In-vehicle device, information processing method, and computer program

Abstract

To provide an in-vehicle device or the like capable of efficiently exchanging communication data between a plurality of virtual devices.SOLUTION: An in-vehicle device includes: a control unit for generating a plurality of virtual devices which serve as program operation environments; and a storage unit for storing a virtualized operating system activated by the control unit. The virtual device includes a communication buffer to which the storage unit divided in terms of area is allocated, and writes communication data to another virtual device in the communication buffer of the own virtual device when performing communication with the other virtual device. A management unit that manages the plurality of virtual devices reads the communication data written in the communication buffer of the virtual device, writes the read communication data in a storage region accessible by the management unit, and writes the communication data written in the storage region in a communication buffer of the other virtual device. The other virtual device reads the communication data from the virtual device that has been written in the communication buffer of the own virtual device.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present disclosure relates to an in-vehicle device, an information processing method, and a computer program. [Background technology]

[0002] There is known an electronic control device that is mounted on a vehicle and processes information relating to control of devices mounted on the vehicle, external communication, and driving control such as autonomous driving (for example, Patent Document 1). The electronic control device of Patent Document 1 includes a multi-core CPU (Central Processing Unit) having multiple cores. Multiple program systems run on the multi-core CPU. The above electronic control device is equipped with a hypervisor as a component of functions realized by executing programs. The above electronic control device uses the hypervisor to create multiple virtual devices on the multi-core CPU and run them in parallel, and runs an OS (Operation System) on the created virtual devices. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2019-179397 A Summary of the Invention [Problem to be solved by the invention]

[0004] In the electronic control device of Patent Document 1, communication between multiple virtual devices may occur via a storage unit such as a memory provided in the electronic control device. In the above communication, communication data is exchanged between the multiple virtual devices by the source virtual device writing communication data to the storage unit and the destination virtual device reading the communication data written in the storage unit. At this time, communication data may be read while it is being written to the storage unit, which may cause a so-called access conflict, and this may result in inefficient communication between the multiple virtual devices.

[0005] The present disclosure has been made in consideration of the above circumstances, and has an object to provide an in-vehicle device or the like that can efficiently transmit and receive communication data between a plurality of virtual devices. [Means for solving the problem]

[0006] An in-vehicle device according to one aspect of the present disclosure includes a control unit that executes a plurality of programs, and a memory unit in which a virtualized operating system that is launched by the control unit is stored. By launching the virtualized operating system, a plurality of virtual devices that serve as an operating environment for the programs are generated, and the virtual devices each include a communication buffer in which communication data exchanged in communication between the plurality of virtual devices is written, and when communicating with another virtual device, the communication data for the other virtual device is written to the communication buffer of the own virtual device. A management unit that manages the plurality of virtual devices reads the communication data written to the communication buffer of the virtual device during a period when the virtual device is not operating, and writes the read communication data to a memory area accessible by the management unit. During a period when the other virtual device to which the communication data is to be sent is not operating, the communication data written to the memory area is written to the communication buffer of the other virtual device, and the other virtual device reads the communication data from the virtual device that was written to the communication buffer of the own virtual device. Effect of the Invention

[0007] According to one aspect of the present disclosure, communication data can be efficiently exchanged between a plurality of virtual devices. [Brief description of the drawings]

[0008] [Figure 1] 1 is a schematic diagram illustrating a configuration of an in-vehicle system according to a first embodiment. [Diagram 2] FIG. 2 is a block diagram illustrating a physical configuration of an in-vehicle ECU. [Diagram 3] FIG. 2 is a block diagram illustrating a logical configuration of an in-vehicle ECU. [Figure 4] FIG. 2 is a schematic diagram illustrating a configuration of a transmission buffer. [Diagram 5] FIG. 2 is a schematic diagram illustrating a configuration of a receiving buffer. [Figure 6] FIG. 2 is an explanatory diagram showing an example of communication between a plurality of virtual ECUs; [Figure 7] 10 is a flowchart illustrating a process performed by a third arithmetic unit functioning as a management unit, and a process related to generation of a virtual ECU performed by a arithmetic unit assigned to the virtual ECU. [Figure 8] 11 is a flowchart illustrating a process performed by a third arithmetic device functioning as a management unit of the second embodiment, and a process related to generation of a virtual ECU performed by a arithmetic device assigned to the virtual ECU of the second embodiment. [Figure 9] FIG. 11 is a block diagram illustrating a logical configuration of an in-vehicle ECU according to a third embodiment. [Figure 10] FIG. 11 is an explanatory diagram showing an example of access restrictions to a communication buffer and a storage area. [Figure 11] FIG. 11 is an explanatory diagram showing an example of communication between a plurality of virtual ECUs according to a third embodiment. [Figure 12] 11 is a flowchart of a main routine illustrating processing performed by a computing device of embodiment 3. [Figure 13] 6 is a flowchart illustrating a processing procedure of a computing device relating to a subroutine of processing of a virtual ECU. [Figure 14]11 is a flowchart illustrating a processing procedure of a computing device relating to a subroutine of processing of a management unit. [Figure 15] FIG. 13 is a conceptual diagram illustrating the contents of an address table. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] [Description of the embodiments of the present disclosure] First, embodiments of the present disclosure will be listed and described. In addition, at least some of the embodiments described below may be arbitrarily combined.

[0010] (1) An in-vehicle device according to one embodiment of the present disclosure includes a control unit that executes a plurality of programs, and a storage unit in which a virtualized operating system launched by the control unit is stored. By launching the virtualized operating system, a plurality of virtual devices that serve as an operating environment for the programs are generated, and the virtual devices each include a communication buffer in which communication data exchanged in communication between the plurality of virtual devices is written, and when communicating with another virtual device, the communication data for the other virtual device is written to the communication buffer of the own virtual device. A management unit that manages the plurality of virtual devices reads the communication data written to the communication buffer of the virtual device during a period when the virtual device is not operating, and writes the read communication data to a storage area accessible by the management unit. During a period when the other virtual device, which is a destination of the communication data, is not operating, the communication data written to the storage area is written to the communication buffer of the other virtual device, and the other virtual device reads the communication data from the virtual device that was written to the communication buffer of the own virtual device.

[0011] In this aspect, the control unit starts the virtualized operating system, thereby generating a plurality of virtual devices. The virtual device includes, for example, a virtual control unit to which the control unit is time-shared and periodically assigned, and a communication buffer. The plurality of virtual devices are managed by a management unit. The management unit corresponds to a process generated when executing a management program for managing the virtual devices generated by the virtualized operating system. When one of the plurality of virtual devices communicates with another virtual device, the one virtual device writes communication data to be transmitted to the other virtual device in the communication buffer of the one virtual device. During a period when the one virtual device is not operating, for example, during a period when the virtual control unit of the one virtual device is not assigned to the control unit, the management unit reads the communication data written in the communication buffer of the one virtual device. The management unit writes the read communication data in a storage area. During a period when the other virtual device to which the communication data is to be transmitted is not operating, for example, during a period when the virtual control unit of the other virtual device is not assigned to the control unit, the management unit writes the communication data written in the storage area in the communication buffer of the other virtual device. The other virtual device reads the communication data written in the communication buffer of the other virtual device. In the communication buffer of one virtual device, communication data transmitted from another virtual device to the one virtual device is written via a storage area. The one virtual device reads the communication data from the other virtual device that is written in the communication buffer of the one virtual device. The transfer of communication data between the one virtual device and the other virtual device is performed by the management unit via a storage area. In other words, communication between the one virtual device and the other virtual device is performed via a storage area. Since the transfer of communication data is performed by the management unit via a storage area, while the one virtual device is writing communication data to the communication buffer, the other virtual device will not read the communication data. Since the management unit writes and reads communication data during a period when the virtual device is not operating, there is no conflict between the writing of communication data to the communication buffer by the virtual device and the reading of communication data from the communication buffer by the management unit. In addition, there is no conflict between the writing of communication data to the communication buffer by the management unit and the reading of communication data from the communication buffer by the virtual device.Therefore, since communication data can be appropriately exchanged between multiple virtual devices without contention in the writing and reading of communication data, communication data can be efficiently exchanged between multiple virtual devices.

[0012] (2) In one embodiment of the in-vehicle device of the present disclosure, the control unit includes a plurality of arithmetic units, one of the plurality of arithmetic units functions as the management unit, and the remaining of the plurality of arithmetic units function as the virtual devices.

[0013] In this embodiment, the control unit includes a plurality of arithmetic units. For example, when the control unit is a multi-core CPU having a plurality of cores, the arithmetic units are cores. Of the plurality of arithmetic units, one arithmetic unit functions as a management unit. Of the plurality of arithmetic units, a virtual unit is generated in the remaining arithmetic units. The remaining arithmetic units function as the generated virtual unit. In the exchange of communication data between the plurality of virtual units, the management unit of one arithmetic unit writes communication data to be written in the communication buffer of the source virtual unit to a storage area. The management unit reads the communication data written in the storage area from the storage area, and writes the communication data to the communication buffer of the destination virtual unit. Since the management unit of one arithmetic unit writes and reads communication data to and from the storage area, the exchange of communication data between the plurality of virtual units can be performed without contention between writing and reading communication data to and from the storage area.

[0014] (3) In one embodiment of the in-vehicle device of the present disclosure, the control unit includes a plurality of arithmetic devices, each of which functions as the management unit and as the virtual device, and which periodically switches between a period during which it functions as the management unit and a period during which it functions as the virtual device, and a period during which one of the plurality of arithmetic devices functions as the management unit does not overlap with a period during which another of the plurality of arithmetic devices functions as the management unit.

[0015] In this aspect, the control unit includes a plurality of arithmetic devices. Each of the arithmetic devices periodically switches between a period in which it functions as a management unit and a period in which it functions as a virtual device. During the period in which the arithmetic device functions as a virtual device, a virtual device is generated in the arithmetic device. The arithmetic device also functions as the generated virtual device. During the period in which the arithmetic device functions as a management unit, the arithmetic device functions as a management unit, and writes and reads communication data to and from the communication buffer, and writes and reads communication data to and from the storage area, as described above. The period in which the arithmetic device functions as a management unit and the period in which the arithmetic device functions as a virtual device are switched is set for each arithmetic device so that the period in which one arithmetic device functions as a management unit does not overlap with the period in which another arithmetic device functions as a management unit. Since the period in which one arithmetic device functions as a management unit does not overlap with the period in which another arithmetic device functions as a management unit, communication data can be exchanged between the plurality of virtual devices without contention in writing and reading communication data to and from the storage area.

[0016] (4) In an in-vehicle device according to one embodiment of the present disclosure, one of the arithmetic devices functions as the management unit that manages the virtual devices generated in the one of the arithmetic devices, the management unit that manages the virtual devices generated in the one of the arithmetic devices can access the communication buffer and the memory area of ​​the virtual devices generated in the one of the arithmetic devices and cannot access the communication buffers of the virtual devices generated in the other of the arithmetic devices, and the virtual devices can access the communication buffers of their own virtual device and cannot access the communication buffers and the memory areas of the other virtual devices.

[0017] In this embodiment, one or more virtual devices are generated in each arithmetic device. One of the plurality of arithmetic devices functions as a virtual device generated in the one arithmetic device. The one arithmetic device also functions as a management unit that manages the virtual devices generated in the one arithmetic device. When the one arithmetic device functions as a management unit, the management unit can access the communication buffer and the storage area of ​​the one or more virtual devices generated in the one arithmetic device. The management unit cannot access the communication buffer of the virtual device generated in the other arithmetic devices other than the one arithmetic device. The management unit can prevent the management unit from erroneously writing and reading communication data to the communication buffer of the virtual device generated in the other arithmetic device. Among the plurality of virtual devices generated in the plurality of arithmetic devices, one virtual device can access the communication buffer of the one virtual device, but cannot access the communication buffer and the storage area of ​​the other virtual devices among the plurality of virtual devices generated. The one virtual device can be prevented from erroneously writing communication data to the communication buffer of the other virtual device. The one virtual device can also be prevented from erroneously reading communication data written in the communication buffer of the other virtual device. By restricting the access to the communication buffer by the virtual device and the management unit as described above, it is possible to prevent communication data from being erroneously written to an unintended communication buffer and to prevent communication data from being erroneously read from the communication buffer. Since the storage area is accessible only by the management unit, it is possible to prevent the virtual device from erroneously writing and reading communication data to and from the storage area.

[0018] (5) In one embodiment of the in-vehicle device of the present disclosure, the communication buffer includes a receive buffer into which the communication data received by the virtual device is written, and when a receive buffer update flag indicating that the communication data written to the receive buffer has been updated is in an on state, the virtual device reads the communication data written to the receive buffer, and after reading the communication data, changes the receive buffer update flag from an on state to an off state.

[0019] In this embodiment, each communication buffer includes a receive buffer in which communication data received by the virtual device is written. A receive buffer update flag is provided in each receive buffer. When the receive buffer update flag is in an off state, the communication data in the receive buffer has not been updated. When the receive buffer update flag is in an on state, the communication data in the receive buffer has been updated, and new communication data has been written in the receive buffer. When the receive buffer update flag of the receive buffer of the virtual device is in an on state, the virtual device reads the new communication data written in the receive buffer. After reading the communication data, the virtual device changes the receive buffer update flag from an on state to an off state, so that it is possible to prevent the read communication data from being read again. The virtual device can appropriately acquire the newly transmitted communication data by reading the communication data written in the receive buffer based on the receive buffer update flag.

[0020] (6) In an in-vehicle device according to one aspect of the present disclosure, the communication buffer includes a transmission buffer into which communication data to be transmitted by the virtual device to the other virtual device is written, and after the virtual device writes the communication data to the transmission buffer, the virtual device turns on a transmission buffer update flag indicating that the communication data written to the transmission buffer has been updated, and when the transmission buffer update flag is on, the management unit writes the communication data written in the transmission buffer of the virtual device to the memory area, and after writing the communication data to the memory area, changes the transmission buffer update flag from on to off, and further turns on a memory area update flag indicating that the communication data written to the memory area has been updated, and when the memory area update flag is on, writes the communication data written in the memory area to the reception buffer of the other virtual device, and after writing the communication data to the reception buffer, turns on the reception buffer update flag, and further changes the memory area update flag from on to off.

[0021] In this aspect, each communication buffer includes a transmission buffer in which communication data to be transmitted from a virtual device to another virtual device is written. A transmission buffer update flag is provided in each transmission buffer. When the transmission buffer update flag is in an off state, the communication data in the transmission buffer has not been updated. When the transmission buffer update flag is in an on state, the communication data in the transmission buffer has been updated, and new communication data has been written in the transmission buffer. After writing new communication data in the transmission buffer of the virtual device, the virtual device sets the transmission buffer update flag of the transmission buffer to an on state. When the transmission buffer update flag is in an on state, the management unit reads the new communication data written in the transmission buffer and writes the read communication data to a storage area. A storage area update flag is provided in the storage area. When the storage area update flag is in an off state, the communication data in the storage area has not been updated. When the storage area update flag is in an on state, the communication data in the storage area has been updated, and new communication data has been written in the storage area. After writing the new communication data to the storage area, the management unit changes the transmission buffer update flag from an on state to an off state, and further sets the storage area update flag to an on state. When the storage area update flag is in an on state, the management unit reads new communication data written in the storage area and writes the read communication data to the receive buffer of the destination virtual device. After writing the communication data to the receive buffer, the management unit sets the receive buffer update flag of the receive buffer to an on state, and further changes the storage area update flag from an on state to an off state. As described above, the destination virtual device reads new data written to the receive buffer of the virtual device based on the receive buffer update flag. When the transmit buffer update flag is in an on state, the communication data written to the transmit buffer is read, so that it is possible to prevent conflicts between writing and reading communication data in the transmit buffer. After writing communication data to the receive buffer, the management unit sets the storage area update flag to an off state, so that the management unit can determine communication data that has been written to the storage area and has not been written to the receive buffer.Since the management unit turns on the receive buffer update flag after writing the communication data to the receive buffer, it is possible to prevent contention between writing and reading of communication data in the receive buffer.

[0022] (7) In an in-vehicle device according to one aspect of the present disclosure, the communication buffer includes a transmission buffer into which the communication data to be transmitted by the virtual device to the other virtual device is written, and after the virtual device writes the communication data to the transmission buffer, the virtual device updates a transmission buffer count value indicating the number of times the communication data has been written to the transmission buffer, and if the transmission buffer count value is different from a storage area count value indicating the number of times the communication data has been written to the storage area, the management unit writes the communication data written in the transmission buffer of the virtual device to the storage area, and after writing the communication data to the storage area, updates the storage area count value to a value equal to the transmission buffer count value, and if the storage area count value is different from a reception buffer count value indicating the number of times the communication data has been written to the reception buffer, the management unit writes the communication data written in the storage area to the reception buffer of the other virtual device, and after writing the communication data to the reception buffer, updates the reception buffer count value to a value equal to the storage area count value, and further turns on the reception buffer update flag.

[0023] In this embodiment, each communication buffer includes a transmission buffer. The transmission buffer is provided with a transmission buffer count value. The storage area is provided with a storage area count value. The reception buffer is provided with a reception buffer count value. The transmission buffer count value, the storage area count value, and the reception buffer count value are each provided for an identifier of communication data, such as a message ID. The source virtual device updates the transmission buffer count value after writing communication data to the transmission buffer of the virtual device. For example, the above virtual device increments the transmission buffer count value of the identifier related to the above communication data by 1. When the transmission buffer count value and the storage area count value are different, the management unit writes the above communication data written in the transmission buffer to the storage area. When the transmission buffer count value and the storage area count value are different, this is the case when the transmission buffer count value and the storage area count value corresponding to the same identifier are different. After writing the communication data to the storage area, the management unit updates the storage area count value to the same value as the transmission buffer count value. When the storage area count value and the reception buffer count value are different, the management unit writes the communication data written in the storage area to the reception buffer of the destination virtual device. When the storage area count value and the reception buffer count value are different, the storage area count value and the reception buffer count value corresponding to the same identifier are different. After writing the communication data to the reception buffer, the management unit updates the reception buffer count value to the same value as the storage area count value and sets the reception buffer update flag to an ON state. Based on the reception buffer update flag, the destination virtual device reads new data written in the reception buffer of the virtual device. Based on the transmission buffer count value and the storage area count value, the communication data written in the transmission buffer is read, so that it is possible to prevent contention between writing and reading the communication data in the transmission buffer. Since the management unit updates the storage area count value after writing the communication data to the storage area, it is possible to prevent contention between writing and reading the communication data in the storage area.After writing communication data to the receive buffer, the management unit updates the receive buffer count value and sets the receive buffer update flag to the on state, thereby preventing contention between writing and reading communication data in the receive buffer.

[0024] (8) In one embodiment of the in-vehicle device of the present disclosure, the communication buffer includes a program execution memory area for executing the program, and the management unit writes the communication data written to the memory area to the program execution memory area of ​​the destination virtual device.

[0025] In this embodiment, the communication buffer includes a program execution memory area for executing a program. The program execution memory area is a so-called variable area, and is provided for each virtual device. The program execution memory area is indicated by a logical address. When a program is executed, communication data is written to the program execution memory area. The management unit writes the communication data written in the memory area to the program execution memory area of ​​the destination virtual device. Since the management unit writes the communication data directly to the program execution memory area, the virtual device does not need to perform processing to write the communication data to the program execution memory area. Therefore, the processing performed by the virtual device can be reduced.

[0026] (9) An information processing method according to one aspect of the present disclosure generates, in an in-vehicle device, a plurality of virtual devices that serve as operating environments for a plurality of programs, and when one of the virtual devices communicates with another virtual device, writes communication data for the other virtual device to a communication buffer included in the virtual device in which the communication data exchanged in communications between the plurality of virtual devices is written, and during a period in which the virtual device is not operating, reads the communication data written in the communication buffer of the virtual device, and writes the read communication data to a memory area, and during a period in which the other virtual device to which the communication data is to be sent is not operating, writes the communication data written in the memory area to the communication buffer of the other virtual device, and reads the communication data from the virtual device that was written in the communication buffer of the other virtual device.

[0027] In this embodiment, as in embodiment (1), data can be exchanged appropriately without contention between multiple virtual devices, so that communication data can be exchanged efficiently between multiple virtual devices.

[0028] (10) A computer program according to one aspect of the present disclosure is a computer program for causing a computer mounted on a vehicle to execute processing, the computer generating a plurality of virtual devices that serve as operating environments for a plurality of programs, and, when one of the virtual devices communicates with another virtual device, writing communication data for the other virtual device to a communication buffer included in the virtual device in which the communication data exchanged in communications between the plurality of virtual devices is written, and, during a period in which the virtual device is not operating, reading the communication data written in the communication buffer of the virtual device, writing the read communication data to a memory area, and, during a period in which the other virtual device to which the communication data is to be sent is not operating, writing the communication data written in the memory area to the communication buffer of the other virtual device, and reading the communication data from the virtual device that has been written to the communication buffer of the other virtual device.

[0029] In this aspect, a computer can function as the in-vehicle device according to one aspect of the present disclosure.

[0030] [Details of the embodiment of the present disclosure] The present disclosure will be specifically described based on the drawings showing the embodiments. An in-vehicle device according to the embodiment of the present disclosure will be described below with reference to the drawings. Note that the present disclosure is not limited to these examples, but is indicated by the claims, and is intended to include all modifications within the meaning and scope equivalent to the claims.

[0031] (Embodiment 1) Hereinafter, an embodiment will be described with reference to the drawings. Fig. 1 is a schematic diagram illustrating a configuration of an in-vehicle system S according to the embodiment 1. The in-vehicle system S includes a plurality of in-vehicle ECUs 2 mounted on a vehicle C. In-vehicle devices 3 are connected to the in-vehicle ECUs 2.

[0032] The multiple on-vehicle ECUs 2 may include an integrated on-vehicle ECU 2 (integrated ECU) that controls the entire vehicle C, and individual on-vehicle ECUs 2 (individual ECUs) that are communicatively connected to the integrated on-vehicle ECU 2 and directly connected to on-vehicle equipment 3. The integrated on-vehicle ECU 2 may be communicatively connected to an external server (not shown) that is connected to an external network such as the Internet, via an external communication device (not shown). The on-vehicle ECU 2 corresponds to an on-vehicle device.

[0033] In Fig. 1, an integrated in-vehicle ECU 2 and a plurality of individual in-vehicle ECUs 2 are communicatively connected by an in-vehicle network 4 that forms a star-shaped network topology. The integrated in-vehicle ECU 2 is provided at the center of the star-shaped network topology. The network topology in the in-vehicle system S is not limited to the above example. The in-vehicle system S may be configured such that adjacent individual in-vehicle ECUs 2 are connected to each other to form a loop-shaped network topology, enabling bidirectional communication and achieving redundancy.

[0034] The individual in-vehicle ECU 2 is disposed in each area of ​​the vehicle C and is connected to a plurality of in-vehicle devices 3. The individual in-vehicle ECU 2 transmits and receives signals or data to and from the in-vehicle devices 3 connected thereto. The individual in-vehicle ECU 2 also communicates with the integrated in-vehicle ECU 2. The individual in-vehicle ECU 2 may be a relay control ECU that functions as an in-vehicle relay device such as a gateway or an Ether switch that relays communication between the plurality of in-vehicle devices 3 connected to the individual in-vehicle ECU 2, or communication between the in-vehicle device 3 and another in-vehicle ECU 2. In addition to relaying communication, the individual in-vehicle ECU 2 may also function as a power distribution device that distributes and relays power output from a power storage device and supplies it to the in-vehicle devices 3 connected to the individual in-vehicle ECU.

[0035] The in-vehicle device 3 includes, for example, an actuator 30 such as a door opening / closing device and a motor device, and various sensors 31 such as a LiDAR (Light Detection and Ranging), a light sensor, a CMOS camera, and an infrared sensor. The in-vehicle device 3 is not limited to the above examples, and may be a switch such as a door switch (switch) and a lamp switch, or may be a lamp.

[0036] The integrated vehicle ECU 2 is a central control device such as a vehicle computer. The integrated vehicle ECU 2 generates and outputs a control signal to each vehicle device 3 based on data from the vehicle device 3 relayed via another vehicle ECU 2 such as an individual vehicle ECU 2. The integrated vehicle ECU 2 generates a control signal for controlling the actuator 30 that is the target of the request signal based on information or data such as a request signal output from the other vehicle ECU 2, and outputs the generated control signal to the other vehicle ECU 2. In this embodiment, the vehicle system S is configured by the integrated vehicle ECU 2 and the individual vehicle ECU 2, but the vehicle system S is not limited to the configuration of the integrated vehicle ECU 2 and the individual vehicle ECU 2. The vehicle system S may be configured by a plurality of vehicle ECUs 2 connected peer-to-peer by a relay device such as a CAN (Controller Area Network) gateway or an Ethernet switch.

[0037] 2 is a block diagram illustrating a physical configuration of the vehicle-mounted ECU 2. The vehicle-mounted ECU 2 includes a control unit 20, a storage unit 21, and an in-vehicle communication unit 22. The control unit 20 is configured with an arithmetic processing device such as a CPU or an MPU (Micro Processing Unit). The control unit 20 reads out and executes a control program P and data previously stored in the storage unit 21 to perform various control processes and arithmetic processes. The control unit 20 includes, for example, a single-core single CPU, a single-core multiple CPU, a multi-core single CPU, and a multi-core multiple CPU. The control unit 20 is not limited to only a software processing unit that performs software processing such as a CPU, but may also include a hardware processing unit that performs various control processes and arithmetic processes by hardware processing such as an FPGA, an ASIC, or an SOC.

[0038] The control unit 20 includes an arithmetic unit 200 configured by, for example, one core of a CPU. In this embodiment, an example will be described in which the control unit 20 is a triple-core CPU. The control unit 20 has three cores since it is a triple-core. The control unit 20 includes three arithmetic units 200: a first arithmetic unit 201 configured by a first core, a second arithmetic unit 202 configured by a second core, and a third arithmetic unit 203 configured by a third core. The number of arithmetic units 200 is not limited to three.

[0039] The storage unit 21 is configured by a volatile memory element such as a random access memory (RAM) or a non-volatile memory element such as a read only memory (ROM), an electrically erasable programmable ROM (EEPROM), or a flash memory. The storage unit 21 may be configured by a combination of storage devices such as the above-mentioned volatile memory element and the non-volatile memory element. The storage unit 21 stores a control program P and data to be referenced during processing in advance. The control program P includes a plurality of programs, such as a program for controlling various in-vehicle devices 3, or a program for performing target recognition for performing automated driving based on output data from a LiDAR or a CMOS camera. These programs are also referred to as applications. Furthermore, the storage unit 21 of the in-vehicle ECU 2 stores a virtualized operating system, such as a Hypervisor or Xen.

[0040] The control program P stored in the storage unit 21 may be a control program P read from a recording medium A readable by the in-vehicle ECU 2. The control program P may also be a program downloaded from an external computer (not shown) connected to a communication network (not shown) and stored in the storage unit 21. The control program P corresponds to a computer program.

[0041] The in-vehicle communication unit 22 is an input / output interface using a communication protocol such as CAN (Controller Area Network) or Ethernet (registered trademark). The control unit 20 communicates with other in-vehicle ECUs 2 connected to the in-vehicle network 4 via the in-vehicle communication unit 22.

[0042] FIG. 3 is a block diagram illustrating a logical configuration of the in-vehicle ECU 2. As described above, the storage unit 21 of the in-vehicle ECU 2 stores a virtualized operating system such as Hypervisor or Xen. The control unit 20 of the in-vehicle ECU 2 can build a plurality of virtual ECUs 5 on the virtualized operating system by starting the control unit 20 of the in-vehicle ECU 2 using the virtualized operating system. Programs for controlling various in-vehicle devices 3 are executed using one of the plurality of virtual ECUs 5 as an operating environment. That is, these programs are executed on one of the virtual ECUs 5. When the virtual ECU 5 executes a program, a single or a plurality of tasks are generated according to the processing content of the program. The tasks execute processing units that are further subdivided or divided.

[0043] In this embodiment, an example will be described in which the virtualization method is a hypervisor method in which a virtualized operating system directly accesses hardware resources such as the control unit 20, but the virtualization method is not limited to the hypervisor method. For example, the virtualization method may be a host OS method in which an operating system such as Linux (registered trademark) is interposed between the virtualized operating system and the hardware resources. In addition, the virtualization method may be one that uses a container-based virtualized operating system.

[0044] The in-vehicle ECU 2 started up using the virtualized operating system can construct multiple virtual ECUs 5 by the function of the virtualized operating system. Hardware resources such as a control unit 20 and a storage unit 21 provided in the in-vehicle ECU 2 are assigned to the multiple virtual ECUs 5. For example, the virtual ECU 5 includes a virtual control unit 5a assigned to the control unit 20, a virtual storage unit (not shown) assigned to the storage unit 21, and a virtual in-vehicle communication unit (not shown) assigned to the in-vehicle communication unit 22. The virtual ECU 5 corresponds to a virtual device.

[0045] A guest OS such as Ubuntu (registered trademark) is stored in each virtual memory unit of the virtual ECU 5, and each virtual ECU 5 starts the guest OS and executes a program on the guest OS. The guest OS may be a different type of OS depending on each virtual ECU 5. As described above, the virtual memory unit is actually a storage area of ​​the storage unit 21 assigned to each virtual ECU 5, so it goes without saying that the guest OS is also stored in the storage unit 21 in the same way as the virtualized operating system. When using a container-based virtualized operating system, a guest OS may be unnecessary, and a container may be generated on the virtualized operating system, and a program may be executed on the container. In this case, the container corresponds to the virtual ECU 5.

[0046] In the control unit 20 of the in-vehicle ECU 2 started using the virtualized operating system, a plurality of virtual ECUs 5 are generated. In the control unit 20 of FIG. 3, three virtual ECUs 5 are generated, namely, a first virtual ECU 51, a second virtual ECU 52, and a third virtual ECU 53. The control unit 20 is time-divided and periodically assigned to the virtual control unit 5a of the first virtual ECU 51, the virtual control unit 5a of the second virtual ECU 52, and the virtual control unit 5a of the third virtual ECU 53. In the example of FIG. 3, the first virtual ECU 51 is periodically generated in the first arithmetic device 201. The virtual control unit 5a of the generated first virtual ECU 51 is assigned to the first arithmetic device 201. In other words, the first arithmetic device 201 functions as the first virtual ECU 51.

[0047] In the second arithmetic device 202, the second virtual ECU 52 and the third virtual ECU 53 are generated in a periodic, alternating manner. The virtual control unit 5a of the generated second virtual ECU 52 is assigned to the second arithmetic device 202. The virtual control unit 5a of the generated third virtual ECU 53 is assigned to the second arithmetic device 202. In other words, the second arithmetic device 202 functions as the generated second virtual ECU 52. The second arithmetic device 202 functions as the generated third virtual ECU 53. Hereinafter, the generation of the virtual ECU 5 in the arithmetic device 200 and the arithmetic device 200 functioning as the generated virtual ECU 5 are also referred to as the arithmetic device 200 generating the virtual ECU 5.

[0048] The third arithmetic device 203 executes a virtual ECU management program that manages all the virtual ECUs 5. The third arithmetic device 203 functions as a control panel of the virtualized operating system by executing the virtual ECU management program. In other words, the third arithmetic device 203 functions as a management unit 1 that manages a plurality of virtual ECUs 5 by executing the virtual ECU management program.

[0049] The management unit 1 performs a process of allocating the utilization time of the first arithmetic unit 201 or the utilization time of the second arithmetic unit 202 to the virtual ECU 5, that is, so-called scheduling, by referring to the allocation time information stored in the storage unit 21, for example. For example, the allocation time information includes a cycle in which the first virtual ECU 51 is generated and a time to which the first virtual ECU 51 is allocated. The allocation time information also includes a cycle in which the second virtual ECU 52 is generated and a time to which the second virtual ECU 52 is allocated, and a cycle in which the third virtual ECU 53 is generated and a time to which the third virtual ECU 53 is allocated. Hereinafter, the time to which the virtual ECU 5 is allocated is also referred to as the allocation time of the virtual ECU 5. For example, the time to which the first virtual ECU 51 is allocated is also referred to as the allocation time of the first virtual ECU 51.

[0050] The management unit 1 performs scheduling to start the operation of each of the first virtual ECU 51, the second virtual ECU 52, and the third virtual ECU 53. In other words, the management unit 1 performs switching of the virtual ECU 5 for the first arithmetic device 201 and switching of the virtual ECU 5 for the second arithmetic device 202 by scheduling. The switching of the virtual ECU 5 includes switching between an active state in which the virtual control unit 5a of the virtual ECU 5 is assigned to the arithmetic device 200 and an inactive state in which the virtual control unit 5a of the virtual ECU 5 is not assigned to the arithmetic device 200. Hereinafter, transition of the virtual ECU 5 from an inactive state to an active state is referred to as activation. Transition of the virtual ECU 5 from an active state to an inactive state is referred to as deactivation.

[0051] The management unit 1 switches the virtual ECU 5 for the first arithmetic device 201, thereby causing the first arithmetic device 201 to periodically generate (activate) the first virtual ECU 51. By switching the virtual ECU 5 for the first arithmetic device 201, the first virtual ECU 51 is generated again in the first arithmetic device 201. Furthermore, the first arithmetic device 201 is assigned to the virtual control unit 5a of the first virtual ECU 51 that has been generated again. In other words, by switching the virtual ECU 5 for the first arithmetic device 201, the first virtual ECU 51 is deactivated, and is activated after being deactivated.

[0052] The management unit 1 switches the virtual ECU 5 for the second arithmetic device 202, causing the second arithmetic device 202 to periodically and alternately generate the second virtual ECU 52 and the third virtual ECU 53. By switching the virtual ECU 5 for the second arithmetic device 202, the virtual ECU 5 generated in the second arithmetic device 202 is switched from one of the second virtual ECU 52 and the third virtual ECU 53 to the other of the second virtual ECU 52 and the third virtual ECU 53. In the second arithmetic device 202, the other of the second virtual ECU 52 and the third virtual ECU 53 is generated. The second arithmetic device 202 is assigned to the virtual control unit 5a of the other of the second virtual ECU 52 and the third virtual ECU 53. In other words, by switching the virtual ECU 5 for the second arithmetic device 202, one of the second virtual ECU 52 and the third virtual ECU 53 is inactivated. Moreover, the other of the second virtual ECU 52 and the third virtual ECU 53 is activated.

[0053] The storage unit 21 is divided into areas and allocated to communication buffers 6 including a first communication buffer 61, a second communication buffer 62, and a third communication buffer 63. The communication buffer 6 is included in the virtual ECU 5. More specifically, the first communication buffer 61 is included in the first virtual ECU 51. The first communication buffer 61 includes a first transmission buffer 61a and a first reception buffer 61b. When the first virtual ECU 51 communicates with another virtual ECU 5, communication data to be transmitted to the other virtual ECU 5 is written in the first transmission buffer 61a. Communication data received by the first virtual ECU 51 from the other virtual ECU 5 is written in the first reception buffer 61b.

[0054] The second communication buffer 62 is included in the second virtual ECU 52. The second communication buffer 62 includes a second transmission buffer 62a and a second reception buffer 62b. When the second virtual ECU 52 communicates with another virtual ECU 5, communication data to be transmitted to the other virtual ECU 5 is written in the second transmission buffer 62a. Communication data received by the second virtual ECU 52 from the other virtual ECU 5 is written in the second reception buffer 62b.

[0055] The third communication buffer 63 is included in the third virtual ECU 53. The third communication buffer 63 includes a third transmission buffer 63a and a third reception buffer 63b. When the third virtual ECU 53 communicates with another virtual ECU 5, communication data to be transmitted to the other virtual ECU 5 is written in the third transmission buffer 63a. Communication data received by the third virtual ECU 53 from the other virtual ECU 5 is written in the third reception buffer 63b.

[0056] The first transmission buffer 61a, the second transmission buffer 62a, and the third transmission buffer 63a are included in the transmission buffer. Hereinafter, the first transmission buffer 61a, the second transmission buffer 62a, and the third transmission buffer 63a are also collectively referred to as the transmission buffer 6a. The first reception buffer 61b, the second reception buffer 62b, and the third reception buffer 63b are included in the reception buffer. Hereinafter, the first reception buffer 61b, the second reception buffer 62b, and the third reception buffer 63b are also collectively referred to as the reception buffer 6b.

[0057] Even when the generation of the virtual ECU 5 is completed, information written in the virtual memory unit and communication buffer 6 of the virtual ECU 5, for example, communication data, is held in the virtual memory unit and communication buffer of the virtual ECU 5 allocated in the memory unit 21. The case where the generation of the virtual ECU 5 is completed includes the case where the virtual ECU 5 is in an inactive state.

[0058] For each transmission buffer 6a, a transmission buffer update flag indicating that the communication data written to the transmission buffer 6a has been updated is provided for each communication data identifier such as a message ID. Note that the communication data identifier is not limited to a message ID, and may be, for example, port number information or an IP address included in the communication data.

[0059] Fig. 4 is a schematic diagram illustrating the configuration of the transmission buffer 6a. The transmission buffer 6a has an area for storing communication data, an identifier of the communication data, a data length of the communication data, and a transmission buffer update flag of the communication data in association with each other, for each identifier. The transmission buffer 6a in Fig. 4 can store multiple pieces of communication data in a distinguished manner.

[0060] When communicating with another virtual ECU 5, the virtual ECU 5 writes communication data to be transmitted to the other virtual ECU 5 in a transmission buffer 6a included in the own virtual ECU. When writing new communication data in the transmission buffer 6a, the virtual ECU 5 overwrites the new communication data in the transmission buffer 6a with communication data associated with the same identifier as the identifier of the new communication data. In other words, the communication data of the above identifier is updated in the transmission buffer 6a.

[0061] The transmission buffer update flag includes an off state and an on state. When the transmission buffer update flag is off, the communication data in the transmission buffer 6a has not been updated. When the transmission buffer update flag is on, the communication data in the transmission buffer 6a has been updated, and therefore the communication data in the transmission buffer 6a for which the transmission buffer update flag is on is communication data that has been newly written to the transmission buffer 6a.

[0062] After writing the communication data, the virtual ECU 5 turns on the transmission buffer update flag of the communication data. The number of pieces of communication data written by the virtual ECU 5 to the transmission buffer 6a may be one or more. When the virtual ECU 5 writes a plurality of pieces of communication data to the transmission buffer 6a, the virtual ECU 5 turns on the transmission buffer update flag of each piece of communication data.

[0063] For example, the first virtual ECU 51 writes communication data to be transmitted to at least one of the second virtual ECU 52 and the third virtual ECU 53, in the first transmission buffer 61a. After writing the communication data in the first transmission buffer 61a, the first virtual ECU 51 sets a transmission buffer update flag for the communication data in the first transmission buffer 61a to an ON state. Similarly to the first virtual ECU 51, the second virtual ECU 52 writes communication data to the second transmission buffer 62a. After writing the communication data, the second virtual ECU 52 sets a transmission buffer update flag for the communication data in the second transmission buffer 62a to an ON state. The third virtual ECU 53 writes communication data to the third transmission buffer 63a. After writing the communication data, the third virtual ECU 53 sets a transmission buffer update flag for the communication data in the third transmission buffer 63a to an ON state.

[0064] For each reception buffer 6b, a reception buffer update flag indicating that the communication data written in the reception buffer 6b has been updated is provided for each identifier of the communication data. FIG. 5 is a schematic diagram illustrating a configuration of the reception buffer 6b. In the reception buffer 6b, an area is provided for each identifier in which communication data, an identifier of the communication data, a data length of the communication data, and a reception buffer update flag of the communication data are associated and stored. The reception buffer 6b in FIG. 5 can store a plurality of communication data in a distinguished manner. As will be described in detail later, the management unit 1 writes communication data to the reception buffer. When writing new communication data to the reception buffer 6b, the management unit 1 overwrites the new communication data with the communication data associated with the same identifier as the identifier of the new communication data in the reception buffer 6b. In other words, the communication data of the above identifier is updated in the reception buffer 6b.

[0065] The receive buffer update flag includes an off state and an on state. When the receive buffer update flag is off, the communication data in the receive buffer 6b has not been updated. When the receive buffer update flag is on, the communication data in the receive buffer 6b has been updated, and therefore the communication data for which the receive buffer update flag is on in the receive buffer 6b is communication data that has been newly written to the receive buffer 6b.

[0066] When the receive buffer update flag in the receive buffer 6b of the own virtual ECU is in an on state, the virtual ECU 5 reads the updated communication data from the receive buffer 6b. More specifically, when the receive buffer update flag is in an on state, at least one of the receive buffer update flags associated with the communication data written in the receive buffer 6b is in an on state. In this case, the virtual ECU 5 reads the communication data whose receive buffer update flag is in an on state in the receive buffer 6b of the own virtual ECU. For example, when there are a plurality of pieces of communication data whose receive buffer update flags are in an on state, the virtual ECU 5 reads the plurality of pieces of communication data. After reading the communication data, the virtual ECU 5 changes the receive buffer update flag of the communication data from an on state to an off state. The virtual ECU 5 executes a program using the read communication data.

[0067] For example, when the receive buffer update flag of the first receive buffer 61b is in an on state, the first virtual ECU 51 reads the updated communication data from the first receive buffer 61b. After reading the communication data, the first virtual ECU 51 turns the receive buffer update flag of the first receive buffer 61b to an off state. When the receive buffer update flag of the second receive buffer 62b is in an on state, the second virtual ECU 52 reads the updated communication data from the second receive buffer 62b. After reading the communication data, the second virtual ECU 52 turns the receive buffer update flag of the second receive buffer 62b to an off state. When the receive buffer update flag of the third receive buffer 63b is in an on state, the third virtual ECU 53 reads the updated communication data from the third receive buffer 63b. After reading the communication data, the third virtual ECU 53 turns the receive buffer update flag of the third receive buffer 63b to an off state.

[0068] As shown in FIG. 3, the storage unit 21 includes a storage area 210 that is accessible only to the management unit 1 among the first virtual ECU 51, the second virtual ECU 52, the third virtual ECU 53, and the management unit 1. In the storage area 210, a storage area update flag indicating that the communication data written in the storage area 210 has been updated is provided for each identifier of the communication data. As will be described later in detail, the management unit 1 writes the communication data written in the transmission buffer 6a to the storage area 210 and temporarily stores the communication data in the storage area 210. For example, the communication data is written in the storage area 210 in association with an identifier of the communication data, a data length of the communication data, and a storage area update flag of the communication data. One or more pieces of communication data are written in the storage area 210 in a distinguished manner. When the management unit 1 writes new communication data in the storage area 210 and communication data associated with the same identifier as the identifier of the new communication data is stored in the storage area 210, the management unit 1 overwrites the communication data with the new communication data. In other words, the communication data of the above identifiers in the storage area 210 is updated.

[0069] The storage area update flag includes an off state and an on state. When the storage area update flag is off, the communication data in the storage area 210 has not been updated. When the storage area update flag is on, the communication data in the storage area 210 has been updated, and therefore the communication data in the storage area 210 for which the storage area update flag is on is communication data that has been newly written to the storage area 210.

[0070] When the transmission buffer update flag in the transmission buffer 6a of one of the three virtual ECUs 5 is in an on state, the management unit 1 reads the updated communication data from the transmission buffer 6a. In detail, when the transmission buffer update flag is in an on state, at least one of the transmission buffer update flags associated with the communication data written in the transmission buffer 6a is in an on state. When the transmission buffer update flag is in an on state, the management unit 1 reads the communication data whose transmission buffer update flag is in an on state from the transmission buffer 6a of one of the virtual ECUs 5. The management unit 1 writes the read communication data into the storage area 210. Although the details will be described later, the reading of the communication data from the transmission buffer 6a of the virtual ECU 5 is performed during a period in which the virtual control unit 5a of the virtual ECU 5 is not assigned to the arithmetic device 200, that is, during a period in which the virtual control unit 5a of the virtual ECU 5 is not assigned to the control unit 20. Hereinafter, the period in which the virtual control unit 5a of the virtual ECU 5 is not assigned to the control unit 20 is also referred to as a period in which the virtual ECU 5 is not assigned to the control unit 20. A period during which a virtual ECU 5 is not assigned to the control unit 20 is a period during which the virtual ECU 5 is in an inactive state. A period during which a virtual ECU 5 is not assigned to the control unit 20 corresponds to a period during which the virtual ECU 5 is not operating.

[0071] After writing the communication data to the memory area 210, the management unit 1 changes the transmission buffer update flag of the communication data from the ON state to the OFF state in the transmission buffer 6a of one virtual ECU 5. Furthermore, the management unit 1 sets the storage area update flag of the communication data in the storage area 210 to the ON state.

[0072] For example, the management unit 1 determines whether the transmission buffer update flag of the first transmission buffer 61a is in the ON state during a period in which the virtual control unit 5a of the first virtual ECU 51 is not assigned to the first arithmetic device 201. If the transmission buffer update flag is in the ON state, the management unit 1 reads communication data whose transmission buffer update flag is in the ON state from the first transmission buffer 61a. The management unit 1 turns the transmission buffer update flag into the OFF state. The management unit 1 writes the read communication data into the memory area 210. The management unit 1 turns the memory area update flag of the written communication data into the ON state.

[0073] The management unit 1 writes, among the communication data written in the storage area 210, the communication data whose storage area update flag is in an ON state and whose destination is the virtual ECU 5 to be operated next, to the reception buffer 6b of the virtual ECU 5 to be operated next. The communication data written in the transmission buffer 6a of the source virtual ECU 5 is written to the reception buffer 6b of the destination virtual ECU 5 via the storage area 210. For example, the management unit 1 determines the destination virtual ECU 5 based on information about the destination of the communication data. For example, the information about the destination may be included in the communication data or may be stored in the storage unit 21 in advance. Although details will be described later, the management unit 1 writes the communication data to the reception buffer 6b during a period when the virtual ECU 5 is not assigned to the control unit 20.

[0074] After writing the communication data to the receive buffer 6b, the management unit 1 turns on the receive buffer update flag for the communication data written in the receive buffer 6b. Furthermore, the management unit 1 turns off the storage area update flag for the communication data in the storage area 210. For example, when a plurality of virtual ECUs 5 are destinations of the communication data, the management unit 1 turns off the storage area update flag for the communication data after writing the communication data to all of the receive buffers 6b of the destination virtual ECUs 5. The destination virtual ECU 5 reads the communication data written to the receive buffer 6b of its own virtual ECU based on the receive buffer update flag as described above.

[0075] For example, when the management unit 1 starts the operation of the first virtual ECU 51, the management unit 1 determines whether the storage area update flag is in an ON state before starting the operation of the first virtual ECU 51. When the storage area update flag is in an ON state, at least one of the storage area update flags of the communication data written in the storage area 210 is in an ON state. When the storage area update flag is in an ON state, the management unit 1 writes the communication data, whose storage area update flag is in an ON state and whose destination is the first virtual ECU 51, to the first receive buffer 61b. After writing the communication data to the first receive buffer 61b, the management unit 1 sets the receive buffer update flag of the written communication data to an ON state in the first receive buffer 61b. Furthermore, the management unit 1 sets the storage area update flag of the communication data in the storage area 210 to an OFF state.

[0076] For example, the management unit 1 may write communication data whose storage area update flag is in an ON state to each of the reception buffers 6b of all virtual ECUs 5 other than the virtual ECU 5 that is the transmission source of the communication data. That is, the management unit 1 may write communication data whose storage area update flag is in an ON state to the reception buffer 6b of the virtual ECU 5 to be operated next, without considering the transmission destination of the communication data. In this case, when the management unit 1 writes the communication data to the reception buffers 6b of all virtual ECUs 5 other than the virtual ECU 5 that is the transmission source of the communication data, it changes the storage area update flag from an ON state to an OFF state. When reading the communication data written in the reception buffer 6b, each virtual ECU 5 determines whether the communication data is to be received by its own virtual ECU. When the communication data is to be received by its own virtual ECU, the virtual ECU 5 acquires the communication data from the reception buffer 6b. When the communication data is not to be received by its own virtual ECU, for example, the virtual ECU 5 discards the communication data. For example, the receive buffer 6b may be configured such that only messages that are to be received by the virtual ECU 5 including the receive buffer 6b are written therein.

[0077] FIG. 6 is an explanatory diagram showing an example of communication between a plurality of virtual ECUs 5. In the example of FIG. 6, the destination of communication data is all virtual ECUs 5 other than the source. As described above, the third arithmetic device 203 functions as the management unit 1. In FIG. 6, the management unit 1 is shown as HV (Hypervisor). As described above, the management unit 1 periodically causes the first arithmetic device 201 to generate the first virtual ECU 51, and assigns the virtual control unit 5a of the generated first virtual ECU 51 to the first arithmetic device 201. A predetermined time is provided between the period in which the first virtual ECU 51 is generated and the period in which the first virtual ECU 51 is generated again.

[0078] As described above, the management unit 1 periodically causes the second arithmetic device 202 to alternately generate the second virtual ECU 52 and the third virtual ECU 53, and assigns the virtual control unit 5a of the generated second virtual ECU 52 or the third virtual ECU 53 to the second arithmetic device 202. A predetermined time is provided between the period in which the second virtual ECU 52 is generated and the period in which the third virtual ECU 53 is generated. The predetermined time for the first virtual ECU 51 and the predetermined time for the second virtual ECU 52 and the third virtual ECU 53 may be the same time or may be different times. In FIG. 6, the period in which the first virtual ECU 51 is generated is longer than each of the period in which the second virtual ECU 52 is generated and the period in which the third virtual ECU 53 is generated.

[0079] In FIG. 6, the management unit 1 causes the first arithmetic device 201 to start generating the first virtual ECU 51, and the second arithmetic device 202 to start generating the second virtual ECU 52. The start of the generation of the virtual ECU 5 includes the activation of the virtual ECU 5. The second virtual ECU 52 writes communication data to the second transmission buffer 62a, and turns on the transmission buffer update flag of the second transmission buffer 62a as described above. In FIG. 6, the solid arrow indicates the writing or reading of communication data by the virtual ECU 5. The dashed arrow indicates the writing or reading of communication data by the management unit 1. The management unit 1 causes the second arithmetic device 202 to end the generation of the second virtual ECU 52, and causes the second arithmetic device 202 to start generating the third virtual ECU 53. In other words, the management unit 1 switches the virtual ECU 5 to the second arithmetic device 202. The end of the generation of the virtual ECU 5 includes the deactivation of the virtual ECU 5.

[0080] During the period from when the second arithmetic device 202 finishes generating the second virtual ECU 52 to when the second arithmetic device 202 starts generating the third virtual ECU 53, the management unit 1 performs the following process. Based on the transmission buffer update flag as described above, the management unit 1 reads communication data whose transmission buffer update flag of the second transmission buffer 62a is in an ON state from the second transmission buffer 62a, and writes the communication data to the storage area 210. As described above, the management unit 1 changes the transmission buffer update flag of the communication data read from the second transmission buffer 62a from an ON state to an OFF state, and sets the storage area update flag of the communication data written to the storage area 210 to an ON state. For the sake of explanation, the storage area 210 in FIG. 6 is shown distinguished according to the transmission source of the communication data.

[0081] Since the virtual ECU 5 that the management unit 1 causes to start operating next is the third virtual ECU 53, the management unit 1 reads communication data whose storage area update flag is in an ON state from the storage area 210 based on the storage area update flag as described above, and writes the communication data to the third receive buffer 63b. In the example of FIG. 6, communication data whose sender is the second virtual ECU 52 is written to the third receive buffer 63b. As described above, the management unit 1 sets the receive buffer update flag of the communication data written in the third receive buffer 63b to an ON state. The period from when the second arithmetic device 202 finishes generating the second virtual ECU 52 to when the second arithmetic device 202 starts generating the third virtual ECU 53 is included in the period during which the virtual control unit 5a of the virtual ECU 5 is not assigned to the control unit 20.

[0082] The third virtual ECU 53 generated in the second arithmetic device 202 reads out communication data whose receive buffer update flag is in an ON state from the third receive buffer 63b based on the receive buffer update flag as described above. In the example of FIG. 6, the third virtual ECU 53 reads out communication data whose sender is the second virtual ECU 52. The communication data is exchanged between the third virtual ECU 53 and the second virtual ECU 52 via the storage area 210. That is, communication is performed between the third virtual ECU 53 and the second virtual ECU 52. The third virtual ECU 53 changes the receive buffer update flag of the read communication data from an ON state to an OFF state.

[0083] The first virtual ECU 51 writes the communication data to the first transmission buffer 61a, and turns on the transmission buffer update flag of the first transmission buffer 61a as described above. The management unit 1 causes the first arithmetic device 201 to end the generation of the first virtual ECU 51, and causes the first arithmetic device 201 to start generating the first virtual ECU 51 again. In other words, the management unit 1 switches the virtual ECU 5 to the second arithmetic device 202.

[0084] During the period from when the first arithmetic device 201 finishes generating the first virtual ECU 51 to when the first arithmetic device 201 starts generating the first virtual ECU 51 again, the management unit 1 performs the following process. Based on the transmission buffer update flag as described above, the management unit 1 reads communication data for which the transmission buffer update flag of the first transmission buffer 61a is in the ON state from the first transmission buffer 61a, and writes the communication data to the storage area 210. As described above, the management unit 1 changes the transmission buffer update flag of the communication data read from the first transmission buffer from the ON state to the OFF state, and sets the storage area update flag of the communication data written to the storage area 210 to the ON state.

[0085] Since the virtual ECU 5 that the management unit 1 causes to start operating next is the first virtual ECU 51, the management unit 1 reads communication data whose storage area update flag is in an ON state from the storage area 210 based on the storage area update flag as described above, and writes the communication data to the first receive buffer 61b. In the example of FIG. 6, communication data whose source is the second virtual ECU 52 is written to the first receive buffer 61b. The management unit 1 sets the receive buffer update flag of the communication data written in the first receive buffer 61b to an ON state. In the example of FIG. 6, the destination of each communication data is all virtual ECUs 5 other than the source. Since the communication data whose source is the second virtual ECU 52 has been written to the first receive buffer 61b and the third receive buffer 63b, the management unit 1 sets the storage area update flag of the communication data whose source is the second virtual ECU 52 to an OFF state in the storage area 210. The period from when the first calculation device 201 finishes generating the first virtual ECU 51 to when the first calculation device 201 starts generating the first virtual ECU 51 again is included in the period in which the virtual control unit 5a of the virtual ECU 5 is not assigned to the control unit 20.

[0086] Again, the first virtual ECU 51 generated in the first arithmetic device 201 reads the communication data, for which the receive buffer update flag of the first receive buffer 61b is in the ON state, from the first receive buffer 61b based on the receive buffer update flag as described above, and acquires the communication data. The first virtual ECU 51 changes the receive buffer update flag of the communication data read in the first receive buffer 61b from the ON state to the OFF state.

[0087] In the example of Figure 6, during the period from the time when the first calculation device 201 finishes generating the first virtual ECU 51 to the time when the first calculation device 201 starts generating the first virtual ECU 51 again, the third virtual ECU 53 writes communication data to the third transmit buffer 63a and turns on the transmit buffer update flag for the communication data written in the third transmit buffer 63a.

[0088] The management unit 1 causes the second arithmetic device 202 to end the generation of the third virtual ECU 53 and causes the second arithmetic device 202 to start the generation of the second virtual ECU 52. In other words, the management unit 1 switches the virtual ECU 5 for the second arithmetic device 202. During the period from when the second arithmetic device 202 ends the generation of the third virtual ECU 53 to when the second arithmetic device 202 starts the generation of the second virtual ECU 52, the management unit 1 performs the following process. Based on the transmission buffer update flag as described above, the management unit 1 reads communication data whose transmission buffer update flag of the third transmission buffer 63a is in an ON state from the third transmission buffer 63a, and writes the communication data to the storage area 210. As described above, the management unit 1 changes the transmission buffer update flag of the read communication data from an ON state to an OFF state, and sets the storage area update flag of the written communication data to an ON state.

[0089] Since the virtual ECU 5 that the management unit 1 causes to start operating next is the second virtual ECU 52, the management unit 1 reads communication data whose storage area update flag is in an ON state from the storage area 210 based on the storage area update flag as described above, and writes the communication data to the second receive buffer 62b. In the example of Fig. 6, communication data whose sender is the first virtual ECU 51 and communication data whose sender is the third virtual ECU 53 are written to the second receive buffer 62b. The period from when the second arithmetic device 202 finishes generating the third virtual ECU 53 to when the second arithmetic device 202 starts generating the second virtual ECU 52 is included in the period during which the virtual control unit 5a of the virtual ECU 5 is not assigned to the control unit 20.

[0090] The second virtual ECU 52 generated in the second arithmetic device 202 reads the communication data for which the reception buffer update flag of the second reception buffer 62b is in the ON state from the second reception buffer 62b based on the reception buffer update flag as described above. In the example of FIG. 6, the second virtual ECU 52 reads two pieces of communication data and turns off the reception buffer update flags of the communication data of the two pieces of data read in the second reception buffer 62b. The second virtual ECU 52 writes new communication data to the second transmission buffer 62a and turns on the transmission buffer update flag of the second transmission buffer 62a as described above. The management unit 1 switches the virtual ECU 5 for the second arithmetic device 202.

[0091] During the period from the end of generation of the second virtual ECU 52 to the start of generation of the third virtual ECU 53, the management unit 1 performs the following process. In the second transmission buffer 62a, the management unit 1 writes communication data for which the transmission buffer update flag of the second transmission buffer 62a is in the ON state to the storage area 210. The management unit 1 changes the transmission buffer update flag from the ON state to the OFF state, and sets the storage area update flag of the written communication data to the ON state.

[0092] Furthermore, the management unit 1 reads out communication data whose storage area update flag is in an ON state from the storage area 210, and writes the communication data to the third receive buffer 63b. In the example of Fig. 6, communication data whose transmission source is the first virtual ECU 51 and communication data whose transmission source is the second virtual ECU 52 are written to the third receive buffer 63b. Since the communication data whose transmission source is the first virtual ECU 51 has been written to the second receive buffer 62b and the third receive buffer 63b, the management unit 1 sets the storage area update flag of the communication data whose transmission source is the first virtual ECU 51 to an OFF state in the storage area 210.

[0093] The generated third virtual ECU 53 reads out the communication data, whose reception buffer update flag of the third reception buffer 63b is in the ON state, from the third transmission buffer 63a based on the reception buffer update flag. The third virtual ECU 53 turns off the reception buffer update flag of the communication data read out in the third reception buffer 63b.

[0094] As described above, the communication data is read or written based on the update flags including the transmission buffer update flag, the storage area update flag, and the reception buffer update flag. In addition, the update flags are set in response to the reading or writing of the communication data.

[0095] 7 is a flowchart illustrating the process performed by the third arithmetic device 203 functioning as the management unit 1 and the process related to the generation of the virtual ECU 5 performed by the arithmetic device 200 assigned to the virtual ECU 5. In this embodiment, the arithmetic devices 200 assigned to the virtual ECU 5 are the first arithmetic device 201 and the second arithmetic device 202. For example, the third arithmetic device 203 performs the following process as the management unit 1 when an IG (ignition) switch (not shown) of the vehicle C transitions from an off state to an on state. Also, the arithmetic device 200 assigned to the virtual ECU 5 performs the following process when the IG switch transitions from an off state to an on state. Hereinafter, steps are abbreviated as S.

[0096] The arithmetic device 200 assigned to the virtual ECU 5 acquires a generation start signal indicating the start of generation of the virtual ECU 5 from the third arithmetic device 203 (S101), and starts the generation of the virtual ECU 5 (S102). In more detail, of the arithmetic devices 200 described above, the first arithmetic device 201 generates the first virtual ECU 51. Moreover, the second arithmetic device 202 generates one of the second virtual ECU 52 and the third virtual ECU 53.

[0097] The arithmetic unit 200 assigned to the virtual ECU 5 determines whether or not the receive buffer update flag of the receive buffer 6b of the generated virtual ECU 5 is in the on state (S103). If the receive buffer update flag is not in the on state (S103: NO), that is, if the receive buffer update flag is in the off state, the arithmetic unit 200 assigned to the virtual ECU 5 performs the process of S106 described later. If the receive buffer update flag is not in the on state, this is the case when all of the receive buffer update flags associated with the communication data written to the receive buffer 6b of the generated virtual ECU 5 are in the off state.

[0098] When the reception buffer update flag is in an ON state (S103: YES), the arithmetic unit 200 assigned to the virtual ECU 5 reads the communication data whose reception buffer update flag is in an ON state from the reception buffer 6b as described above (S104). When the reception buffer update flag is in an ON state, at least one of the reception buffer update flags associated with the communication data written in the reception buffer 6b of the generated virtual ECU 5 is in an ON state. As described above, the arithmetic unit 200 assigned to the virtual ECU 5 turns off the reception buffer update flag of the read communication data (S105). The arithmetic unit 200 assigned to the virtual ECU 5 executes a program (S106). Note that the program is executed on the virtual ECU 5. For example, when the arithmetic unit 200 assigned to the virtual ECU 5 reads the communication data from the reception buffer 6b in the process of S104, it executes the program using the read communication data.

[0099] The arithmetic unit 200 assigned to the virtual ECU 5 writes the communication data to the transmission buffer 6a of the generated virtual ECU 5 (S107). After writing the communication data to the transmission buffer 6a, the arithmetic unit 200 sets the transmission buffer update flag of the written communication data to an ON state (S108) as described above. The arithmetic unit 200 assigned to the virtual ECU 5 acquires a generation end signal indicating the end of generation of the virtual ECU 5 from the third arithmetic unit 203 (S109) and ends the generation of the virtual ECU 5 (S110). The arithmetic unit 200 assigned to the virtual ECU 5 performs the process of S101. The generated virtual ECU 5 is switched. In more detail, of the arithmetic units 200, the first arithmetic unit 201 ends the generation of the first virtual ECU 51 and starts the generation of the first virtual ECU 51 again. Further, the second arithmetic device 202 ends the generation of one of the second virtual ECU 52 and the third virtual ECU 53, and starts the generation of the other of the second virtual ECU 52 and the third virtual ECU 53. The arithmetic device 200 assigned to the virtual ECU 5 ends the process, for example, when the IG switch transitions from the on state to the off state.

[0100] The third arithmetic device 203 outputs a generation start signal to the arithmetic device 200 assigned to the virtual ECU 5 based on the above-mentioned allocated time information (S111). The third arithmetic device 203 causes the first arithmetic device 201 to start generating the first virtual ECU 51. Alternatively, the third arithmetic device 203 causes the second arithmetic device 202 to start generating one of the second virtual ECU 52 and the third virtual ECU 53.

[0101] The third arithmetic device 203 determines whether or not the allocation time of the virtual ECU 5 has elapsed since the arithmetic device 200 assigned to the virtual ECU 5 started generating the virtual ECU 5 (S112). For example, when the third arithmetic device 203 causes the first arithmetic device 201 to start generating the first virtual ECU 51, the third arithmetic device 203 determines whether or not the allocation time of the first virtual ECU 51 has elapsed since the generation of the first virtual ECU 51 started.

[0102] If the allocated time of the virtual ECU 5 has not elapsed (S112: NO), the third arithmetic device 203 performs the loop process to perform the process of S112 again. If the allocated time of the virtual ECU 5 has elapsed (S112: YES), the third arithmetic device 203 outputs a generation end signal to the arithmetic device 200 allocated to the virtual ECU 5 based on the allocated time information (S113), and causes the first arithmetic device 201 or the second arithmetic device 202 to end the generation of the virtual ECU 5.

[0103] Instead of the process of S112, the third arithmetic device 203 may perform a standby process from the time when the arithmetic device 200 assigned to the virtual ECU 5 starts generating the virtual ECU 5 until the allocation time of the virtual ECU 5 has elapsed. After the standby process, the third arithmetic device 203 performs the process of S113.

[0104] The third arithmetic unit 203 judges whether or not the transmission buffer update flag is on in the transmission buffer 6a of the virtual ECU 5 for which generation has been completed (S114). If the transmission buffer update flag is not on (S114: NO), the third arithmetic unit 203 performs processing in S117, which will be described later. If the transmission buffer update flag is not on, send Buffer 6 a associated with the communication data written to send This is the case when all of the buffer update flags are in the off state.

[0105] When the transmission buffer update flag is in an ON state (S114: YES), the third calculation device 203 reads the communication data whose transmission buffer update flag is in an ON state from the transmission buffer 6a, as described above, and writes the communication data to the storage area 210 (S115). When the transmission buffer update flag is in an ON state, at least one of the transmission buffer update flags associated with the communication data written to the transmission buffer 6a is in an ON state. As described above, after writing the communication data to the storage area 210, the third calculation device 203 changes the transmission buffer update flag of the communication data read in the transmission buffer 6a from an ON state to an OFF state, and sets the storage area update flag of the communication data written in the storage area 210 to an ON state. That is, the third calculation device 203 updates the transmission buffer update flag and the storage area update flag (S116).

[0106] The third arithmetic unit 203 judges whether the storage area update flag is in an ON state (S117). When the storage area update flag is in an ON state (S117: YES), the third arithmetic unit 203 performs the following process. As described above, the third arithmetic unit 203 reads from the storage area 210 the communication data whose storage area update flag is in an ON state and whose destination is the virtual ECU 5 to be operated next, among the communication data written in the storage area 210. The third arithmetic unit 203 writes the communication data read from the storage area 210 to the reception buffer 6b of the virtual ECU 5 to be operated next (S118). When the above-mentioned storage area update flag is in an ON state, at least one of the storage area update flags associated with the communication data written in the storage area 210 is in an ON state. Note that, as described above, the third arithmetic unit 203 may write the communication data whose storage area update flag is in an ON state to the reception buffer 6b of the virtual ECU 5 to be operated next, without considering the destination of the communication data.

[0107] As described above, after writing the communication data to the receive buffer 6b, the third arithmetic unit 203 changes the storage area update flag of the communication data read from the storage area 210 from on to off. Furthermore, the third arithmetic unit 203 turns on the receive buffer update flag of the communication data written in the receive buffer 6b. That is, the third arithmetic unit 203 updates the storage area update flag and the receive buffer update flag (S119). For example, when there are multiple destinations for the communication data, the third arithmetic unit 203 changes the storage area update flag of the communication data from on to off when the communication data is written to the receive buffers 6b of all the destination virtual ECUs 5.

[0108] The third arithmetic unit 203 performs the process of S111 and switches the virtual ECU 5 for the first arithmetic unit 201 or the second arithmetic unit 202. In detail, the third arithmetic unit 203 causes the first arithmetic unit 201 to start generating the first virtual ECU 51 again. Alternatively, the third arithmetic unit 203 causes the second arithmetic unit 202 to start generating the other of the second virtual ECU 52 and the third virtual ECU 53. The third arithmetic unit 203 ends the process, for example, when the IG switch transitions from the on state to the off state.

[0109] If the memory area update flag is not on (S117: NO), the third arithmetic device 203 performs the process of S111 and switches the virtual ECU 5 for the first arithmetic device 201 or the second arithmetic device 202. If the memory area update flag is not on, it is the case that all of the memory area update flags associated with the communication data written in the memory area 210 are off.

[0110] In this embodiment, a plurality of virtual ECUs 5 are generated in the in-vehicle ECU 2. Of the first arithmetic unit 201, the second arithmetic unit 202, and the third arithmetic unit 203 included in the control unit 20, the third arithmetic unit 203 functions as the management unit 1. A virtual control unit 5a of the virtual ECU 5 is assigned to each of the first arithmetic unit 201 and the second arithmetic unit 202. Each of the first arithmetic unit 201 and the second arithmetic unit 202 functions as a virtual ECU 5. The virtual ECU 5 writes and reads communication data to and from the communication buffer 6 of its own virtual ECU. The management unit 1 reads the communication data written in the transmission buffer 6a and writes the communication data to the storage area 210. The management unit 1 also writes the communication data written in the storage area 210 to the reception buffer 6b of the destination virtual ECU 5. Communication data is exchanged between the plurality of virtual ECUs 5 via the storage area 210. That is, the plurality of virtual ECUs 5 communicate with each other via the storage area 210. Since the memory area 210 is accessible only by the management unit 1, it is possible to prevent the virtual ECU 5 from erroneously writing and reading communication data to and from the memory area 210.

[0111] Since the communication data is exchanged by the management unit 1 via the storage area 210, while one virtual ECU 5 is writing the communication data, another virtual ECU 5 does not read the communication data. As described above, the management unit 1 writes and reads the communication data during a period in which the virtual control unit 5a is not assigned to the first arithmetic unit 201 or the second arithmetic unit 202, so that the writing of the communication data to the communication buffer 6 by the virtual ECU 5 and the reading of the communication data from the communication buffer 6 by the management unit 1 do not conflict. Furthermore, the writing of the communication data to the communication buffer 6 by the management unit 1 and the reading of the communication data from the communication buffer 6 by the virtual ECU 5 do not conflict. In detail, it is possible to prevent the writing and reading of the communication data from conflicting in the transmission buffer 6a. Furthermore, it is possible to prevent the writing and reading of the communication data from conflicting in the reception buffer 6b. Therefore, the communication data can be appropriately exchanged between the multiple virtual ECUs 5 without the writing and reading of the communication data from conflicting. Furthermore, the communication data can be efficiently exchanged between the multiple virtual ECUs 5. That is, no access conflict occurs, and communication between the plurality of virtual ECUs 5 can be efficiently performed.

[0112] As described above, the third arithmetic device 203 functions as the management unit 1. That is, one arithmetic device 200 functions as the management unit 1. Since the management unit 1 by one arithmetic device 200 writes and reads communication data to and from the memory area 210, communication data can be exchanged between the multiple virtual ECUs 5 without contention in writing and reading communication data to and from the memory area 210.

[0113] When the receive buffer update flag of the receive buffer 6b of the virtual ECU 5 is in an ON state, the virtual ECU 5 reads the communication data from the receive buffer 6b. After reading the communication data, the virtual ECU 5 changes the receive buffer update flag from ON to OFF, so that it is possible to prevent communication data that has already been read from being read again. The virtual ECU 5 can appropriately read newly transmitted communication data by reading the communication data from the receive buffer 6b based on the receive buffer update flag.

[0114] After writing the communication data to the transmission buffer 6a, the virtual ECU 5 sets the transmission buffer update flag to the ON state. When the transmission buffer update flag is in the ON state, the management unit 1 writes the communication data written to the transmission buffer 6a to the storage area 210, and sets the transmission buffer update flag to the OFF state after writing the communication data to the transmission buffer 6a. Since the communication data written to the transmission buffer 6a is read based on the transmission buffer update flag, the management unit 1 can appropriately read the newly transmitted communication data from the transmission buffer 6a.

[0115] The management unit 1 turns on the storage area update flag after writing the communication data to the transmission buffer 6a. When the storage area update flag is on, the management unit 1 reads the communication data from the storage area 210 and writes the read communication data to the reception buffer 6b of the destination virtual ECU 5. After writing to the reception buffer 6b, the management unit 1 turns on the reception buffer update flag and changes the storage area update flag from on to off. Since the communication data is read from the storage area 210 and written to the reception buffer 6b based on the storage area update flag, the management unit 1 can determine the communication data that has not been written to the reception buffer 6b among the communication data written to the storage area 210. Since the management unit 1 turns on the reception buffer update flag after writing the communication data to the reception buffer 6b, the virtual ECU 5 can appropriately read the newly transmitted communication data from the reception buffer 6b.

[0116] (Embodiment 2) Among the configurations according to the second embodiment, the same components as those according to the first embodiment are denoted by the same reference numerals, and detailed description thereof will be omitted. The second embodiment relates to an in-vehicle ECU 2 that writes communication data into a storage area 210 or a receiving buffer 6b based on a count value indicating the number of times the communication data has been updated.

[0117] The in-vehicle ECU 2 of the second embodiment includes a control unit 20 including a first arithmetic unit 201, a second arithmetic unit 202, and a third arithmetic unit 203, as in the first embodiment. As in the first embodiment, the first arithmetic unit 201 periodically generates a first virtual ECU 51. The second arithmetic unit 202 periodically and alternately generates a second virtual ECU 52 and a third virtual ECU 53. The third arithmetic unit 203 functions as a management unit 1.

[0118] In each of the transmission buffers 6a of the multiple virtual ECUs 5 including the first virtual ECU 51, the second virtual ECU 52, and the third virtual ECU 53, a transmission buffer count value indicating the number of times communication data has been written to the transmission buffer 6a is provided for each identifier of the communication data. The transmission buffer count value is associated with communication data for each identifier of the communication data in the transmission buffer 6a, similar to the transmission buffer update flag in the first embodiment. After the virtual ECU 5 writes communication data to the transmission buffer 6a of its own virtual ECU, the virtual ECU 5 increments the transmission buffer count value of the written communication data by 1 in the transmission buffer 6a. That is, the virtual ECU 5 updates the transmission buffer count value. For example, when the transmission buffer count value is at a maximum value and the virtual ECU 5 updates the transmission buffer count value to an initial value, for example, 0. Note that, similar to the first embodiment, when writing communication data to the transmission buffer 6a, the virtual ECU 5 overwrites the communication data of the same identifier that has already been written with the communication data to be written.

[0119] In the memory area 210, a memory area count value indicating the number of times communication data has been written to the memory area 210 is provided for each identifier of the communication data. As with the memory area update flag in the first embodiment, the memory area count value is associated with communication data for each identifier of the communication data in the memory area 210. After writing communication data to the memory area 210, the management unit 1 increments the memory area count value of the written communication data in the memory area 210 by 1. That is, the management unit 1 updates the memory area count value. For example, when the management unit 1 updates the memory area count value when the memory area count value is at a maximum value, the management unit 1 updates the memory area count value to an initial value, for example, 0.

[0120] Writing of communication data to the storage area 210 is performed by the management unit 1 during a period in which the virtual control unit 5a of the virtual ECU 5 is not assigned to the control unit 20, as in the first embodiment. During the above period, the management unit 1 compares the transmission buffer count value with the storage area count value, and writes the communication data of the transmission buffer 6a to the storage area 210 when the transmission buffer count value and the storage area count value are different. In detail, when the transmission buffer count value and the storage area count value are different, the transmission buffer count value of one communication data in the transmission buffer 6a is different from the storage area count value of the one communication data in the storage area 210. In this case, the one communication data in the transmission buffer 6a is communication data that is newly transmitted from the virtual ECU 5. When the transmission buffer count value and the storage area count value are different in this way, the management unit 1 reads communication data having a transmission buffer count value different from the storage area count value from the transmission buffer 6a, and writes the communication data to the storage area 210.

[0121] After writing the communication data to the memory area 210, the management unit 1 updates the memory area count value of the communication data to the same value as the transmission buffer count value. In detail, the management unit 1 updates the memory area count value of the communication data written to the memory area 210 to the same value as the transmission buffer count value associated with the communication data having the same identifier as the identifier of the above communication data in the transmission buffer 6a.

[0122] In each of the reception buffers 6b of the virtual ECUs 5, a reception buffer update flag is provided for each identifier of the communication data, as in the first embodiment. In each of the reception buffers 6b of the virtual ECUs 5, a reception buffer count value indicating the number of times communication data has been written to the reception buffer 6b is provided for each identifier of the communication data. In the reception buffer 6b, the reception buffer count value is associated with communication data for each identifier of the communication data, as in the reception buffer update flag. After writing communication data to the reception buffer 6b of the destination virtual ECU 5, the management unit 1 increments the reception buffer count value of the written communication data by 1 in the reception buffer 6b. That is, the management unit 1 updates the reception buffer count value. For example, when the reception buffer count value is at a maximum value, the management unit 1 updates the reception buffer count value to an initial value, for example, 0.

[0123] As in the first embodiment, when the management unit 1 writes communication data to the memory area 210 and the receiving buffer 6b, the management unit 1 overwrites communication data with the same identifier that has already been written with the communication data to be written.

[0124] Writing of communication data to the reception buffer 6b is performed by the management unit 1 during a period in which the virtual control unit 5a of the virtual ECU 5 is not assigned to the control unit 20, as in the first embodiment. During the above period, the management unit 1 compares the storage area count value with the reception buffer count value of the reception buffer 6b of the virtual ECU 5 to be operated next, and writes the communication data in the storage area 210 to the reception buffer 6b when the storage area count value and the reception buffer count value are different. In more detail, when the storage area count value and the reception buffer count value are different, the storage area count value of one communication data in the storage area 210 is different from the reception buffer count value of the one communication data in the reception buffer 6b. In this case, the one communication data in the storage area 210 is communication data to be newly transmitted. When the storage area count value and the reception buffer count value are different in this way, the management unit 1 reads communication data having a storage area count value different from the reception buffer count value from the storage area 210, and writes the communication data to the reception buffer 6b.

[0125] After writing the communication data to the receive buffer 6b, the management unit 1 turns on the receive buffer update flag, as in the first embodiment. Furthermore, after writing the communication data to the receive buffer 6b, the management unit 1 updates the receive buffer count value of the communication data to the same value as the transmit buffer count value. In detail, the management unit 1 updates the receive buffer count value of the communication data written to the receive buffer 6b to the same value as the storage area count value associated in the storage area 210 with the communication data having the same identifier as the identifier of the communication data.

[0126] The virtual ECU 5 reads communication data for which the receive buffer update flag is in the ON state from the receive buffer 6b of its own virtual ECU in the same manner as in embodiment 1. After reading the communication data, the virtual ECU 5 changes the receive buffer update flag from the ON state to the OFF state.

[0127] In this embodiment, the communication data is written to the reception buffer 6b of each virtual ECU 5 based on the storage area count value and the reception buffer count value of each virtual ECU 5 as described above. For example, in the case where the communication data is written to each reception buffer 6b based on the storage area update flag as in the first embodiment, when the communication data with the storage area update flag in the ON state is written to the reception buffer 6b of all the destination virtual ECUs 5, the storage area update flag is changed to the OFF state. In this case, depending on the switching period of the virtual ECU 5, data already written to the reception buffer 6b may be written to the reception buffer 6b again. That is, the virtual ECU 5 may read the same communication data as the communication data already read. The management unit 1 writes the communication data to the reception buffer 6b based on the storage area count value and the reception buffer count value, thereby preventing the virtual ECU 5 from reading the same communication data as the communication data already read.

[0128] 8 is a flowchart illustrating a process performed by the third arithmetic device 203 functioning as the management unit 1 of the second embodiment, and a process related to generation of the virtual ECU 5 performed by the arithmetic device 200 assigned to the virtual ECU 5 of the second embodiment. In this embodiment, the arithmetic devices 200 assigned to the virtual ECU 5 are the first arithmetic device 201 and the second arithmetic device 202. For example, the third arithmetic device 203 performs the following process as the management unit 1 when an IG switch (not shown) of the vehicle C transitions from an off state to an on state. Also, the arithmetic device 200 assigned to the virtual ECU 5 performs the following process when the IG switch transitions from an off state to an on state.

[0129] The arithmetic device 200 assigned to the virtual ECU 5 performs the processes of S201 and S202. The processes of S201 and S202 are similar to the processes of S101 and S102 in the first embodiment, and therefore detailed description thereof will be omitted. The first arithmetic device 201 starts generating the first virtual ECU 51. The second arithmetic device 202 starts generating one of the second virtual ECU 52 and the third virtual ECU 53.

[0130] The arithmetic unit 200 assigned to the virtual ECU 5 performs the process of S203. The process of S203 is similar to the process of S103 in the first embodiment, and therefore detailed description thereof will be omitted. If the reception buffer update flag is not in the on state (S203: NO), the arithmetic unit 200 assigned to the virtual ECU 5 performs the process of S206 described later.

[0131] If the receive buffer update flag is in an on state (S203: YES), the arithmetic unit 200 assigned to the virtual ECU 5 performs the processes of S204, S205, S206, and S207. The processes of S204, S205, S206, and S207 are similar to the processes of S104, S105, S106, and S107 in the first embodiment, and therefore detailed description thereof will be omitted. The arithmetic unit 200 assigned to the virtual ECU 5 updates the transmit buffer count value as described above (S208).

[0132] The arithmetic unit 200 assigned to the virtual ECU 5 performs the processes of S209 and S210. The processes of S209 and S210 are similar to the processes of S109 and S110 in the first embodiment, and therefore detailed explanations are omitted. Furthermore, the arithmetic unit 200 assigned to the virtual ECU 5 performs the process of S201. The virtual ECU 5 to be generated is switched. In detail, the first arithmetic unit 201 starts generating the first virtual ECU 51 again. Furthermore, the second arithmetic unit 202 starts generating the other of the second virtual ECU 52 and the third virtual ECU 53. The arithmetic unit 200 assigned to the virtual ECU 5 ends the process, for example, when the IG switch transitions from the on state to the off state.

[0133] The third arithmetic device 203 performs the processes of S211 and S212. The processes of S211 and S212 are similar to the processes of S111 and S112 in the first embodiment, and therefore detailed description thereof will be omitted. If the allocated time of the virtual ECU 5 has not elapsed (S212: NO), the third arithmetic device 203 performs the loop process to perform the process of S212 again. If the allocated time of the virtual ECU 5 has elapsed (S212: YES), the third arithmetic device 203 performs the process of S213. The process of S213 is similar to the process of S113 in the first embodiment, and therefore detailed description thereof will be omitted. Instead of the process of S212, the third arithmetic device 203 may perform a standby process from the time when the arithmetic device 200 assigned to the virtual ECU 5 starts generating the virtual ECU 5 until the allocated time of the virtual ECU 5 has elapsed. After the standby process, the third arithmetic device 203 performs the process of S213.

[0134] The third calculation device 203 judges whether the transmission buffer count value and the storage area count value are different (S214). If the transmission buffer count value and the storage area count value are not different (S214: NO), that is, if the transmission buffer count value and the storage area count value are the same value, the third calculation device 203 performs the process of S217 described later.

[0135] If the transmission buffer count value and the storage area count value are different (S214: YES), the third calculation device 203 reads communication data having a transmission buffer count value different from the storage area count value from the transmission buffer 6a, as described above, and writes the communication data to the storage area 210 (S215). After writing the communication data to the storage area 210, the third calculation device 203 updates the storage area count value of the communication data to the same value as the transmission buffer count value (S216), as described above.

[0136] The third calculation device 203 judges whether the receive buffer count value of the receive buffer 6b of the virtual ECU 5 to be operated next is different from the storage area count value (S217). If the receive buffer count value is different from the storage area count value (S217: YES), the third calculation device 203 reads communication data having a storage area count value different from the receive buffer count value from the storage area 210, as described above, and writes the communication data to the receive buffer 6b (S218).

[0137] As described above, after writing the communication data to the reception buffer 6b, the third arithmetic unit 203 updates the reception buffer count value of the communication data (S219). Furthermore, the third arithmetic unit 203 sets the reception buffer update flag of the written communication data to an ON state (S220). The third arithmetic unit 203 performs the process of S211 and switches the virtual ECU 5 for the first arithmetic unit 201 or the second arithmetic unit 202. In detail, the third arithmetic unit 203 makes the first arithmetic unit 201 start generating the first virtual ECU 51 again. Alternatively, the third arithmetic unit 203 makes the second arithmetic unit 202 start generating the other of the second virtual ECU 52 and the third virtual ECU 53. The third arithmetic unit 203 ends the process, for example, when the IG switch transitions from an ON state to an OFF state.

[0138] If the reception buffer count value and the storage area count value are not different (S217: NO), that is, if the reception buffer count value and the storage area count value are the same value, the third arithmetic unit 203 performs the process of S211. That is, the third arithmetic unit 203 switches the virtual ECU 5 for the first arithmetic unit 201 or the second arithmetic unit 202.

[0139] In this embodiment, communication data written to the transmission buffer 6a is read based on the transmission buffer count value and the memory area count value, thereby preventing communication data that has not been updated in the transmission buffer 6a from being read.

[0140] The management unit 1 updates the memory area count value after writing communication data to the memory area 210. Since the management unit 1 reads communication data from the memory area 210 based on the receive buffer count value and the memory area count value, it is possible to prevent communication data that has not been updated in the memory area 210 from being read.

[0141] After writing communication data to the receive buffer 6b, the management unit 1 updates the receive buffer count value and sets the receive buffer update flag to the on state, thereby preventing communication data that has not been updated in the receive buffer 6b from being read.

[0142] For example, if any one of the transmission buffer count value, the reception buffer count value, and the storage area count value is not updated for a predetermined period of time or longer, the in-vehicle ECU 2 may determine that an abnormality has occurred in communication between the virtual ECUs 5.

[0143] (Embodiment 3) 9 is a block diagram illustrating a logical configuration of an in-vehicle ECU 2 according to embodiment 3. Among the configuration according to embodiment 3, components similar to those in embodiment 1 are given the same reference numerals, and detailed description thereof will be omitted. Embodiment 3 relates to an in-vehicle ECU 2 in which the arithmetic device 200 of the control unit 20 periodically switches between a period in which it functions as the management unit 1 and a period in which it functions as the virtual ECU 5.

[0144] As shown in FIG. 9, the in-vehicle ECU 2 of the third embodiment includes a control unit 20 including two arithmetic units 200, a first arithmetic unit 201 and a second arithmetic unit 202. As in the first embodiment, the first virtual ECU 51 is generated in the first arithmetic unit 201. A virtual control unit 5a of the generated first virtual ECU 51 is assigned to the first arithmetic unit 201. Furthermore, the first arithmetic unit 201 functions as a management unit 1 that manages the virtual ECU 5 generated by the first arithmetic unit 201. That is, the first arithmetic unit 201 functions as the management unit 1 that manages the first virtual ECU 51. Hereinafter, the management unit 1 that manages the virtual ECU 5 generated by the first arithmetic unit 201 is also referred to as a first management unit 11. The first management unit 11 switches the virtual ECU 5 for the first arithmetic unit 201 and causes the first arithmetic unit 201 to periodically generate the first virtual ECU 51.

[0145] Similarly to the first embodiment, the second arithmetic device 202 periodically generates the second virtual ECU 52 and the third virtual ECU 53 alternately. The virtual control unit 5a of the generated second virtual ECU 52 is assigned to the second arithmetic device 202. The virtual control unit 5a of the generated third virtual ECU 53 is assigned to the second arithmetic device 202. Furthermore, the second arithmetic device 202 functions as a management unit 1 that manages the virtual ECU 5 generated by the second arithmetic device 202. That is, the second arithmetic device 202 functions as the management unit 1 that manages the second virtual ECU 52 and the third virtual ECU 53. Hereinafter, the management unit 1 that manages the virtual ECU 5 generated by the second arithmetic device 202 is also referred to as a second management unit 12. The second management unit 12 switches the virtual ECU 5 for the second arithmetic device 202, and causes the second arithmetic device 202 to periodically generate the second virtual ECU 52 and the third virtual ECU 53 alternately.

[0146] The storage unit 21 includes a communication buffer including a first communication buffer 61, a second communication buffer 62, and a third communication buffer 63, and a storage area 210. In the storage unit 21 of the third embodiment, the virtual ECU 5 and the management unit 1 that can access the first communication buffer 61, the second communication buffer 62, the third communication buffer 63, and the storage area 210, respectively, are determined in advance. In other words, access to the communication buffer 6 and the storage area 210 is restricted. The access includes writing and reading of communication data. The communication buffer 6 and the storage area 210 are protected by the access restriction. For the above-mentioned access restriction, a memory protection device such as an MPU (Memory Protection Unit) is used.

[0147] FIG. 10 is an explanatory diagram showing an example of access restrictions for the communication buffer 6 and the storage area 210. In FIG. 10, "-" indicates that access is not possible. The first management unit 11 can access the first transmission buffer 61a and the first reception buffer 61b, and the storage area 210. That is, the first management unit 11 can access the communication buffer 6 of the virtual ECU 5 generated by the first arithmetic device 201, and the storage area 210. The first management unit 11 cannot access the communication buffer 6 of the virtual ECU 5 generated by the second arithmetic device 202. The communication buffers 6 of the virtual ECU 5 generated by the second arithmetic device 202 are the second transmission buffer 62a, the second reception buffer 62b, the third transmission buffer 63a, and the third reception buffer 63b.

[0148] The first virtual ECU 51 can access the first transmission buffer 61a and the first reception buffer 61b. That is, the first virtual ECU 51 can access the communication buffer 6 of its own virtual ECU. The first virtual ECU 51 cannot access the memory area 210, the second transmission buffer 62a and the second reception buffer 62b, and the third transmission buffer 63a and the third reception buffer 63b. That is, the first virtual ECU 51 cannot access the memory area 210 and the communication buffers 6 of the other virtual ECUs 5.

[0149] The second management unit 12 can access the second transmission buffer 62a and the second reception buffer 62b, the third transmission buffer 63a and the third reception buffer 63b, and the storage area 210. That is, the second management unit 12 can access the communication buffer 6 of the virtual ECU 5 generated by the second arithmetic device 202, and the storage area 210. The second management unit 12 cannot access the communication buffer 6 of the virtual ECU 5 generated by the first arithmetic device 201. The communication buffer 6 of the virtual ECU 5 generated by the first arithmetic device 201 is the first transmission buffer 61a and the first reception buffer 61b.

[0150] The second virtual ECU 52 can access the second transmission buffer 62a and the second reception buffer 62b. That is, the second virtual ECU 52 can access the communication buffer 6 of its own virtual ECU. The second virtual ECU 52 cannot access the memory area 210, the first transmission buffer 61a and the first reception buffer 61b, and the third transmission buffer 63a and the third reception buffer 63b. That is, the second virtual ECU 52 cannot access the memory area 210 and the communication buffers 6 of the other virtual ECUs 5.

[0151] The third virtual ECU 53 can access the third transmission buffer 63a and the third reception buffer 63b. That is, the third virtual ECU 53 can access the communication buffer 6 of its own virtual ECU. The third virtual ECU 53 cannot access the memory area 210, the first transmission buffer 61a and the first reception buffer 61b, and the second transmission buffer 62a and the second reception buffer 62b. That is, the third virtual ECU 53 cannot access the memory area 210 and the communication buffers 6 of the other virtual ECUs 5.

[0152] FIG. 11 is an explanatory diagram showing an example of communication between a plurality of virtual ECUs 5 in the third embodiment. In FIG. 11, the first management unit 11 is indicated as HV(1). The second management unit 12 is indicated as HV(2). The first arithmetic device 201 periodically switches between a period in which it functions as the first management unit 11 and a period in which it generates the first virtual ECU 51. In other words, the first arithmetic device 201 periodically switches between a period in which it functions as the first management unit 11 and a period in which it functions as the first virtual ECU 51. The second arithmetic device 202 periodically switches between a period in which it functions as the second management unit 12, a period in which it generates the second virtual ECU 52, and a period in which it generates the third virtual ECU 53. In other words, the second arithmetic device 202 periodically switches between a period in which it functions as the second management unit 12, a period in which it functions as the second virtual ECU 52, and a period in which it functions as the third virtual ECU 53. 11, the period during which the first arithmetic device 201 functions as the first management unit 11 and the period during which the second arithmetic device 202 functions as the second management unit 12 are set so as not to overlap. In Fig. 11, the solid arrows indicate writing or reading of communication data by the virtual ECU 5. The dashed arrows indicate writing or reading of communication data by the management unit 1.

[0153] As in the first embodiment, the first virtual ECU 51 writes communication data to the first transmission buffer 61a and turns on the transmission buffer flag of the communication data. The first virtual ECU 51 also reads communication data whose reception buffer update flag is on from the first reception buffer 61b and turns off the reception buffer update flag of the read communication data.

[0154] The first arithmetic device 201 functions as the first management unit 11 during a period from the time when the generation of the first virtual ECU 51 is completed to the time when the generation of the first virtual ECU 51 is started again. The period during which the first arithmetic device 201 functions as the first management unit 11 is a period during which the virtual control unit 5a of the first virtual ECU 51 is not assigned to the first arithmetic device 201. In other words, the period during which the first arithmetic device 201 functions as the first management unit 11 is a period during which the first virtual ECU 51 is not operating. During the period during which the first arithmetic device 201 functions as the first management unit 11, the first management unit 11 performs the following process.

[0155] Similar to the management unit 1 of the first embodiment, the first management unit 11 writes communication data for which the transmission buffer update flag in the first transmission buffer 61a is in the ON state to the memory area 210. After writing the communication data to the memory area 210, the first management unit 11 sets the memory area update flag of the written communication data to the ON state, and further sets the transmission buffer update flag to the OFF state.

[0156] Furthermore, the first management unit 11 writes the communication data, which has a storage area update flag in an ON state and is destined for the virtual ECU 5 to be operated next, out of the communication data written in the storage area 210, to the reception buffer of the virtual ECU 5 to be operated next. That is, the management unit 1 writes the communication data, which has a storage area update flag in an ON state and is destined for the first virtual ECU 51, to the first reception buffer 61b. After writing the communication data to the first reception buffer 61b, the first management unit 11 sets the reception buffer update flag of the written communication data to an ON state. Furthermore, the first management unit 11 sets the storage area update flag of the communication data in the storage area 210 to an OFF state. The first management unit 11 switches the virtual ECU 5 to the first arithmetic device 201. Generation of the first virtual ECU 51 is started again in the first arithmetic device 201.

[0157] Similarly to the first embodiment, the second virtual ECU 52 writes communication data to the second transmission buffer 62a and sets the transmission buffer flag of the communication data to the ON state. The second virtual ECU 52 also reads communication data whose reception buffer update flag is ON from the second reception buffer 62b and sets the reception buffer update flag of the read communication data to the OFF state.

[0158] Similarly to the first embodiment, the third virtual ECU 53 writes communication data to the third transmit buffer 63a and turns on the transmit buffer flag of the communication data. The third virtual ECU 53 also reads communication data whose receive buffer update flag is on from the third receive buffer 63b and turns off the receive buffer update flag of the read communication data.

[0159] The second arithmetic device 202 functions as the second management unit 12 during a period from the time when the generation of one of the second virtual ECU 52 and the third virtual ECU 53 is completed to the time when the generation of the other of the second virtual ECU 52 and the third virtual ECU 53 is started. The period during which the second arithmetic device 202 functions as the second management unit 12 is a period during which neither the virtual control unit 5a of the second virtual ECU 52 nor the third virtual ECU 53 is assigned to the second arithmetic device 202. In other words, the period during which the second arithmetic device 202 functions as the second management unit 12 is a period during which the second virtual ECU 52 and the third virtual ECU 53 are not operating. During the period during which the second arithmetic device 202 functions as the second management unit 12, the second management unit 12 performs the following process.

[0160] Similar to the management unit 1 of the first embodiment, the second management unit 12 writes communication data for which the transmission buffer flag is in the ON state in the second transmission buffer 62a or the third transmission buffer 63a to the memory area 210. After writing the communication data to the memory area 210, the second management unit 12 sets the memory area update flag of the written communication data to the ON state, and further sets the transmission buffer update flag of the above communication data to the OFF state.

[0161] Furthermore, the second management unit 12 writes, among the communication data written in the memory area 210, the communication data whose memory area update flag is in an on state and whose destination is the virtual ECU 5 to be operated next, to the receive buffer 6b of the virtual ECU 5 to be operated next. For example, when the virtual ECU 5 to be operated next is the second virtual ECU 52, the second management unit 12 writes, to the second receive buffer 62b, the communication data whose memory area update flag is in an on state and whose destination is the second virtual ECU 52. When the virtual ECU 5 to be operated next is the third virtual ECU 53, the second management unit 12 writes, to the third receive buffer 63b, the communication data whose memory area update flag is in an on state and whose destination is the third virtual ECU 53.

[0162] After writing the communication data to the receive buffer 6b, the second management unit 12 turns on the receive buffer update flag for the written communication data. Furthermore, the second management unit 12 turns off the storage area update flag for the above communication data in the storage area 210. The second management unit 12 switches the virtual ECU 5 to the second arithmetic device 202. Generation of the other of the second virtual ECU 52 and the third virtual ECU 53 is started in the second arithmetic device 202.

[0163] In this embodiment, a transmission buffer update flag, a storage area update flag, and a reception buffer update flag are used for transmitting and receiving communication data among the multiple virtual ECUs 5. For transmitting and receiving communication data, a transmission buffer count value, a storage area count value, a reception buffer count value, and a reception buffer update flag may be used as in the second embodiment.

[0164] Fig. 12 is a flowchart of a main routine illustrating processing performed by the arithmetic device 200 of embodiment 3. Fig. 13 is a flowchart illustrating a processing procedure of the arithmetic device 200 related to a subroutine of processing of the virtual ECU 5. Fig. 14 is a flowchart illustrating a processing procedure of the arithmetic device 200 related to a subroutine of processing of the management unit 1. For example, the arithmetic device 200 performs the following processing when an IG switch (not shown) of the vehicle C transitions from an off state to an on state.

[0165] The arithmetic device 200 starts generating the virtual ECU 5 (S31). More specifically, the first arithmetic device 201 starts generating the first virtual ECU 51. The second arithmetic device 202 starts generating one of the second virtual ECU 52 and the third virtual ECU 53. The arithmetic device 200 calls and executes a subroutine of the processing of the virtual ECU 5 (S32).

[0166] Hereinafter, the processing related to the subroutine of the processing of the virtual ECU 5 performed by the arithmetic device 200 will be described with reference to FIG. 13. The arithmetic device 200 performs the processing of S41. The processing of S41 is the same as the processing of S103 in the first embodiment, and therefore a detailed description thereof will be omitted. If the reception buffer update flag is in the on state (S41: YES), the arithmetic device 200 performs the processing of S42, S43, S44, S45, and S46. The processing of S42, S43, S44, S45, and S46 is the same as the processing of S104, S105, S106, S107, and S108 in the first embodiment, and therefore a detailed description thereof will be omitted. The arithmetic device 200 returns to the main routine. If the reception buffer update flag is not in the on state (S41: NO), the arithmetic device 200 performs the processing of S44, S45, and S46, and returns to the main routine.

[0167] As shown in Fig. 12, the arithmetic device 200 ends the generation of the virtual ECU 5 (S33). More specifically, the first arithmetic device 201 ends the generation of the first virtual ECU 51. The second arithmetic device 202 ends the generation of one of the second virtual ECU 52 and the third virtual ECU 53. The arithmetic device 200 calls and executes a subroutine of the processing of the management unit 1 (S34). The first arithmetic device 201 functions as the first management unit 11. The second arithmetic device 202 functions as the second management unit 12.

[0168] Hereinafter, the process related to the subroutine of the process of the management unit 1 performed by the arithmetic device 200 will be described with reference to Fig. 14. The arithmetic device 200 performs the process of S51. The process of S51 is similar to the process of S114 in the first embodiment, and therefore a detailed description thereof will be omitted.

[0169] If the transmission buffer update flag is on (S51: YES), the calculation device 200 performs the processes of S52, S53, and S54. The processes of S52, S53, and S54 are similar to the processes of S115, S116, and S117 in the first embodiment, and therefore detailed explanations are omitted. If the transmission buffer update flag is not on (S51: NO), the calculation device 200 performs the process of S54.

[0170] If the storage area update flag is on (S54: YES), the arithmetic device 200 performs the processes of S55 and S56 and returns to the main routine. The processes of S55 and S56 are similar to the processes of S118 and S119 in the first embodiment, so detailed explanations are omitted. If the storage area update flag is not on (S54: NO), the arithmetic device 200 returns to the main routine.

[0171] 12, the arithmetic device 200 performs the process of S31. In detail, the first arithmetic device 201 starts generating the first virtual ECU 51 again. The second arithmetic device 202 starts generating the other of the second virtual ECU 52 and the third virtual ECU 53. The period during which the arithmetic device 200 functions as the management unit 1 and the period during which the arithmetic device 200 functions as the virtual ECU 5 are switched periodically. The arithmetic device 200 ends the process when, for example, the IG switch transitions from an on state to an off state.

[0172] In this embodiment, each of the multiple arithmetic devices 200 included in the control unit 20 periodically switches between a period in which it functions as the management unit 1 and a period in which it functions as the virtual ECU 5. Since the period in which one arithmetic device 200 functions as the management unit 1 does not overlap with the period in which another arithmetic device 200 functions as the management unit 1, communication data can be exchanged between the multiple virtual ECUs 5 without causing contention in writing and reading communication data to the storage area 210.

[0173] In this embodiment, the first management unit 11 in which the first arithmetic device 201 functions as the management unit 1 can access the communication buffer 6 of the virtual ECU 5 generated by the first arithmetic device 201, but cannot access the communication buffer 6 of the virtual ECU 5 generated by the second arithmetic device 202. It is possible to prevent the first management unit 11 from erroneously writing and reading communication data to the second communication buffer 62 and the third communication buffer 63. The second management unit 12 in which the second arithmetic device 202 functions as the management unit 1 can access the communication buffer 6 of the virtual ECU 5 generated by the second arithmetic device 202, but cannot access the communication buffer 6 of the virtual ECU 5 generated by the first arithmetic device 201. It is possible to prevent the second management unit 12 from erroneously writing and reading communication data to the first communication buffer 61.

[0174] A virtual ECU 5 can access the communication buffer 6 of its own virtual ECU, but cannot access the communication buffer 6 and the storage area 210 of another virtual ECU 5. It is possible to prevent the virtual ECU 5 from erroneously writing and reading communication data to and from the communication buffer 6 of another virtual ECU 5. It is also possible to prevent the virtual ECU 5 from erroneously writing and reading communication data to and from the storage area 210.

[0175] (Embodiment 4) Among the configurations according to the fourth embodiment, the same components as those according to the first embodiment are denoted by the same reference numerals, and detailed description thereof will be omitted. The fourth embodiment relates to an in-vehicle ECU 2 in which the management unit 1 writes communication data written in the storage area 210 to a program execution area (to be described later) of the destination virtual ECU 5.

[0176] In the in-vehicle ECU 2 of the fourth embodiment, the control unit 20 includes a first arithmetic unit 201, a second arithmetic unit 202, and a third arithmetic unit 203. The first arithmetic unit 201 and the second arithmetic unit 202 generate a virtual ECU 5 in the same manner as in the first embodiment. The third arithmetic unit 203 functions as the management unit 1 in the same manner as in the first embodiment. The communication buffer 6 of the virtual ECU 5 of the fourth embodiment includes a program execution memory area for the virtual ECU 5 to execute a program. More specifically, the program execution memory area is included in the receive buffer 6b. Note that the communication buffer 6 is assigned to the memory unit 21, and therefore the program execution memory area is included in the memory unit 21. Therefore, the program execution memory area is included in the memory unit 21 for each virtual ECU 5.

[0177] The program execution memory area is a so-called variable area. When a program is executed, communication data used for executing the program is written into the program execution memory area of ​​the virtual ECU 5 that executes the program. During the execution of the program, the program execution memory area into which the communication data is written is indicated as a logical address.

[0178] The virtual ECU 5 writes the communication data to the transmission buffer 6a and sets the transmission buffer update flag, similar to the embodiment 1. The management unit 1 writes the communication data written to the transmission buffer 6a to the memory area 210 based on the transmission buffer update flag, similar to the embodiment 1, and sets the memory area update flag.

[0179] When the storage area update flag is in an ON state, the management unit 1 writes the communication data, for which the storage area update flag is in an ON state, to a program execution storage area included in the receive buffer 6b of the destination virtual ECU 5. The program execution storage area is included in the receive buffer 6b, and is therefore included in the storage unit 21. When writing the communication data to the program execution storage area, the management unit 1 refers to, for example, an address table and writes the communication data to a logical address of the program execution storage area where a program using the communication data is executed. In detail, the management unit 1 writes the communication data to a physical address corresponding to the above logical address in the storage unit 21. The communication data is exchanged between a plurality of virtual ECUs 5. FIG. 15 is a conceptual diagram illustrating the contents of an address table. In the address table of FIG. 15, an identifier of the communication data, a logical address to which the communication data is written, and a physical address to which the communication data is written are stored for each identifier. After writing the communication data, the management unit 1 sets the receive buffer update flag of the communication data to an ON state. When the reception buffer update flag is in an on state, the virtual ECU 5 executes a program using the written communication data.

[0180] The method by which the management unit 1 writes communication data to the program execution storage area is not limited to the method using an address table. For example, the management unit 1 may write communication data to the program execution storage area using a function that outputs a logical address to which the communication data is to be written or a physical address to which the communication data is to be written when the management unit 1 receives communication data or an identifier of the communication data. The address table or the above function is stored in the storage unit 21, for example, a virtual storage unit included in each virtual ECU 5.

[0181] In this embodiment, the communication buffer 6 includes a program execution memory area for executing a program. The program execution memory area is a so-called variable area, and is provided for each virtual ECU 5. The program execution memory area is indicated by a logical address. The management unit 1 writes the communication data written in the memory area 210 to the program execution memory area of ​​the destination virtual ECU 5. Since the management unit 1 directly writes the communication data to the program execution memory area, the virtual ECU 5 does not need to perform processing for writing the communication data to the program execution memory area. Therefore, the processing performed by the virtual ECU 5 can be reduced.

[0182] For example, the receive buffer 6b in the first embodiment does not include a program execution storage area. When the virtual ECU 5 in the first embodiment executes a program, it is necessary to read the communication data written in the receive buffer 6b and write the communication data in an area of ​​the logical address associated with the identifier of the communication data among the areas of the storage unit 21 allocated to the virtual ECU 5. That is, when the virtual ECU 5 executes a program, it is necessary to read the communication data written in the receive buffer 6b and write the read communication data in the program execution storage area.

[0183] The in-vehicle ECU 2 may be configured to use a transmission buffer count value, a storage area count value, a reception buffer count value, and a reception buffer update flag as in the second embodiment for transmitting and receiving communication data between the plurality of virtual ECUs 5. The in-vehicle ECU 2 may be configured to switch between a period in which each of the arithmetic devices 200 functions as the management unit 1 and a period in which each of the arithmetic devices 200 functions as a virtual ECU 5 as in the third embodiment.

[0184] The embodiments disclosed herein are illustrative in all respects and should not be considered as limiting. The scope of the present disclosure is defined by the claims, not by the above meaning, and is intended to include all modifications within the scope and meaning equivalent to the claims. [Explanation of symbols]

[0185] A. Recording medium C Vehicle S In-vehicle system P Control Program 1 Management Department 11 1st Management Department 12 2nd Management Department 2 In-vehicle ECU 20 Control section 200 Computing equipment 201 1st calculation unit 202 2nd arithmetic unit 203 Third calculation unit 21 Memory section 210 Storage area 22 In-vehicle communication unit 3 In-vehicle equipment 30 Actuator 31 Sensors 4. In-vehicle network 5 Virtual ECU (Virtual Device) 5a Virtual control section 51 First virtual ECU 52 Second virtual ECU 53 3rd virtual ECU 6 Communication Buffer 6a Send Buffer 6b Receive Buffer 61 First communication buffer 61a First transmit buffer 61b First receive buffer 62 Second communication buffer 62a Second transmit buffer 62b Second receive buffer 63 Third communication buffer 63a Third transmit buffer 63b Third receive buffer

Claims

1. A control unit that executes a plurality of programs; a storage unit in which a virtualized operating system to be started by the control unit is stored; By booting the virtualized operating system, a plurality of virtual devices that serve as operating environments for the programs are generated, The virtual device is The storage unit includes a communication buffer in which communication data exchanged in communication between the plurality of virtual devices is written, the communication buffer being divided into areas and allocated to the storage unit; When communicating with another virtual device, the communication data for the other virtual device is written into the communication buffer of the virtual device itself; A management unit for managing a plurality of the virtual devices, reading the communication data written in the communication buffer of the virtual device during a period when the virtual device is not operating; writing the read communication data into a storage area accessible by the management unit; writing the communication data written in the storage area to the communication buffer of the other virtual device during a period when the other virtual device, which is the destination of the communication data, is not operating; The other virtual device reads the communication data from the virtual device that has been written to the communication buffer of the virtual device. In-vehicle device.

2. The control unit includes a plurality of arithmetic units, One of the plurality of arithmetic units functions as the management unit, The remaining computing devices among the plurality of computing devices function as the virtual device. The in-vehicle device according to claim 1 .

3. The control unit includes a plurality of arithmetic units, Each of the computing devices comprises: Functioning as the management unit, Acting as the virtual device, periodically switching between a period during which the device functions as the management unit and a period during which the device functions as the virtual device; A period during which one of the plurality of arithmetic devices functions as the management unit does not overlap with a period during which another of the plurality of arithmetic devices functions as the management unit. The in-vehicle device according to claim 1 .

4. one of the computing devices functions as the management unit that manages the virtual device generated in the one of the computing devices; The management unit, which manages the virtual device generated in one of the computing devices, The communication buffer and the memory area of ​​the virtual device generated in one of the computing devices are accessible; the communication buffer of the virtual device created on the other computing device is inaccessible; The virtual device is The communication buffer of the virtual device can be accessed; The communication buffer and the storage area of ​​the other virtual device are inaccessible. The vehicle-mounted device according to claim 3.

5. the communication buffer includes a receive buffer into which the communication data received by the virtual device is written; The virtual device is When a reception buffer update flag indicating that the communication data written to the reception buffer has been updated is in an on state, the communication data written to the reception buffer is read; After reading the communication data, the reception buffer update flag is changed from an on state to an off state. The vehicle-mounted device according to any one of claims 1 to 4.

6. the communication buffer includes a transmission buffer in which the communication data to be transmitted from the virtual device to the other virtual device is written; After writing the communication data to the transmission buffer, the virtual device turns on a transmission buffer update flag indicating that the communication data written to the transmission buffer has been updated; The management unit If the transmission buffer update flag is in an on state, the communication data written in the transmission buffer of the virtual device is written to the storage area; After writing the communication data to the storage area, the transmission buffer update flag is changed from an ON state to an OFF state; Furthermore, a storage area update flag indicating that the communication data written in the storage area has been updated is set to an ON state; When the storage area update flag is in an on state, the communication data written in the storage area is written to the reception buffer of the other virtual device; After writing the communication data to the receiving buffer, the receiving buffer update flag is set to an ON state; Furthermore, the storage area update flag is changed from the ON state to the OFF state. The vehicle-mounted device according to claim 5 .

7. the communication buffer includes a transmission buffer in which the communication data to be transmitted from the virtual device to the other virtual device is written; After writing the communication data to the transmission buffer, the virtual device updates a transmission buffer count value indicating the number of times the communication data has been written to the transmission buffer; The management unit if the transmission buffer count value is different from a storage area count value indicating the number of times the communication data has been written to the storage area, writing the communication data written to the transmission buffer of the virtual device to the storage area; After writing the communication data to the storage area, the storage area count value is updated to the same value as the transmission buffer count value; if the storage area count value is different from a receive buffer count value indicating the number of times the communication data has been written to the receive buffer, writing the communication data written to the storage area to the receive buffer of the other virtual device; After writing the communication data to the receiving buffer, the receiving buffer count value is updated to the same value as the storage area count value; Furthermore, the receive buffer update flag is set to ON. The vehicle-mounted device according to claim 5 .

8. the communication buffer includes a program execution storage area for executing the program, the management unit writes the communication data written in the storage area to the program execution storage area of ​​the virtual device of a destination; The program execution storage area is a storage area in which communication data used for executing the program is written. The in-vehicle device according to any one of claims 1 to 7.

9. generating a plurality of virtual devices in the in-vehicle device, the virtual devices being operating environments for a plurality of programs; When the virtual device communicates with another virtual device, the virtual device writes communication data to the other virtual device into a communication buffer included in the virtual device and into which the communication data exchanged in the communication between the plurality of virtual devices is written; A management unit for managing a plurality of the virtual devices, reading the communication data written in the communication buffer of the virtual device during a period when the virtual device is not operating; writing the read communication data into a storage area accessible by the management unit; writing the communication data written in the storage area to the communication buffer of the other virtual device during a period when the other virtual device, which is the destination of the communication data, is not operating; The other virtual device reads the communication data from the virtual device that has been written to the communication buffer of the virtual device. Information processing methods.

10. A computer program for causing a computer installed in a vehicle to execute processing, generating a plurality of virtual devices which serve as operating environments for a plurality of programs; When the virtual device communicates with another virtual device, the virtual device writes communication data to the other virtual device into a communication buffer included in the virtual device and into which the communication data exchanged in the communication between the plurality of virtual devices is written; A management unit for managing a plurality of the virtual devices, reading the communication data written in the communication buffer of the virtual device during a period when the virtual device is not operating; writing the read communication data into a storage area accessible by the management unit; writing the communication data written in the storage area to the communication buffer of the other virtual device during a period when the other virtual device, which is the destination of the communication data, is not operating; The other virtual device reads the communication data from the virtual device that has been written to the communication buffer of the virtual device. A computer program that causes a computer to carry out processing.

Images