Electronic control device, memory area allocation method, and memory area allocation program

Abstract

To appropriately secure a real-time property of an entire system in a configuration where a plurality of systems are virtualized by a hypervisor.SOLUTION: In an electronic control device 1 mounted on a vehicle, a plurality of systems 4 to 6 including operating systems and application programs operating on the operating systems are operated on a multi-core CPU 2 having a plurality of cores. The electronic control device comprises a memory 7 for use by the plurality of systems and a management unit 3 for dynamically allocating memory ares of the memory to the systems. The memory has preferential memory areas to be preferentially allocated to the plurality of systems and reserve memory areas other than the preferential memory areas. If a memory capacity of preferential memory areas to be allocated to a system requiring addition of a memory capacity is deficient, the management unit allocates reserve memory areas to the system requiring addition of the memory capacity.SELECTED DRAWING: Figure 4

Description

Technical Field

[0001] The present invention relates to an electronic control device, a method for allocating a memory area, and a program for allocating a memory area.

Background Art

[0002] For example, in the field of in-vehicle electronic control devices (hereinafter referred to as ECUs (Electronic Control Units)), in a single computer system, a technique has been developed to integrate the operations of a plurality of operating systems (hereinafter referred to as OSs (Operating Systems)) by a hypervisor as a management unit. For example, Patent Document 1 discloses a technique for switching the core allocation according to the vehicle state, system state, etc. in a configuration where a plurality of systems operate on a multi-core CPU having a plurality of cores, and effectively utilizing the resources of each core with respect to the increase and decrease of the processing load.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] In a configuration where a plurality of systems are virtualized by a hypervisor, it is required to optimally allocate the memory capacity to each system. On the other hand, the memory capacity required for each system dynamically changes according to, for example, the vehicle state and the system state. Therefore, it is necessary to appropriately review the memory capacity allocated to each system according to the vehicle state, system state, etc.

[0005] When attempting to allocate additional memory capacity to a system that requests it, unless the memory areas being used by other systems are released, it is not possible to allocate additional memory capacity to the system that requests it. In this case, it is necessary to wait until the memory areas being used by other systems are released, which poses a problem of degrading the real-time performance of the entire system. With the technology of Patent Document 1 described above, although the resources of each core can be effectively utilized in response to increases and decreases in processing load, it does not succeed in solving the problem of degrading the real-time performance of the entire system.

[0006] The present invention has been made in view of the above circumstances, and an object thereof is to provide an electronic control device, a method for allocating a memory area, and a program for allocating a memory area that can effectively utilize the memory resources used by a plurality of systems and can appropriately ensure the real-time performance of the entire system in a configuration in which a plurality of systems are virtualized by a management unit.

Means for Solving the Problems

[0007] According to the invention described in claim 1, an electronic control device mounted on a vehicle, wherein a plurality of systems (4 to 6) including an operating system and an application program operating on the operating system operate on a multi-core CPU (2) having a plurality of cores. It includes a memory (7) used by the plurality of systems and a management unit (3) that dynamically allocates a memory area of the memory to the systems. The memory has a priority memory area that is preferentially allocated to the plurality of systems and a reserved memory area other than the priority memory area. When the memory capacity of the priority memory area to be allocated to a system that requires additional memory capacity is insufficient, the management unit allocates the reserved memory area to the system that requires additional memory capacity.

[0008] A reserved memory area is prepared in advance as a memory area other than the priority memory area, and when the memory capacity of the priority memory area allocated to a system that requires additional memory capacity is insufficient, the reserved memory area is allocated to the system that requires additional memory capacity. Without waiting until the memory area being used by another system is released, the memory capacity can be additionally allocated to the system that requests additional memory capacity, without degrading the real-time performance of the entire system. As a result, in a configuration where a management unit virtualizes a plurality of systems, the memory resources used by the plurality of systems can be effectively utilized, and the real-time performance of the entire system can be appropriately ensured. Particularly in an in-vehicle environment, there are restrictions on increasing the size of the memory from the viewpoints of mountability and cost, etc., so the advantage of effectively utilizing the memory resources is great.

[0009] According to the invention described in claim 6, there is provided an electronic control device mounted on a vehicle, wherein a plurality of systems (14 to 16) including an operating system and an application program operating on the operating system operate on a multi-core CPU (12) having a plurality of cores. The electronic control device includes a memory (17) used by the plurality of systems, and a management unit (13) that dynamically allocates a memory area of the memory to the systems. The memory has a first memory area in which data used across a plurality of or different control cycles of the management unit is stored, and a second memory area in which data not used across a plurality of or different control cycles of the management unit is stored. The management unit dynamically switches the allocation of the second memory area at a predetermined timing.

[0010] Separate from the first memory area that stores data used across multiple or different control cycles of the management unit, a second memory area that stores data not used across multiple or different control cycles of the management unit is prepared in advance, and the allocation of the second memory area is dynamically switched at a predetermined timing. By dynamically switching the allocation of the second memory area, memory capacity can be additionally allocated to a system that requests an increase in memory capacity, and the real-time performance of the entire system is not impaired. As a result, in a configuration where the management unit virtualizes multiple systems, the memory resources used by the multiple systems can be effectively utilized, and the real-time performance of the entire system can be appropriately ensured. Particularly in an in-vehicle environment, there are restrictions on increasing the size of the memory from the viewpoints of mounting and cost, etc., so the advantage of effectively utilizing memory resources is great.

Brief Description of the Drawings

[0011]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

Figure 12

Figure 13

Figure 14

Mode for Carrying Out the Invention

[0012] Hereinafter, a plurality of embodiments will be described with reference to the drawings. In subsequent embodiments, descriptions of the same parts as those in the preceding embodiments may be omitted (First Embodiment)

[0013] The first embodiment will be described with reference to FIGS. 1 to 5. As shown in FIG. 1, the ECU 1 is mounted on a vehicle such as an automobile, and performs information processing related to control of devices mounted on the vehicle, communication control with the outside, and driving control such as autonomous driving. The ECU 1 includes a multi-core CPU 2, and is composed of the multi-core CPU 2, a semiconductor memory (not shown) such as a RAM, a ROM, and a flash memory, an input / output interface (not shown), and the like

[0014] The ECU 1 is embodied by, for example, a microcontroller that integrates functions as a computer system. The ECU 1 is realized by the multi-core CPU 2 executing a program stored in a physical recording medium such as a ROM or a semiconductor memory. The multi-core CPU 2 is an arithmetic device in which a plurality of processor cores (hereinafter referred to as cores) are mounted in one package. In this embodiment, the multi-core CPU 2 has three cores 1 to 3, and the case where the number of cores is "3" is exemplified, but the number of cores is not limited to "3".

[0015] The multi-core CPU 2 includes a hypervisor 3 (corresponding to a management unit), a first system 4, a second system 5, and a third system 6 as components of functions realized by executing a program. The first system 4, the second system 5, and the third system 6 each operate on the multi-core CPU 2

[0016] The hypervisor 3 is a control program that creates a plurality of virtual machines on the multi-core CPU 2 to operate them in parallel and operates an OS on the created virtual machines. The hypervisor 3 executes scheduling to dynamically allocate the cores used by each OS so that a plurality of OSs can be executed in parallel on a plurality of cores. The hypervisor 3 executes a method for allocating a memory area and a program for allocating a memory area.

[0017] The first system 4, the second system 5, and the third system 6 each include an OS that operates on a virtual machine formed by the hypervisor 3 and a plurality of tasks executed by an application program that operates on the OS. The first system 4 has OS1 and n tasks 1-1 to 1-n. The second system 5 has OS2 and n tasks 2-1 to 2-n. The third system 6 has OS3 and n tasks 3-1 to 3-n. When simultaneously executing a plurality of tasks, OS1 to 3 each execute scheduling to allocate the resources of cores 1 to 3 allocated by the hypervisor 3 to the plurality of tasks so as to operate independently of each other. The number of tasks executed by systems 4 to 6 may be the same or different.

[0018] Each of the tasks 1-1 to 1-n of the first system 4, each of the tasks 2-1 to 2-n of the second system 5, and each of the tasks 3-1 to 3-n of the third system 6 are tasks that execute information processing related to navigation from the current location of the vehicle to the destination, tasks that execute information processing related to data wireless communication with an external device, tasks that execute information processing related to autonomous driving, and the like. Each task may be a task that executes information processing other than that exemplified.

[0019] The memory 7 is a RAM and is used by the first system 4, the second system 5, and the third system 6. The memory area of the memory 7 is partitioned and is divided into a priority memory area and a reserved memory area. The priority memory area has a memory area for the first system, a memory area for the second system, and a memory area for the third system. The memory area for the first system is an area preferentially allocated to the first system 4. The memory area for the second system is an area preferentially allocated to the second system 5. The memory area for the third system is an area preferentially allocated to the third system 6. The systems 4 to 6 each dynamically change the memory capacity used according to, for example, the execution state of a task, and when an increase in the memory capacity is required, they notify the hypervisor 3 of a memory capacity increase request. When the hypervisor 3 is notified of the memory capacity increase request, it identifies the shortage of the memory capacity in the system that is the source of the notification of the memory capacity increase request.

[0020] The ECU 1 includes, outside the multi-core 2, a first allocation information storage unit 8, a second allocation information storage unit 9, and a first abnormal-time allocation information storage unit 10. The first allocation information storage unit 8 stores first allocation information indicating the allocation of the memory capacity to the systems 4 to 6 according to the vehicle state indicating the state of the vehicle. The vehicle state is, for example, during parking, during driving, or during stopping. During parking means a state in which the vehicle is stopped with the engine running. During driving means a state in which the vehicle is moving with the engine running. During stopping means a state in which the vehicle is stopped with the engine stopped. Since the processing load of each system changes following the change in the vehicle state, the first allocation information storage unit 8 stores the allocation of the memory capacity so that the processing of each system does not stagnate.

[0021] The second allocation information storage unit 9 stores second allocation information indicating the allocation of memory capacity to systems 4 to 6 according to the system state indicating the states of systems 4 to 6. The system state is, for example, during startup, during operation, or during sleep. During startup means that systems 4 to 6 are waiting for operation. During operation means that the system is operating. During sleep means that systems 4 to 6 are waiting for startup. Since the processing load of each system changes following the change in the system state, the second allocation information storage unit 8 stores the allocation of memory capacity so that the processing of each system does not stagnate.

[0022] The first abnormal-time allocation information storage unit 10 stores first abnormal-time allocation information indicating the allocation of memory capacity to systems 4 to 6 according to the abnormal states of systems 4 to 6. Since the processing load of each system changes following the occurrence of an abnormality in systems 4 to 6, the first abnormal-time allocation information storage unit 10 stores the allocation of memory capacity so that the processing of each system does not stagnate.

[0023] The hypervisor 3 determines the allocation of memory capacity based on the first allocation information, the second allocation information, and the first abnormal-time allocation information. For example, when the vehicle state changes, the hypervisor 3 refers to the first allocation information and allocates the memory capacity based on the first allocation information. The hypervisor 3 determines whether it is necessary to add memory capacity to any of the systems due to the change in the vehicle state. When the hypervisor 3 identifies that it is necessary to add memory capacity to any of the systems, it determines whether it is possible to allocate the additional amount from the priority memory area to the system that requires the additional memory capacity. When the hypervisor 3 identifies that it is possible to allocate the additional amount from the priority memory area, it allocates the additional amount from the priority memory area. When the hypervisor 3 identifies that it is impossible to allocate the additional amount from the priority memory area, it allocates the additional amount from the reserved memory area.

[0024] Similarly, when the system state changes, for example, the hypervisor 3 refers to the second allocation information and allocates the memory capacity based on the second allocation information. When the hypervisor 3 determines that additional memory capacity is required for any system due to a change in the system state, it allocates the additional amount from the priority memory area or the reserved memory area.

[0025] Also, when an abnormality occurs in any system, the hypervisor 3 refers to the first abnormal-time allocation information and allocates the memory capacity based on the first abnormal-time allocation information. When the hypervisor 3 determines that additional memory capacity is required for any system due to an abnormality occurring in any system, it allocates the additional amount from the priority memory area or the reserved memory area.

[0026] Next, the operation of the above-described configuration will be described with reference to FIGS. 2 to 5. The hypervisor 3 waits for the occurrence of the start event of the additional memory capacity determination process. For example, when it determines the occurrence of the start event of the additional memory capacity determination process at every predetermined period, it starts the additional memory capacity determination process. When the hypervisor 3 starts the additional memory capacity determination process, it determines whether additional memory capacity is required for any system (S1). When the hypervisor 3 has not been notified of any additional memory capacity request from any system and determines that additional memory capacity is not required for any system (S1: NO), it ends the additional memory capacity determination process and waits for the occurrence of the start event of the next additional memory capacity determination process.

[0027] The hypervisor 3 has been notified of a memory capacity increase request from one of the systems. When it determines that an increase in memory capacity is required for one of the systems (S1: YES), it determines whether it is possible to allocate the additional amount from the priority memory area to the system that requires the memory capacity increase (S2). When the hypervisor 3 determines that it is possible to allocate the additional amount from the priority memory area, that is, when it determines that the memory capacity of the priority memory area allocated to the system that requires the memory capacity increase is not insufficient (S2: YES), it allocates the additional amount from the priority memory area to the system that requires the memory capacity increase (S3), terminates the memory capacity increase necessity determination process, and waits for the occurrence of the start event of the next memory capacity increase necessity determination process.

[0028] On the other hand, when the hypervisor 3 determines that it is impossible to allocate the additional amount from the priority memory area, that is, when it determines that the memory capacity of the priority memory area allocated to the system that requires the memory capacity increase is insufficient (S2: NO, corresponding to the first determination procedure), it allocates the additional amount from the reserved memory area to the system that requires the memory capacity increase (S4, corresponding to the allocation procedure), terminates the memory capacity increase necessity determination process, and waits for the occurrence of the start event of the next memory capacity increase necessity determination process.

[0029] With reference to FIGS. 3 to 5 regarding the allocation of memory capacity when the vehicle state changes, the memory areas allocated to each system will be described in the cases where the vehicle state is stopped, changing from stopped to running, and running. FIG. 4 shows the change in the memory capacity available to the system. FIG. 5 shows the change in the physical memory management state.

[0030] When the vehicle state is stopped, for the entire memory 7, for example, the first system 4 requires 30% of the memory capacity, the second system 5 requires 30% of the memory capacity, and the third system 6 requires 20% of the memory capacity. In this case, the reserved memory area is 20% of the memory capacity of the entire memory 7. The 30% of the memory capacity required by the first system 4 is allocated from the memory area for the first system, the 30% of the memory capacity required by the second system 5 is allocated from the memory area for the second system, and the 20% of the memory capacity required by the third system 6 is allocated from the memory area for the third system.

[0031] When the vehicle state switches from stopped to running (at t1 in Fig. 5), it is assumed that the processing load of the first system 4 increases, the processing load of the second system 5 decreases, and the processing load of the third system 6 does not change. When the vehicle state switches from stopped to running, for the entire memory 7, for example, due to the increase in the processing load, the memory capacity required by the first system 4 increases from 30% to 50%, and due to the decrease in the processing load, the memory capacity required by the second system 5 decreases from 30% to 10%, and the memory capacity required by the third system 6 remains 20% due to maintaining the current processing load.

[0032] In this case, immediately after the vehicle state switches from stopped to running, the first system 4 notifies the hypervisor 3 of a request for additional memory capacity. When the hypervisor 3 is notified of the request for additional memory capacity from the first system 4, it identifies that additional memory capacity is required for the first system 4. At that time, it also identifies that it is impossible to allocate the additional amount from the priority memory area. Therefore, the hypervisor 3 allocates the additional amount from the reserved memory area.

[0033] That is, 50% of the memory capacity required by the first system 4 is allocated from the memory area for the first system and the reserved memory area, 10% of the memory capacity required by the second system 5 is allocated from the memory area for the second system, and 20% of the memory capacity required by the third system 6 is allocated from the memory area for the third system. By preparing the reserved memory area in advance, even if it is impossible to allocate the additional portion from the priority memory area, it is possible to allocate the reserved memory area to the first system 4 that requires an increase in the memory capacity without waiting until the memory area being used by another system is released. That is, the first system 4 can appropriately execute the process during the change from the stopped state to the running state of the vehicle without a shortage of memory capacity because the additional memory capacity required is allocated in real time from the reserved memory area. Also, at this time, in the memory area for the second system, as the memory capacity required by the second system 5 decreases from 30% to 10%, 20% of the memory capacity with respect to the entire memory 7 is gradually released.

[0034] When the vehicle state completes the change from the stopped state to the running state (at t2 in Fig. 5), 20% of the memory area for the second system with respect to the entire memory 7 released during the change of the vehicle state from stopped to running becomes the reserved memory area.

[0035] The above has described the allocation of the memory capacity when the vehicle state changes from the stopped state to the running state. However, for example, when the vehicle state changes from the running state to the stopped state, when the vehicle state changes from the parked state to the stopped state, etc., it is the same. When a memory capacity increase request is notified from any system, real-time performance is ensured by appropriately allocating the required additional memory capacity from the reserved memory area. Also, not limited to the case where the vehicle state changes, the same applies to the allocation of the memory capacity when the system state changes and the allocation of the memory capacity when an abnormality occurs in systems 4 to 6.

[0036] Whether to allocate the reserved memory area to the system that is the source of the memory capacity addition request may be determined according to the importance of the system that is the source of the memory capacity addition request. For example, when the tasks executed by the system that is the source of the memory capacity addition request are involved in vehicle driving, stopping, steering, etc., it is identified that the importance of the system is relatively high, and the reserved memory area is allocated to the system that is the source of the memory capacity addition request. On the other hand, when the tasks executed by the system that is the source of the memory capacity addition request are not involved in vehicle driving, stopping, steering, etc., it is identified that the importance of the system is relatively low, and the reserved memory area may not be allocated to the system that is the source of the memory capacity addition request. The importance of the system may be determined according to the allowable waiting time.

[0037] As described above, according to the first embodiment, the following operational effects can be obtained. In the ECU1, a reserved memory area is prepared in advance as a memory area other than the priority memory area, and when the memory capacity of the priority memory area to be allocated to a system that requires additional memory capacity is insufficient, the reserved memory area is allocated to the system that requires additional memory capacity. Without waiting until the memory area being used by another system is released, the memory capacity can be additionally allocated to the system that requests additional memory capacity, and the real-time performance of the entire system will not be impaired. As a result, in a configuration where the hypervisor 3 virtualizes a plurality of systems 4 to 6, the memory 7 resources used by the plurality of systems 4 to 6 can be effectively utilized, and the real-time performance of the entire system can be appropriately ensured. Especially in an in-vehicle environment, there are restrictions on increasing the size of the memory 7 from the viewpoints of mountability and cost, etc., so the advantage of effectively utilizing the memory 7 resources is great.

[0038] Whether to allocate the reserved memory area to the system that is the source of the memory capacity increase request is determined according to the importance of the system that is the source of the memory capacity increase request. When the importance of the system that is the source of the memory capacity increase request is relatively high, the reserved memory area is allocated to the system that is the source of the memory capacity increase request. On the other hand, when the importance of the system that is the source of the memory capacity increase request is relatively low, the reserved memory area is not allocated to the system that is the source of the memory capacity increase request, so that the reserved memory area can be effectively utilized.

[0039] For example, the allocation of the memory capacity to Systems 4 to 6 is determined according to the vehicle state such as when the vehicle is stopped, running, parked, etc. Although the memory capacity required by each system changes according to the vehicle state, the required memory capacity can be appropriately allocated to each system.

[0040] For example, the allocation of the memory capacity to Systems 4 to 6 is determined according to the system state such as when the system is starting up, operating, in sleep, etc. Although the memory capacity required by each system changes according to the system state, the required memory capacity can be appropriately allocated to each system.

[0041] The allocation of the memory capacity to Systems 4 to 6 is determined according to the abnormality of Systems 4 to 6. Although the memory capacity required by each system changes due to the abnormality of Systems 4 to 6, the required memory capacity can be appropriately allocated to each system.

[0042] (Second Embodiment) Next, the second embodiment will be described with reference to FIGS. 6 to 10. The second embodiment has a configuration in which the memory has a first memory area in which data used across a plurality of different control cycles of the hypervisor is stored, and a second memory area in which data not used across a plurality of different control cycles of the hypervisor is stored.

[0043] In ECU 11, the multicore 12, hypervisor 13 (corresponding to the management unit), first system 14, second system 15, and third system 16 are equivalent to the multicore 2, hypervisor 3, first system 4, second system 5, and third system 6 described in the first embodiment, respectively.

[0044] The memory 17 is a RAM and is used by the first system 14, second system 15, and third system 16. The memory 17 is divided into a first memory area and a second memory area. The first memory area has a first system memory area, a second system memory area, and a third system memory area. Similar to the first embodiment, the first system memory area is an area preferentially allocated to the first system 14, the second system memory area is an area preferentially allocated to the second system 15, and the third system memory area is an area preferentially allocated to the third system 16. The first memory area is a memory area in which data used across a plurality of different control cycles of the hypervisor 13 is stored. The second memory area is a memory area in which data not used across a plurality of different control cycles of the hypervisor 13 is stored and data used across a plurality of different control cycles of the hypervisor 13 is not stored.

[0045] ECU 11 includes, outside the multicore 12, a third allocation information storage unit 18, a fourth allocation information storage unit 19, and a second abnormal-time allocation information storage unit 20. The third allocation information storage unit 18 stores third allocation information indicating the allocation of the memory capacity to the systems 14 to 16 according to the vehicle state indicating the state of the vehicle. The fourth allocation information storage unit 19 stores fourth allocation information indicating the allocation of the memory capacity to the systems 14 to 16 according to the system state indicating the state of the systems 14 to 16. The second abnormal-time allocation information storage unit 20 stores second abnormal-time allocation information indicating the allocation of the memory capacity to the systems 14 to 16 in case of an abnormality in the systems 14 to 16.

[0046] Next, the operation of the above-described configuration will be described with reference to FIGS. 7 to 10. When the hypervisor 13 starts the determination process for the necessity of additional memory capacity, it determines whether additional memory capacity is required for any of the systems (S11). If the hypervisor 13 has not been notified of any memory capacity addition requests from any of the systems and determines that additional memory capacity is not required for any of the systems (S11: NO), it ends the determination process for the necessity of additional memory capacity and waits for the occurrence of the start event of the next determination process for the necessity of additional memory capacity.

[0047] If the hypervisor 13 has been notified of a memory capacity addition request from any of the systems and determines that additional memory capacity is required for any of the systems (S11: YES, corresponding to the second determination procedure), it switches the allocation of the second memory area for the system that requires additional memory capacity (S12, corresponding to the switching procedure), ends the determination process for the necessity of additional memory capacity, and waits for the occurrence of the start event of the next determination process for the necessity of additional memory capacity.

[0048] With reference to FIGS. 8 to 10 regarding the allocation of memory capacity when the vehicle state changes, the memory areas allocated to each system in the case where the vehicle state is stopped or running will be described. FIG. 9 shows the change in the memory capacity available to the system. FIG. 10 shows the change in the physical memory management state. The data stored in the second memory area when the vehicle state is stopped is data that is not carried over in the transition from stopped to running, that is, data used only when the vehicle is stopped. The data stored in the second memory area when the vehicle state is running is data that is not carried over in the transition from running to stopped, that is, data used only when the vehicle is running.

[0049] When the vehicle state is stopped, for the entire memory 17, for example, the first system 14 requires 40% of the memory capacity, the second system 15 requires 40% of the memory capacity, and the third system 16 requires 20% of the memory capacity. In this case, the second memory area is 10% of the memory capacity of the entire memory 17. The 40% of the memory capacity required by the first system 14 is allocated from the memory area for the first system and the second memory area, the 40% of the memory capacity required by the second system 15 is allocated from the memory area for the second system, and the 20% of the memory capacity required by the third system 16 is allocated from the memory area for the third system.

[0050] When the vehicle state switches from stopped to running (at t11 in Fig. 10), it is assumed that the processing load of the first system 14 decreases, the processing load of the second system 15 increases, and the processing load of the third system 16 does not change. When the vehicle state switches from stopped to running, for the entire memory 17, for example, the first system 14 requires a memory capacity that decreases from 40% to 30% due to the decrease in the processing load, the second system 15 requires a memory capacity that increases from 40% to 50% due to the increase in the processing load, and the third system 16 requires a memory capacity that remains 20% due to maintaining the current processing load.

[0051] In this case, immediately after the vehicle state switches from stopped to running, the second system 15 notifies the hypervisor 13 of a memory capacity additional request. The hypervisor 13, upon receiving the memory capacity additional request notified from the second system 15, identifies that an additional memory capacity is required for the second system 15 and switches the allocation of the second memory area. That is, the hypervisor 13 allocates the second memory area that was allocated to the first system 14 to the second system 15.

[0052] The above has described the allocation of the memory capacity when the vehicle state changes. Also in this case, the same applies to the allocation of the memory capacity when the system state changes and the allocation of the memory capacity when an abnormality occurs in systems 14 to 16.

[0053] As described above, according to the second embodiment, the following operational effects can be obtained. In the ECU 11, separately from the first memory area in which data used across a plurality of different control cycles of the hypervisor 13 is stored, a second memory area in which data not used across a plurality of different control cycles of the hypervisor 13 is stored is prepared in advance. For example, when the vehicle state switches from a stopped state to a running state, the allocation of the second memory area is dynamically switched. By dynamically switching the allocation of the second memory area, it is possible to additionally allocate memory capacity to a system that requires an increase in memory capacity, without degrading the real-time performance of the entire system. As a result, in a configuration in which a plurality of systems 14 to 16 are virtualized by the hypervisor 13, the memory resources used by the plurality of systems can be effectively utilized, and the real-time performance of the entire system can be appropriately ensured.

[0054] (Third Embodiment) Next, the third embodiment will be described with reference to FIGS. 11 to 14. The third embodiment is configured to dynamically switch the allocation of the second memory area in synchronization with the timing at which the execution cycle of the corresponding system changes in the control cycle of the hypervisor 13.

[0055] When starting the memory capacity addition necessity determination process, the hypervisor 13 determines whether it is the timing of switching the execution cycle of the system (S21). If the hypervisor 13 determines that it is not the timing of switching the execution cycle of the system (S12: NO), it ends the memory capacity addition necessity determination process and waits for the occurrence of the start event of the next memory capacity addition necessity determination process.

[0056] If the hypervisor 13 determines that it is the timing of switching the execution cycle of the system (S21: YES, corresponding to the second determination procedure), it switches the allocation of the second memory area for the corresponding system (S22, corresponding to the switching procedure), ends the memory capacity addition necessity determination process, and waits for the occurrence of the start event of the next memory capacity addition necessity determination process.

[0057] Regarding the allocation of memory capacity when the execution state of the system changes, refer to FIGS. 12 to 14 for explanation. FIG. 13 shows the change in the memory capacity available to the system. FIG. 14 shows the change in the physical memory management state.

[0058] During the execution of the first system 14, with respect to the entire memory 17, for example, the first system 14 requires 40% of the memory capacity, the second system 15 requires 40% of the memory capacity, and the third system 16 requires 20% of the memory capacity. The 40% of the memory capacity required by the first system 14 is allocated from the memory area for the first system and the second memory area. The 40% of the memory capacity required by the second system 15 is allocated from the memory area for the second system. The 20% of the memory capacity required by the third system 16 is allocated from the memory area for the third system.

[0059] During the execution of the second system 15, with respect to the entire memory 17, for example, the first system 14 requires 30% of the memory capacity, the second system 15 requires 50% of the memory capacity, and the third system 16 requires 20% of the memory capacity. The 30% of the memory capacity required by the first system 14 is allocated from the memory area for the first system. The 50% of the memory capacity required by the second system 15 is allocated from the memory area for the second system and the second memory area. The 20% of the memory capacity required by the third system 16 is allocated from the memory area for the third system. That is, when the system in execution during the control cycle of the hypervisor 13 switches from the first system 14 to the second system 15 (refer to t21 in FIG. 14), the allocation destination of the second memory area switches from the first system 14 to the second system 15.

[0060] While the third system 16 is running, for the entire memory 17, for example, the first system 14 requires 30% of the memory capacity, the second system 15 requires 40% of the memory capacity, and the third system 16 requires 30% of the memory capacity. The 30% of the memory capacity required by the first system 14 is allocated from the memory area for the first system, the 40% of the memory capacity required by the second system 15 is allocated from the memory area for the second system, and the 30% of the memory capacity required by the third system 16 is allocated from the memory area for the third system and the second memory area. That is, when the system running in the control cycle of the hypervisor 13 switches from the second system 15 to the third system 16 (see t22 in FIG. 14), the allocation destination of the second memory area switches from the second system 15 to the third system 16. Thereafter, when the control cycle of the hypervisor 13 switches and the system running switches from the third system 16 to the first system 14 (see t23 in FIG. 14), the allocation destination of the second memory area switches from the third system 16 to the first system 14. Thereafter, the same process is repeated.

[0061] As described above according to the third embodiment, the following operational effects can be obtained. In the ECU 11, the timing at which the execution cycle of the corresponding system switches in the control cycle of the hypervisor 13 is set as the predetermined timing, and the allocation of the second memory area is dynamically switched. The allocation of the second memory area can be dynamically switched following the execution cycle of the system, and in a configuration where each system executes periodic tasks, the resources of the memory 17 can be effectively utilized.

[0062] (Other Embodiments) The present disclosure has been described based on the embodiments, but it should be understood that the present disclosure is not limited to these embodiments and structures. The present disclosure includes various modifications and modifications within the equivalent scope. In addition, various combinations and forms, and further other combinations and forms including only one element, more than one element, or less than one element thereof are also within the scope and spirit of the present disclosure.

[0063] The control unit and its method described in the present disclosure may be implemented by a dedicated computer configured by a processor and a memory programmed to execute one or more functions embodied by a computer program. Alternatively, the control unit and its method described in the present disclosure may be implemented by a dedicated computer configured by a processor constituted by one or more dedicated hardware logic circuits. Or, the control unit and its method described in the present disclosure may be implemented by one or more dedicated computers configured by a combination of a processor and a memory programmed to execute one or more functions and a processor constituted by one or more hardware logic circuits. Also, the computer program may be stored in a computer-readable non-transitory tangible recording medium as instructions to be executed by a computer.

Description of Signs

[0064] In the drawings, 1 is an ECU (Electronic Control Unit), 2 is a multi-core CPU, 3 is a hypervisor (management unit), 4 to 6 are systems, 7 is a memory, 8 is a first allocation information storage unit, 9 is a second allocation information storage unit, 10 is a first abnormal-time allocation information storage unit, 11 is an ECU (Electronic Control Unit), 12 is a multi-core CPU, 13 is a hypervisor (management unit), 14 to 16 are systems, 17 is a memory, 18 is a third allocation information storage unit, 19 is a fourth allocation information storage unit, and 20 is a second abnormal-time allocation information storage unit.

Claims

1. An electronic control unit mounted on a vehicle, wherein a plurality of systems (4 to 6) including an operating system and an application program operating on the operating system operate on a multi-core CPU (2) having a plurality of cores. In the electronic control unit (1), a memory (7) used by the plurality of systems, and a management unit (3) for dynamically allocating a memory area of the memory to the systems, are provided, the memory has a priority memory area preferentially allocated to the plurality of systems and a reserved memory area other than the priority memory area, and when the memory capacity of the priority memory area to be allocated to a system that requires an increase in memory capacity is insufficient, the management unit allocates the reserved memory area to the system that requires an increase in memory capacity. An electronic control unit.

2. The management unit can allocate the reserved memory area to the system that has notified a request for increasing the memory capacity when receiving a notification of a request for increasing the memory capacity from the system that requires an increase in memory capacity, and whether or not to allocate the reserved memory area to the system that has notified the request for increasing the memory capacity. The electronic control unit according to claim 1, which is determined according to the importance of the system that has notified the request for increasing the memory capacity.

3. A first allocation information storage unit (8) that stores first allocation information indicating the allocation of memory capacity to the system according to the vehicle state indicating the state of the vehicle is provided, and the management unit determines the allocation of memory capacity to the system based on the first allocation information. The electronic control unit according to claim 1.

4. A second allocation information storage unit (9) that stores second allocation information indicating the allocation of memory capacity to the system according to the system state indicating the state of the system is provided, and the management unit determines the allocation of memory capacity to the system based on the second allocation information. The electronic control unit according to claim 1.

5. A first abnormal-time allocation information storage unit (10) that stores first abnormal-time allocation information indicating the allocation of memory capacity to the system in response to an abnormality of the system is provided, and the management unit determines the allocation of memory capacity to the system based on the first abnormal-time allocation information. The electronic control unit according to claim 1.

6. An electronic control device mounted on a vehicle, wherein a plurality of systems (14 to 16) including an operating system and an application program operating on the operating system operate on a multi-core CPU (12) having a plurality of cores. In the electronic control device (11), a memory (17) used by the plurality of systems; a management unit (13) for dynamically allocating a memory area of the memory to the systems, and the memory has a first memory area in which data used across a plurality of or different control cycles of the management unit is stored, and a second memory area in which data not used across a plurality of or different control cycles of the management unit is stored. The management unit is an electronic control device that dynamically switches the allocation of the second memory area at a predetermined timing.

7. A third allocation information storage unit (18) that stores third allocation information indicating the allocation of memory capacity to the system according to the vehicle state indicating the state of the vehicle, The management unit uses the timing at which the vehicle state changes as the predetermined timing, and dynamically switches the allocation of the second memory area based on the third allocation information. The electronic control device according to claim 6.

8. A fourth allocation information storage unit (19) that stores fourth allocation information indicating the allocation of memory capacity to the system according to the system state indicating the state of the system, The management unit uses the timing at which the system state changes as the predetermined timing, and dynamically switches the allocation of the second memory area based on the fourth allocation information. The electronic control device according to claim 6.

9. A second abnormal-time allocation information storage unit (20) that stores second abnormal-time allocation information indicating the allocation of memory capacity to the system in response to an abnormality of the system, The management unit uses the time of abnormality of the system as the predetermined timing, and dynamically switches the allocation of the second memory area based on the second abnormal-time allocation information. The electronic control device according to claim 6.

10. The management unit uses the timing at which the execution cycle of the corresponding system switches in a control cycle as the predetermined timing, and dynamically switches the allocation of the second memory area. The electronic control device according to claim 6.

11. An electronic control unit mounted on a vehicle, wherein a plurality of systems (4 to 6) including an operating system and an application program operating on the operating system operate on a multi-core CPU (2) having a plurality of cores, and the memory used by the plurality of systems has a priority memory area preferentially allocated to the plurality of systems and a reserved memory area other than the priority memory area. In the electronic control unit (1), A first determination step of determining whether or not the memory capacity of the priority memory area allocated to the system that requires an increase in memory capacity is insufficient; An allocation method for a memory area, which includes an allocation step of allocating the reserved memory area to the system that requires an increase in memory capacity when it is specified by the first determination step that the memory capacity of the priority memory area allocated to the system that requires an increase in memory capacity is insufficient.

12. An electronic control unit mounted on a vehicle, wherein a plurality of systems (4 to 6) including an operating system and an application program operating on the operating system operate on a multi-core CPU (2) having a plurality of cores, and the memory used by the plurality of systems has a priority memory area preferentially allocated to the plurality of systems and a reserved memory area other than the priority memory area. In the electronic control unit (1), A first determination step of determining whether or not the memory capacity of the priority memory area allocated to the system that requires an increase in memory capacity is insufficient; A memory area allocation program that causes the execution of a first determination step of determining whether or not the memory capacity of the priority memory area allocated to the system that requires an increase in memory capacity is insufficient, and an allocation step of allocating the reserved memory area to the system that requires an increase in memory capacity when it is specified by the first determination step that the memory capacity of the priority memory area allocated to the system that requires an increase in memory capacity is insufficient.

13. An electronic control unit mounted on a vehicle, wherein a plurality of systems (14 to 16) including an operating system and an application program operating on the operating system operate on a multi-core CPU (12) having a plurality of cores, and the memory used by the plurality of systems stores a first memory area storing data used across a plurality of or different control cycles of the management unit, and a second memory area storing data not used across a plurality of or different control cycles of the management unit. In the electronic control unit (11), A second determination procedure for determining whether it is a predetermined timing, A switching procedure for dynamically switching the allocation of the second memory area when it is determined by the second determination procedure that it is a predetermined timing. A method for allocating a memory area that performs the above.

14. An electronic control unit mounted on a vehicle, wherein a plurality of systems (14 to 16) including an operating system and an application program operating on the operating system operate on a multi-core CPU (12) having a plurality of cores, and the memory used by the plurality of systems stores a first memory area storing data used across a plurality of or different control cycles of the management unit, and a second memory area storing data not used across a plurality of or different control cycles of the management unit. In the electronic control unit (11), A second determination procedure for determining whether it is a predetermined timing, A switching procedure for dynamically switching the allocation of the second memory area when it is determined by the second determination procedure that it is a predetermined timing. A memory area allocation program that performs the above.

Images