Electronic control unit

Abstract

The objective is to provide a technology that can monitor each core malfunction during the initialization process of a microprocessor equipped with multiple cores, while preventing unnecessary resets from occurring during the initialization process that is actually required. [Solution] The electronic control device includes a runaway monitoring device and a microprocessor connected to the runaway monitoring device, which includes a first core and a second core different from the first core, wherein the runaway monitoring device has a counter, and the counter is configured to monitor runaway behavior of the first core and the second core during the initialization of the microprocessor using the same runaway monitoring time threshold as periodic processing. When the initialization process of the first core has finished and the initialization process of the second core is continuing, the first core sends a refresh instruction to the runaway monitoring device to refresh the counter's count value before the runaway monitoring time threshold has elapsed.

Description

Technical Field

[0001] The present disclosure relates to an electronic control device, and is a technology effective when applied to an electronic control device including a microprocessor equipped with a plurality of cores and a runaway monitoring device.

Background Art

[0002] As a proposal of a microcomputer equipped with a runaway monitoring device, there is Japanese Patent Application Laid-Open No. 2002-41493.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] The present disclosure has studied the configuration of the initialization process of an electronic control device including a microprocessor equipped with a plurality of cores and a runaway monitoring device connected to the outside of the microprocessor. Here, as the runaway monitoring device, it is common to adopt a watchdog timer.

[0005] When adopting a method of outputting a refresh instruction from the microprocessor to the runaway monitoring device during the initialization process of a plurality of cores of the microprocessor, if a configuration is adopted in which the refresh instruction is generated at regular intervals, when any of the plurality of cores actually runs away, the runaway cannot be detected. Also, when adopting a method of lengthening the runaway detection time of the runaway monitoring device during the initialization process of a plurality of cores, extra communication processing between the microprocessor and the runaway monitoring device is required to set a long runaway detection time in the runaway monitoring device. Further, when taking a method of stopping the monitoring of the runaway monitoring device during the initialization process of a plurality of cores, there is a problem that the runaway cannot be detected when any of the plurality of cores actually runs away.

[0006] The present disclosure aims to provide a technology that, during the initialization process of a microprocessor equipped with multiple cores, can monitor each core for malfunctions while preventing unnecessary resets from occurring during the initialization process that is actually required.

[0007] Other challenges and novel features will become apparent from the description and accompanying drawings in this specification. [Means for solving the problem]

[0008] A brief overview of some of the representative disclosures is as follows:

[0009] According to one embodiment, the electronic control device includes a runaway monitoring device and a microprocessor connected to the runaway monitoring device, which includes a first core and a second core different from the first core, The runaway monitoring device has a counter, and the counter is configured to monitor runaway behavior of the first core and the second core during the initialization of the microprocessor using the same runaway monitoring time threshold as the periodic processing. When the initialization process of the first core has finished and the initialization process of the second core is continuing, the first core sends a refresh instruction to the runaway monitoring device to refresh the count value of the counter before the threshold of the runaway monitoring time has elapsed. [Effects of the Invention]

[0010] According to the electronic control device of the above embodiment, when the microprocessor is initialized, the runaway monitoring device is set to the same runaway monitoring time as the periodic processing, and the initialization process of the microprocessor is monitored without changing the runaway monitoring time, thereby preventing unnecessary resets even if there is a delay in the initialization time that exceeds the runaway monitoring time. [Brief explanation of the drawing]

[0011] [Figure 1]Figure 1 shows an example of the configuration of an electronic control device according to an embodiment. [Figure 2] Figure 2 shows the timing of the refresh instruction according to the embodiment. [Figure 3] Figure 3 is a flowchart showing the operation of the electronic control device according to the embodiment during initialization. [Modes for carrying out the invention]

[0012] The following examples will be described with reference to the drawings. However, in the following description, the same reference numerals will be used for identical components, and repeated explanations may be omitted. In addition, the drawings may be more schematic than the actual embodiments in order to make the explanation clearer, but they are merely examples and do not limit the interpretation of the present invention. [Examples]

[0013] Figure 1 is a diagram showing an example configuration of an electronic control device according to the embodiment. Figure 2 is a diagram showing the timing of the refresh instruction according to the embodiment. Figure 3 is a flowchart showing the operation of the electronic control device during initialization according to the embodiment.

[0014] As shown in Figure 1, the electronic control unit 100 includes a microprocessor 107 having multiple cores (108, 109) and a runaway monitoring device (hereinafter referred to as the monitoring device) 101 connected to the microprocessor 107 to monitor runaway behavior of the microprocessor 107. The monitoring device 101 is provided to monitor runaway behavior of the first core 108 (labeled as core 1 in Figure 1) and the second core 109 (labeled as core 12 in Figure 1) of the microprocessor 107.

[0015] The monitoring device 101 includes a communication circuit 106 that receives a clear instruction 117 for the watchdog timer 104 from the microprocessor 107, a monitoring time threshold 103 for monitoring runaway operation of the microprocessor 107, and a monitoring time control 102 that detects using the watchdog timer 104. The monitoring device 101 also includes an output process 105 that outputs a reset instruction REST to the microprocessor 107 when the monitoring time control 102 determines that the microprocessor 107 is runaway, and a communication path 116 for communicating the reset instruction REST output from the output process 105 to the microprocessor 107.

[0016] The monitoring device 101 has a relationship with the microprocessor 107 that allows it to perform a reset of the microprocessor 107 when it detects a malfunction in the microprocessor 107.

[0017] The microprocessor 107 has a first core 108 that issues a clear command 117 to the monitoring device 101, and at least one second core 109 that is different from the first core 108.

[0018] The arithmetic processing unit of the first core 108 includes a communication circuit 112 that outputs a clear instruction 117 and a reset control that receives a reset instruction REST from a communication path 116. Upon receiving the reset instruction REST, the reset control controls the microprocessor 107 to perform a reset 121, such as a software reset. The arithmetic processing unit of the first core 108 includes an initialization process and a periodic process, and the initialization process and the periodic process each have separate reset processes (first reset process 110, second reset process 111). Here, in the first core 108, the initialization process refers to, for example, the initialization of the registers of the first core 108, and the periodic process refers to the periodic processing of various controls executed by the first core 108 after the initialization process.

[0019] The arithmetic processing unit of the second core 109 has initialization processing and periodic processing, similar to the first core 108. However, the initialization processing of the second core 109 includes an initialization completion determination process 114 for notifying the completion of the initialization of the second core 109 to the initialization processing of the first core 108, and a notification function 118 for notifying the initialization completion notification of the second core 109 to the initialization processing of the first core 108. The periodic processing of the second core 109 has a periodic control 115. Here, in the second core 109, the initialization processing means the processing of initializing registers and the like of the second core 109, and the periodic processing means the periodic processing of various controls executed by the second core 109 after the initialization processing.

[0020] Also, the microprocessor 107 has a system timer 113 (described as a CPU timer in FIG. 1). The use of the system timer 113 will be described in FIG. 3 which will be described later.

[0021] In the microprocessor 107 of FIG. 1, when the initialization of the microprocessor 107 is executed, the initialization of the first core 108 is started. At this time, the first core 108 gives an instruction to initialize the second core 109 to the second core 109. In this way, it is configured to execute the initialization of the microprocessor 107.

[0022] Here, when the initialization processing of the first core 108 does not receive the initialization completion notification of the second core 109 from the notification function 118, the first reset process 110 of the initialization processing of the first core 108 transmits a reset request signal to the communication circuit 106 of the monitoring device 101 via, for example, the communication circuit 112. As a result, the output process 105 of the monitoring device 101 outputs a reset instruction REST to the reset control of the microprocessor 107 via the communication path 116, and causes the microprocessor 107 to perform a reset 121 such as a software reset.

[0023] Next, an example of the timing of the refresh instruction will be described using FIG. 2.

[0024] As shown in Figure 2, first, OS startup 304 is executed to start the OS (Operating system) of the first core (core 1) 108, and then OS startup 302 is instructed by the OS of the first core (core 1) 108 to start the OS of the second core (core 2) 109. After OS startup 304 of the first core 108 and OS startup 302 of the second core 109, initialization process 305 of the first core 108 is performed in the first core 108, and initialization process 303 of the second core 109 is executed in the second core 109.

[0025] Once the initialization process 303 of the second core 109 is completed, the second core 109 sends an initialization completion notification 308 to the first core 108.

[0026] The first core 108 receives an initialization completion notification 308 from the second core 109 and completes the initialization of the first core 108.

[0027] Once the initialization of the first core 108 is complete, the first core 108 proceeds to execute the periodic process 306.

[0028] After the OS startup 304 of the first core 108, the OS of the first core 108 performs watchdog timer activation 301 to activate the watchdog timer 104 of the monitoring device 101. This activates the watchdog timer 104 of the monitoring device 101, and monitoring for runaway behavior of the microprocessor 107, including the first core 108 and the second core 109, begins. In other words, the clock counting by the counter of the watchdog timer 104 starts from its initial value.

[0029] The watchdog timer 104, when activated, has an open period 311 that accepts refresh instructions and a closed period 312 that does not accept refresh instructions. The activated watchdog timer 104 first enters an open period 311 for a first predetermined fixed time, during which it becomes capable of accepting, for example, a refresh instruction 309. After the open period 311 (after the first fixed time has elapsed), it enters a closed period 312 for a second predetermined fixed time, and then enters an open period 311 again. In this manner, the open period 311 and the closed period 312 are repeated. When the watchdog timer 104 receives a refresh instruction 309, it is configured to refresh the counter's count value to an initial value, such as zero (also called clearing the count value). After that, the counter of the watchdog timer 104 restarts counting the clock from the initial value.

[0030] The periodic processing 306 of the first core 108 outputs a refresh instruction 310 only on the first occasion at the timing of the open period 311, based on the time information of the system timer 113 that was obtained when the watchdog timer 104 was activated 301.

[0031] After the initial refresh instruction 309 in the first core 108, the periodic processing 306 switches to outputting a refresh instruction 310 based on the number of times the periodic processing 306 has been executed.

[0032] Next, using the flowchart in Figure 3, we will explain the initialization process of the first core 108, the initialization process of the second core 109, the runaway monitoring process of the second core 109 by the first core 108, and the timing of the refresh instruction.

[0033] The watchdog timer 104 of the monitoring device 101 includes an enable / disable switching process 421, a refresh instruction reception process 422, and a clear process 423.

[0034] The enable / disable switching process 421 receives an enable instruction 402 from the first core 108 to enable the watchdog timer 104 and enables the watchdog timer 104. Conversely, upon receiving a disable instruction to disable the watchdog timer 104, it disables the watchdog timer 104. In short, the enable / disable switching process 421 is a process that enables the watchdog timer 104 to be enabled or disabled.

[0035] The refresh instruction reception process 422 is a process that receives a refresh instruction from the first core 108 to refresh the counter of the watchdog timer 104.

[0036] The clear process 423 executes a process to clear the count value of the watchdog timer counter to an initial value, such as zero, based on the refresh instruction received by the refresh instruction reception process 422.

[0037] The first core 108 (labeled Core 1 in Figure 3), which issues a refresh instruction to the watchdog timer 104, includes an FBL 404 performed after startup, an OS startup process 405 that starts the OS of the first core 108, and a first CPU timer acquisition process 406 that acquires time information (first time information) of the CPU timer 113, which is performed before the start of the initialization process 407 of the first core 108. The first core 108 further includes an initialization process 407 of the first core 108, and a second CPU timer acquisition process 408 that acquires time information (second time information) of the CPU timer 113 after the initialization process 407 of the first core 108. After the initialization process 407 of the first core 108 is completed, the first core 108 has a function to start a loop process (408-412) to wait for the initialization process of the second core 109 to be completed, without performing the periodic processing 413 until an initialization completion notification 418 is received from the second core 109 (labeled as core 2 in Figure 3).

[0038] The second core 109 includes an OS startup process 415 that starts the OS of the second core 109 based on instructions from the OS of the first core 108, an initialization process 416 of the second core 109 that is executed after the OS startup process 415, and a periodic process 417 that is executed after the initialization process 416 of the second core 109. The initialization process 416 of the second core 109 is configured to share information by outputting an initialization completion notification 418 to the OS of the first core 108 via inter-core communication (communication using the communication path between communication circuit 112 and communication circuit 106) when the initialization of the second core 109 is completed.

[0039] The loop processing of the first core 108 (408-412) has the following processing:

[0040] Process 408: As explained earlier, process 408 is a second CPU timer acquisition process that acquires time information (second time information) of the CPU timer 113 after the initialization process 407 of the first core 108.

[0041] Process 409: Process 409 is a decision process that determines whether or not an initialization completion notification 418 has been received from the second core 109. If the initialization completion notification 418 has been received (YES), the process proceeds to periodic process 413. If the initialization completion notification 418 has not been received (NO), the process proceeds to process 410.

[0042] Process 410: Process 410 is a determination process that determines whether the difference between the time information of the CPU timer 113 (first time information) obtained in the first CPU timer acquisition process 406 and the time information of the CPU timer 113 (second time information) obtained in the second CPU timer acquisition process 408 (second time information) exceeds a specified time. Here, the specified time is, for example, 10 seconds. This specified time is set as the time for determining whether the second core 109 has malfunctioned. In other words, process 410 is a process (core 2 initialization malfunction monitoring 419) for monitoring malfunctions in the initialization process of the second core 109.

[0043] Therefore, if the time difference (second time information - first time information) does not exceed the specified time (NO), the process proceeds to 411. On the other hand, if the time difference (second time information - first time information) exceeds the specified time (YES), the first reset process 110 of the initialization process of the first core 108 determines that the second core 109 has malfunctioned and sends a reset request signal 425 to the communication circuit 106 of the monitoring device 101 via the communication circuit 112, for example. As a result, the output process 105 of the monitoring device 101 outputs a reset instruction REST to the reset control of the microprocessor 107 via the communication path 116, causing the microprocessor 107 to perform a reset 121, such as a software reset.

[0044] Process 411: Process 411 determines whether a periodic refresh instruction is needed for the watchdog timer 104. If a refresh instruction is needed (YES), the process proceeds to process 412. Process 411 is a process for generating a periodic refresh instruction when the initialization of the second core 109 is extended (periodic refresh instruction 420 when core 2 initialization is extended).

[0045] Process 412: Process 412 instructs the first core 108 to perform a refresh instruction process, outputting a refresh instruction to the watchdog timer 104 refresh instruction receiving process 422 during the watchdog timer 104's open period. The refresh instruction receiving process 422, upon receiving the refresh instruction, issues a refresh instruction to the clear process 423. The clear process 423 then executes a process to clear the watchdog timer's counter to an initial value, such as zero, based on the refresh instruction received by the refresh instruction receiving process 422. This refreshes the watchdog timer 104's counter.

[0046] After the refresh instruction process, the processing of the first core 108 moves to process 408, and the loop processing (408-412) is executed again.

[0047] The loop process (408-412) terminates under the following two conditions: 1) Initialization process completion notification 418 is received from the initialization process 416 of the second core 109. 2) When the difference time (second time information - first time information) is compared with the specified time (specified time 10s) and it is determined that a runaway operation has occurred in the second core 109 (difference time > specified time 10s).

[0048] The key features of the flowchart in Figure 3 can be summarized as follows:

[0049] 1) After the first core 108 and the second core 109 have completed their respective initialization processes 407 and 416, they perform a synchronization process 409. If the initialization process of the second core 109 is still ongoing after the initialization of the first core 108 is complete, the first core 108 performs a refresh process 412 for the watchdog timer 104 counter. This feature prevents false detection of a malfunction, even if the initialization processes of multiple cores have different processing times, by allowing the first core 108 to continue instructing the monitoring device 101 to refresh until the initialization process is complete.

[0050] 2) For the watchdog timer 104, which alternates between open and closed periods, the first core 108 can be adjusted to issue a refresh command during the open period to prevent false detection of a malfunction. The first core 108 is not particularly restricted, but is configured to recognize the open period of the watchdog timer 104 based on the time information (first time information) of the CPU timer 113 acquired in the first CPU timer acquisition process 406, and to output multiple refresh commands targeting the open period.

[0051] 3) In the above 2), the first core 108 can monitor for runaway behavior over a longer period with fewer refresh commands by issuing a refresh command just before the end of the open period of the watchdog timer, which repeats open and closed periods.

[0052] 4) Since a loop process (408-412) is provided after the initialization process 407 of the first core 108, a malfunction of the first core 108 can be reliably monitored. In other words, if the first core 108 malfunctions, the process does not proceed to the loop process (408-412), so no refresh instruction is issued to the watchdog timer 104. Therefore, the monitoring device 101 can instruct the microprocessor 107 to reset.

[0053] 5) In Figure 3, the same time threshold (monitoring time threshold 103 in Figure 1) is used for monitoring the runaway of the first core 108 during initialization and periodic processing. In this example, the monitoring time threshold 103 is, for example, 35ms. The monitoring time threshold 103 is the determination value for count value overflow when the watchdog timer 104 counter is an up counter, and this determination value is used as the determination value for a reset instruction. In the case of an up counter, the count value is reset to its initial value (zero) by refreshing the counter. Also, when the watchdog timer 104 counter is a down counter, the monitoring time threshold 103 is set to its initial value, and count value underflow (zero) is used as the determination value for a reset instruction. Therefore, since a method of increasing the runaway detection time of the runaway monitoring device during the initialization process of multiple cores is not adopted, the extra communication processing between the microprocessor and the runaway monitoring device that was necessary to set a long runaway detection time for the runaway monitoring device becomes unnecessary.

[0054] 6) If the second core 109 malfunctions during initialization (416), the refresh process (412) will prevent a reset until a specified time (e.g., 10s) has elapsed. If the specified time (10s) is exceeded (YES in 410), the reset process will be performed. The specified time (10s) is longer than the reset threshold (e.g., monitoring time threshold 103 = 35ms).

[0055] 7) When the initialization of the second core 109 is completed, an initialization completion notification 418 is sent to the first core 108 via intercore communication between the first core 108 and the second core 109, so that the first core 108 can determine whether or not the initialization process of the second core 109 is still ongoing.

[0056] The present invention has been described in detail above based on examples, but it goes without saying that the present invention is not limited to the above embodiments and examples and can be modified in various ways. [Explanation of symbols]

[0057] 100: Electronic control unit 101: Monitoring device 104: Watchdog Timer 107: Microprocessor 108: First Core 109: Second Core 113: CPU Timer (System Timer)

Claims

1. Runaway vehicle monitoring device, A microprocessor connected to the runaway monitoring device, including a first core and a second core different from the first core, An electronic control device including, The runaway monitoring device has a counter, and the counter is configured to monitor runaway behavior of the first core and the second core during the initialization of the microprocessor using the same runaway monitoring time threshold as the periodic processing. An electronic control device in which, when the initialization process of the first core has finished and the initialization process of the second core is continuing, the first core sends a refresh instruction to the runaway monitoring device to refresh the count value of the counter before the threshold of the runaway monitoring time has elapsed.

2. In the electronic control device according to claim 1, The runaway monitoring device has an open period for accepting the refresh instruction and a closed period for not accepting the refresh instruction. The refresh instruction output from the first core is an electronic control device output during the open period of the runaway monitoring device.

3. In the electronic control device according to claim 2, The first core has a loop process for waiting to receive an initialization completion notification from the second core. The loop processing includes a process in which, when the first core has not yet received the initialization completion notification from the second core, and the open period of the runaway monitoring device changes to the closed period, the first core outputs the refresh instruction to the runaway monitoring device before switching to the closed period.

4. In the electronic control device according to claim 3, An electronic control device which, if the first core malfunctions during initialization, the loop process cannot be executed and the refresh instruction cannot be output, and therefore the malfunction monitoring device outputs a reset to the microprocessor.

5. In the electronic control device according to claim 1, The first core is an electronic control device that, if the output of the refresh instruction continues for a specified time, determines that the initialization process of the second core has run out of control and outputs a reset instruction to the microprocessor.

6. In the electronic control device according to claim 1, The microprocessor is an electronic control device having a communication mechanism for performing intercore communication between the first core and the second core.

Images