, A first processing unit (21) capable of performing a switching process to switch the aforementioned operating machine, A second processing unit (22) that can execute a prohibition process to prohibit the execution of the aforementioned switching process and a permission process to permit the execution of the aforementioned switching process, Equipped with, The aforementioned operating machine sends a prohibition request when starting a specific process that must be executed consecutively, and sends a permission request when it has completed the specific process. The second processing unit is, When the aforementioned prohibition request is received, a determination process is executed to determine whether the remaining time, which is the time from that point until the end of the aforementioned operation time, is equal to or greater than a predetermined set time. As a result of the aforementioned determination process, if the remaining time is equal to or greater than the set time, the prohibition process is executed; however, if the remaining time is less than the set time, the prohibition process is not executed. When the aforementioned permission request is received, the permission process is executed. The first processing unit is an operation control device that, if the operation machine has transmitted the prohibition request but the prohibition process has not been executed, causes the operation machine to repeatedly transmit the prohibition request until the prohibition process is executed.

8. An operation control device that controls each of multiple virtual machines (10, 11) to operate in a time-division manner for a predetermined operating time for each operating cycle, If we consider the one currently running among the aforementioned multiple virtual machines as the operating machine, A first processing unit (21) capable of performing a switching process to switch the aforementioned operating machine, A second processing unit (22) that can execute a prohibition process to prohibit the execution of the aforementioned switching process and a permission process to permit the execution of the aforementioned switching process, Equipped with, The aforementioned operating machine sends a prohibition request when starting a specific process that must be executed consecutively, and sends a permission request when it has completed the specific process. The second processing unit is, When the aforementioned prohibition request is received, a determination process is executed to determine whether the remaining time, which is the time from that point until the end of the aforementioned operation time, is equal to or greater than a predetermined set time. As a result of the aforementioned determination process, if the remaining time is equal to or greater than the set time, the prohibition process is executed; however, if the remaining time is less than the set time, the prohibition process is not executed. When the aforementioned permission request is received, the permission process is executed. The first processing unit is an operation control device that, if the prohibition process is not executed after the operation machine transmits the prohibition request, executes the switching process before the operation time allocated to the operation machine has elapsed, or at the time the operation time allocated to the operation machine has elapsed.

9. The first processing unit is configured to extend the operation time by a predetermined margin time during the prohibition period, The second processing unit executes the decision process using the time from the time the prohibition request is received until the extended operating time has elapsed as the remaining time. Each of the aforementioned multiple virtual machines has a set usage time, The operation control device according to claim 7 or 8, wherein the first processing unit extends the operation time by consuming the required margin time from the usable time corresponding to the operation machine.

10. An operation control device according to any one of claims 1 to 8, wherein the operation machine performs the specific processing during the prohibition period, which is the period during which the prohibition processing is being performed.

11. An operation control program to be executed by an operation control device (2) that controls each of multiple virtual machines (VM10, VM11) to operate in a time-division manner for a predetermined operating time for each operation cycle, If we consider the one currently running among the aforementioned multiple virtual machines as the operating machine, A first process that can execute a switching process to switch the aforementioned operating machine, A second process that can execute a prohibition process to prohibit the execution of the aforementioned switching process and a permission process to permit the execution of the aforementioned switching process, Includes, The aforementioned operating machine sends a prohibition request when starting a specific process that must be executed consecutively, and sends a permission request when it has completed the specific process. In the second process described above, When the aforementioned prohibition request is received, a determination process is executed to determine whether the remaining time, which is the time from that point until the end of the aforementioned operation time, is equal to or greater than a predetermined set time. As a result of the aforementioned determination process, if the remaining time is equal to or greater than the set time, the prohibition process is executed; however, if the remaining time is less than the set time, the prohibition process is not executed. When the aforementioned permission request is received, the permission process is executed. In the first process, the operation time can be extended by a predetermined margin time during the prohibition period. In the second process, the decision process is executed using the remaining time as the time from the time the prohibition request is received until the extended operating time has elapsed. A usable time is set for each of the aforementioned operating cycles. In the first process, the operating time can be extended by consuming the required margin time from the available time. The first process is configured such that, if there is remaining time in the available time when the operation of the last operating machine in the operation cycle is started, at least a portion of that remaining time can be allocated to the operation time of the last operating machine.

12. An operation control program to be executed by an operation control device (2) that controls each of multiple virtual machines (VM10, VM11) to operate in a time-division manner for a predetermined operating time for each operation cycle, If we consider the one currently running among the aforementioned multiple virtual machines as the operating machine, A first process that can execute a switching process to switch the aforementioned operating machine, A second process that can execute a prohibition process to prohibit the execution of the aforementioned switching process and a permission process to permit the execution of the aforementioned switching process, Includes, The aforementioned operating machine sends a prohibition request when starting a specific process that must be executed consecutively, and sends a permission request when it has completed the specific process. In the second process described above, When the aforementioned prohibition request is received, a determination process is executed to determine whether the remaining time, which is the time from that point until the end of the aforementioned operation time, is equal to or greater than a predetermined set time. As a result of the aforementioned determination process, if the remaining time is equal to or greater than the set time, the prohibition process is executed; however, if the remaining time is less than the set time, the prohibition process is not executed. When the aforementioned permission request is received, the permission process is executed. The first process is configured to cause the operating machine to repeatedly send the prohibition request if the prohibition process is not executed after the operating machine has sent the prohibition request, until the prohibition process is executed.

13. An operation control program to be executed by an operation control device (2) that controls each of multiple virtual machines (VM10, VM11) to operate in a time-division manner for a predetermined operating time for each operation cycle, If we consider the one currently running among the aforementioned multiple virtual machines as the operating machine, A first process that can execute a switching process to switch the aforementioned operating machine, A second process that can execute a prohibition process to prohibit the execution of the aforementioned switching process and a permission process to permit the execution of the aforementioned switching process, Includes, The aforementioned operating machine sends a prohibition request when starting a specific process that must be executed consecutively, and sends a permission request when it has completed the specific process. In the second process described above, When the aforementioned prohibition request is received, a determination process is executed to determine whether the remaining time, which is the time from that point until the end of the aforementioned operation time, is equal to or greater than a predetermined set time. As a result of the aforementioned determination process, if the remaining time is equal to or greater than the set time, the prohibition process is executed; however, if the remaining time is less than the set time, the prohibition process is not executed. When the aforementioned permission request is received, the permission process is executed. In the first process, if the prohibition process is not executed after the operating machine sends the prohibition request, the operation control program executes the switching process before the operation time allocated to the operating machine has elapsed, or at the time the operation time allocated to the operating machine has elapsed.

14. The operation control program according to any one of claims 11 to 13, wherein the operation machine executes the specific processing during the prohibition period, which is the period during which the prohibition processing is being executed.

15. An electronic control device comprising a computer (3), a plurality of virtual machines (VM10, VM11) operating on the computer, and an operation control device (2) that controls each of the plurality of virtual machines to operate in a time-division manner for a predetermined operating time for each operating cycle, If we consider the one currently running among the aforementioned multiple virtual machines as the operating machine, The aforementioned operation control device is A first processing unit (21) capable of performing a switching process to switch the aforementioned operating machine, A second processing unit (22) that can execute a prohibition process to prohibit the execution of the aforementioned switching process and a permission process to permit the execution of the aforementioned switching process, Equipped with, The aforementioned operating machine sends a prohibition request when starting a specific process that must be executed consecutively, and sends a permission request when it has completed the specific process. The second processing unit is, When the aforementioned prohibition request is received, a determination process is executed to determine whether the remaining time, which is the time from that point until the end of the aforementioned operation time, is equal to or greater than a predetermined set time. As a result of the aforementioned determination process, if the remaining time is equal to or greater than the set time, the prohibition process is executed; however, if the remaining time is less than the set time, the prohibition process is not executed. When the aforementioned permission request is received, the permission process is executed. The first processing unit is configured to extend the operation time by a predetermined margin time during the prohibition period. The second processing unit executes the decision process using the time from the time the prohibition request is received until the extended operating time has elapsed as the remaining time. A usable time is set for each of the aforementioned operating cycles. The first processing unit is capable of extending the operating time by consuming the required margin time from the available time. The first processing unit is an electronic control device that, if there is remaining time in the available time when the operation of the last operating machine in the operation cycle is started, can allocate at least a portion of that remaining time to the operation time of the last operating machine.

16. An electronic control device comprising a computer (3), a plurality of virtual machines (VM10, VM11) operating on the computer, and an operation control device (2) that controls each of the plurality of virtual machines to operate in a time-division manner for a predetermined operating time for each operating cycle, If we consider the one currently running among the aforementioned multiple virtual machines as the operating machine, The aforementioned operation control device is A first processing unit (21) capable of performing a switching process to switch the aforementioned operating machine, A second processing unit (22) that can execute a prohibition process to prohibit the execution of the aforementioned switching process and a permission process to permit the execution of the aforementioned switching process, Equipped with, The aforementioned operating machine sends a prohibition request when starting a specific process that must be executed consecutively, and sends a permission request when it has completed the specific process. The second processing unit is, When the aforementioned prohibition request is received, a determination process is executed to determine whether the remaining time, which is the time from that point until the end of the aforementioned operation time, is equal to or greater than a predetermined set time. As a result of the aforementioned determination process, if the remaining time is equal to or greater than the set time, the prohibition process is executed; however, if the remaining time is less than the set time, the prohibition process is not executed. When the aforementioned permission request is received, the permission process is executed. The first processing unit is an electronic control device that, if the prohibition process is not executed after the operating machine has transmitted the prohibition request, causes the operating machine to repeatedly transmit the prohibition request until the prohibition process is executed.

17. An electronic control device comprising a computer (3), a plurality of virtual machines (VM10, VM11) operating on the computer, and an operation control device (2) that controls each of the plurality of virtual machines to operate in a time-division manner for a predetermined operating time for each operating cycle, If we consider the one currently running among the aforementioned multiple virtual machines as the operating machine, The aforementioned operation control device is A first processing unit (21) capable of performing a switching process to switch the aforementioned operating machine, A second processing unit (22) that can execute a prohibition process to prohibit the execution of the aforementioned switching process and a permission process to permit the execution of the aforementioned switching process, Equipped with, The aforementioned operating machine sends a prohibition request when starting a specific process that must be executed consecutively, and sends a permission request when it has completed the specific process. The second processing unit is, When the aforementioned prohibition request is received, a determination process is executed to determine whether the remaining time, which is the time from that point until the end of the aforementioned operation time, is equal to or greater than a predetermined set time. As a result of the aforementioned determination process, if the remaining time is equal to or greater than the set time, the prohibition process is executed; however, if the remaining time is less than the set time, the prohibition process is not executed. When the aforementioned permission request is received, the permission process is executed. The first processing unit is an electronic control device that, if the prohibition process is not executed after the operating machine transmits the prohibition request, executes the switching process before the operating time allocated to the operating machine has elapsed, or at the time the operating time allocated to the operating machine has elapsed.

18. The electronic control device according to any one of claims 15 to 18, wherein the operating machine performs the specific processing during the prohibition period, which is the period during which the prohibition processing is being performed.

Images