Electronic control device for vehicle and control method using electronic control device for vehicle

Abstract

To provide an electronic control device for a vehicle capable of improving operational reliability.SOLUTION: An electronic control device for a vehicle comprises a processor and a memory, where the processor executes the periodic task of first processing to control a vehicle and the periodic task of second processing with higher priority than the first processing, using a calculated value by the periodic task of the first processing. The memory includes a first area and a second area capable of writing in by the first processing and spare areas of the first area and of the second area. The processor duplicates the calculated value and writes the same in the second area, and also writes the same even in the spare areas of the first area and of the second area before finishing the periodic task after the processor writes the calculated value in the first area of the memory in the periodic task of the first processing. Moreover, the processor checks the consistency of the calculated value based on the values in the first area and in the second area, and on the values in the spare areas of the first area and of the second area in the periodic task of the second processing.SELECTED DRAWING: Figure 7

Description

[Technical field]

[0001] The present invention relates to a vehicle electronic control device and a control method using the vehicle electronic control device. [Background technology]

[0002] ISO26262, a functional safety standard for electronic control of vehicles, defines ASIL (Automotive Safety Integrity Level) as an index for achieving functional safety. As an example of a vehicle control device that executes processes with a high safety level based on such ASIL, a technology has been proposed that divides the memory area used by ASIL processing from the memory area used by QM (Quality Management) processing that executes normal control processing. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2017-199294 A Summary of the Invention [Problem to be solved by the invention]

[0004] Here, in a configuration in which both a periodic task of ASIL processing and a periodic task of QM processing are executed in a vehicle control device, a calculated value by the periodic task of QM processing may be used in the periodic task of ASIL processing. In this case, the calculated value may be duplicated and written to a memory in QM processing, and the consistency of the calculated value written to the memory may be checked based on the duplicated value in ASIL processing. However, QM processing generally has a lower priority than ASIL processing, and when the processing load of the vehicle control device becomes large, a delay may occur in the periodic task of QM processing due to interrupt processing or the like. In this case, even though the calculation of QM processing itself is executed normally, a check by ASIL processing is performed before QM processing duplicates and writes the calculated value, so that an error may be erroneously detected. Note that such a problem may occur not only in QM processing and ASIL processing, but also in general cases in which processes of different priorities are executed in cooperation with each other in a vehicle control device.

[0005] Therefore, one aspect of the present invention aims to suppress false detection of errors that occur due to delays in low-priority processing in a vehicle control device, and to improve the reliability of operation of the vehicle control device. [Means for solving the problem]

[0006] In one aspect of the present invention, an electronic control device for a vehicle includes a processor that executes a periodic task of a first process for controlling a vehicle and a periodic task of a second process that is a process higher in priority than the first process and uses a calculated value by the periodic task of the first process, and an electrically rewritable memory, and is configured as follows: First, the memory includes a first area and a second area that can be written by the first process, and a spare area of ​​the first area and a spare area of ​​the second area. Then, when the processor executes the periodic task of the first process, it writes the calculated value of the periodic task to the first area of ​​the memory, and then writes the calculated value in duplicate to the second area and writes the calculated value to the spare area of ​​the first area and the spare area of ​​the second area before the periodic task is terminated. Furthermore, when the processor executes the periodic task of the second process, it checks the consistency of the calculated value based on the value in the first area and the value in the second area and the value in the spare area of ​​the first area and the spare area of ​​the second area. Effect of the Invention

[0007] According to the present invention, false detection of an error caused by a delay in a low-priority process in a vehicle control device is suppressed, and the reliability of the operation of the vehicle control device can be improved. [Brief description of the drawings]

[0008] [Figure 1] FIG. 2 is a block diagram showing an example of an electronic control device according to an embodiment of the present invention. [Diagram 2] 2 is a block diagram showing an example of a CPU, a memory, etc., of an electronic control device according to an embodiment of the present invention. FIG. [Diagram 3] FIG. 1 is an explanatory diagram showing a specific example of processing of an electronic control device in the prior art; [Figure 4] FIG. 1 is an explanatory diagram showing a specific example of processing of an electronic control device in the prior art; [Diagram 5] 4 is a flowchart showing an example of QM processing in an electronic control device according to an embodiment of the present invention. [Figure 6] 5 is a flowchart showing an example of ASIL processing in an electronic control device according to an embodiment of the present invention. [Figure 7] FIG. 2 is an explanatory diagram showing a specific example of processing of an electronic control device according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, specific examples of embodiments for carrying out the present invention will be described in detail with reference to the attached drawings. Note that in some of the drawings, only the reference numerals of the components are given, and the names of the components are omitted.

[0010] [Configuration of the Electronic Control Device of the Present Embodiment] FIG. 1 shows an example of an electronic control device 1 mounted on a vehicle such as an automobile. The electronic control device 1 is configured to electronically control an engine 2, which is a drive source for driving a vehicle, and includes a microcomputer 10. The microcomputer 10 includes a CPU 11, a RAM 12, and a ROM 13. The electronic control device 1 also includes an input / output interface 14, a communication interface 15, and an internal bus 16 that connects these interfaces so that they can communicate with each other.

[0011] The CPU 11 is hardware that executes a set of instructions (such as data transfer, calculation, processing, control, and management) written in a program, and includes a calculation unit, registers that store instructions and information, peripheral circuits, etc. The CPU 11 loads the program stored in the ROM 13 into the RAM 12 and executes it.

[0012] The RAM 12 is a volatile memory in which data is lost when the power supply is cut off, and provides a temporary storage area that is used by the CPU 11 during operation. The ROM 13 is a non-volatile memory that is electrically rewritable, and includes, for example, a flash ROM or an EEPROM. The ROM 13 stores a startup program that runs when the electronic control unit 1 is started, a control program that controls the in-vehicle devices, and data such as parameters used in the processing of the programs.

[0013] The input / output interface 14 is composed of an A / D converter, a D / A converter, a D / D converter, etc., and provides an input / output function of analog signals and digital signals to external devices. The microcomputer 10 is connected to the engine 2, which is the object to be controlled, via the input / output interface 14, and receives signals from various sensors while transmitting control signals to the engine 2. The communication interface 15 is configured with, for example, a CAN (Controller Area Network) transceiver or the like, and provides a function for connecting to an in-vehicle network or the like. The internal bus 16 is a path for exchanging data between devices, and includes an address bus for transferring addresses, a data bus for transferring data, and a control bus for transmitting timing and control information for actual input / output on the address bus and data bus.

[0014] The engine 2 is a power plant including an internal combustion engine, and is a drive source for driving the vehicle. The electronic control unit 1 electronically controls the intake cam, exhaust cam, injector, spark plug, ignition coil, throttle, and other components of the engine 2 based on required torque based on accelerator and brake operation and input signals from various sensors, thereby controlling the output torque to the wheels. When the rotation speed of the engine 2 increases and the number of input signals used for engine control increases, the processing load on the microcomputer 10 of the electronic control unit 1 increases.

[0015] Next, the CPU 11 and the RAM 12 included in the microcomputer 10 will be described in more detail with reference to FIG. The CPU 11 includes a QM processing unit 111 and an ASIL processing unit 112 that are realized by the CPU 11 executing a program.

[0016] In ISO26262, processes are classified into QM and ASIL (ASIL-A, ASIL-B, ASIL-C, ASIL-D) in order from the least dangerous process to the most dangerous process based on functional safety requirements. QM process is a control process to which normal operation guarantee is applied, and ASIL process is a control process to which higher safety is required than QM process. In other words, ASIL process is more important than QM process and has a higher priority. In the vehicle control device 1 of this embodiment, among the control processes of the engine 2, the QM processing unit 111 executes normal control processes as QM processes, while the ASIL processing unit 112 executes control processes with a higher priority as ASIL processes. Note that the QM process is an example of a first process, and the ASIL process is an example of a second process.

[0017] Furthermore, the CPU 11 includes an MPU (Memory Protection Unit) 113 that realizes a memory protection function. The memory protection function is a function that detects and prevents unauthorized use of memory due to unintended program processing, and divides memory and register areas and performs access control for each area. For example, the memory protection function makes it possible to divide areas to which access is permitted depending on program processing, and to prevent interference between processes. In this embodiment, the function of the MPU 113 divides the area of ​​the RAM 12 into an area used by the QM processing executed by the QM processing unit 111 and an area used by the ASIL processing executed by the ASIL processing unit 112.

[0018] The RAM 12 includes a QM label 121, a QM duplex label 122, a QM buffer 123, and a QM duplex buffer 124, which are areas used by the QM processing executed by the QM processing unit 111. The RAM 12 also includes an ASIL label 125, which is an area used by the ASIL processing executed by the ASIL processing unit 112.

[0019] The QM processing executed by the QM processing unit 111 can write to the QM label 121, the QM duplex label 122, the QM buffer 123, and the QM duplex buffer 124. However, due to the memory protection function of the MPU 113 described above, writing to the ASIL label 125 by the QM processing is not permitted and is not possible. For this reason, when a calculated value by the QM processing is used in the ASIL processing executed by the ASIL processing unit 112, the value written to the QM label 121 is read by the ASIL processing, and the value is written to the ASIL label 125 for use. Note that the QM label 121, the QM duplex label 122, the QM buffer 123, the QM duplex buffer 124, and the ASIL label 125 are examples of the first area, the second area, the spare area of ​​the first area, the spare area of ​​the second area, and the third area, respectively.

[0020] [Differences between this embodiment and the prior art] Here, in order to clarify the explanation of the present invention, the following describes the differences in configuration between a conventional electronic control device and the electronic control device 1, which is an example of the embodiment of the present invention described above, and describes the issues (problems) of the conventional technology. In the conventional electronic control device, like the electronic control device 1 of the present embodiment described above, the RAM is provided with areas corresponding to the QM label 121 and the QM duplicated label 122. However, unlike the electronic control device 1 described above, the RAM of the conventional electronic control device does not include areas corresponding to the QM buffer 123 and the QM duplicated buffer 124.

[0021] 3 is a diagram showing a specific example of processing in such a conventional electronic control device. In this specific example, the QM processing unit executes a periodic task of QM processing every 10 ms (milliseconds) in the background.

[0022] In the periodic task of the QM processing, the QM processing unit writes the calculated value to the QM label (S901). As a result, the value of the QM label, which was "0xFF", is rewritten to "0x01". The QM processing unit then reads out the value "0x01" written to the QM label (S902). The QM processing unit then writes the same value as the read QM label value, "0x01", to the QM duplication label (S903). As a result, the value of the QM duplication label, which was "0xFF", is also rewritten to "0x01".

[0023] Then, the ASIL processing unit performs ASIL processing using the calculation value written in the QM label. At this time, the ASIL processing unit checks the consistency of the calculation value written in the memory by the QM processing to confirm whether the QM processing has been performed normally. Specifically, the ASIL processing unit reads both the value written in the QM label and the value written in the QM duplex label (S904). Then, the ASIL processing unit checks whether the value of the QM label and the value of the QM duplex label match. In the case of the example of FIG. 3, at this timing, the value of the QM label and the value of the QM duplex label are both "0x01". Therefore, the ASIL processing unit writes the value of "0x01" to the ASIL label (S905) and continues processing. In this case, no error is detected in the check of the consistency of the calculation value written in the QM label.

[0024] On the other hand, Figure 4 is a diagram showing a specific example of a case in which, in processing in such a conventional electronic control device, when a 10 ms periodic task of QM processing is executed in the background, the load on the control processing of engine 2 increases, causing a delay in QM processing.

[0025] As in the case of FIG. 3, in the periodic task of QM processing, the QM processing unit writes the calculated value to the QM label (S911). As a result, the value of the QM label, which was "0xFF", is rewritten to "0x01". Normally, the QM processing unit would then read the value written to the QM label and write it to the QM duplicated label. However, an interrupt process occurs due to the engine rotation process signal, causing a delay in the low-priority QM processing, resulting in a situation in which the periodic task of QM processing does not end within 10 ms. On the other hand, delays due to interrupt processing are less likely to occur in high-priority ASIL processing.

[0026] In such a case, before the QM label value is written to the QM duplicated label by the QM processing, the ASIL processing unit reads both the QM label value and the QM duplicated label value (S912) and checks that the two values ​​match. At this time, the QM label value is "0x01", while the QM duplicated label value is "0xFF", and the two values ​​do not match. For this reason, the ASIL processing unit writes an alternative value to the ASIL label that allows control processing to be executed safely (S913). At this time, the MPU also detects that an error has occurred in the RAM value.

[0027] After that, the QM processing unit reads the value of the QM label (S914) and writes the same value as the read QM label value "0x01" to the QM duplication label (S915). As a result, the value of the QM duplication label, which was "0xFF", is also rewritten to "0x01". In this way, the calculation of the QM processing itself is performed normally, and the value of the QM label and the value of the QM duplication label match at this timing. However, as described above, the delay in the periodic task of the QM processing has already caused the MPU to detect an error. As such, in the conventional technology, there is a problem that when the QM processing is delayed, an error that does not actually need to be detected is erroneously detected.

[0028] [Processing in the Electronic Control Unit of the Present Embodiment] The electronic control device 1, which is an example of an embodiment of the present invention, can solve such problems by including a QM buffer 123 and a QM dual buffer 124 as shown in Fig. 2. Hereinafter, the processing in the electronic control device 1, which is an embodiment of the present invention, will be described with reference to Figs. 1 and 2 as well as Figs. 5 to 7.

[0029] FIG. 5 shows processing related to access to the RAM 12 among the periodic tasks of the QM processing executed by the QM processor 111. In step 1001 (denoted as S1001 in the figure), the QM processing unit 111 writes a calculated value by a periodic task of the QM processing into the QM label 121. In step 1002, the QM processing unit 111 reads the value written in the QM label 121 at a predetermined timing until the periodic task of the QM processing is completed.

[0030] In step 1002 , the QM processing unit 111 writes the same value as that written in the QM label 121 into the QM duplicate label 122 . In step 1003, the QM processing unit 111 writes the same value as that written in the QM label 121 into the QM buffer 123 and the QM duplicate buffer 124. Note that it is desirable to minimize the time difference between the processing of step 1002 and the processing of step 1003.

[0031] FIG. 6 shows processing related to access to the RAM 12 in the periodic task of the ASIL processing executed by the ASIL processing unit 112. In step 1011 , the ASIL processing unit 112 reads the value of the QM label 121 and the value of the QM duplex label 122 . In step 1012, the ASIL processing unit 112 checks the consistency of the calculation value written to the RAM 12 by the periodic task of the QM processing. Specifically, the ASIL processing unit 112 checks whether the value of the QM label 121 matches the value of the QM duplication label 122. If they match, the process proceeds to step 1013, and if they do not match, the process proceeds to step 1015. In step 1013 , the ASIL processing unit 112 writes the value of the QM label 121 into the ASIL label 125 .

[0032] In step 1014 , the ASIL processing unit 112 reads the value of the QM buffer 123 and the value of the QM dual buffer 124 . In step 1015, the ASIL processing unit 112 further checks the consistency of the calculation value written by the periodic task of the QM processing, using the value of the QM buffer 123 and the value of the QM duplex buffer 124. More specifically, the ASIL processing unit 112 checks whether the value of the QM buffer 123 and the value of the QM duplex buffer 124 match. If they match, the process proceeds to step 1016, and if they do not match, the process proceeds to step 1017.

[0033] In step 1016, the ASIL processing unit 112 writes the value of the QM buffer 123 to the ASIL label 125. In this case, the value of the QM label 121 does not match the value of the QM duplex label 122, but the value of the QM buffer 123 matches the value of the QM duplex buffer 124, so that the MPU 113 does not detect an error. In step 1017, the ASIL processing unit 112 writes an alternative value that enables safe execution of the control processing to the ASIL label 125. At this time, the MPU 113 detects that an error has occurred in the value of the RAM 12. However, as described above, a consistency check is performed based on the value of the QM buffer 123 and the value of the QM duplex buffer 124, and therefore at least erroneous detection of unnecessary errors due to delays in the periodic task of the QM processing is suppressed.

[0034] Fig. 7 is a diagram showing a specific example of a case where a load in the control processing of the engine 2 increases and a delay occurs in the QM processing when a 10 ms periodic task of the QM processing is executed in the background in the processing of the electronic control unit 1 according to this embodiment as in the conventional technology shown in Fig. 4. Note that the reference numerals of the steps shown in Fig. 7 match the reference numerals of the corresponding steps in the processing by the QM processing unit 111 shown in Fig. 4 and the processing by the ASIL processing unit 112 shown in Fig. 5.

[0035] In the periodic task of the QM processing, the QM processing unit 111 writes a calculated value to the QM label 121 (S1001). As a result, the value of the QM label 121, which was "0xFF", is rewritten to "0x01". Thereafter, normally, the QM processing unit 111 reads the value written to the QM label 121 and writes it to the QM duplicated label 122. However, because an interrupt process occurs due to the engine rotation process signal, a delay occurs in the low-priority QM processing, and a situation occurs in which the periodic task of the QM processing does not end within 10 ms. On the other hand, delays due to interrupt process are unlikely to occur in the high-priority ASIL processing.

[0036] For this reason, the ASIL processing unit 112 reads out both the value of the QM label 121 and the value of the QM duplex label 122 (S1011) before the value of the QM label 121 is written to the QM duplex label 122 by step 1002 of the QM processing. Then, the ASIL processing unit 112 checks whether the value of the QM label 121 matches the value of the QM duplex label 122. At this time, the value of the QM label 121 is "0x01", while the value of the QM duplex label 122 is "0xFF", and the two values ​​do not match.

[0037] Therefore, the ASIL processing unit 112 further reads out both the value of the QM buffer 123 and the value of the QM duplex buffer 124 (S1014). At this time, the value of the QM buffer 123 and the value of the QM duplex buffer 124 are both "0xFF", and therefore, the two are the same. Therefore, the ASIL processing unit 112 writes the value of "0xFF" to the ASIL label 125 (S1016) and continues processing.

[0038] Thereafter, the QM processing unit 111 reads the value of the QM label 121 (S1002), and writes the same value as the read value of the QM label 121 to the QM duplex label 122 (S1003). That is, the QM processing unit 111 rewrites the value of the QM duplex label 122, which was "0xFF", to "0x01". At this time, the QM processing unit 111 also writes the value of the QM label 121 to the QM buffer 123 and the QM duplex buffer 124. That is, the QM processing unit 111 rewrites the values ​​of the QM buffer 123 and the QM duplex buffer 124, which were "0xFF", to "0x01".

[0039] As a result, a delay occurs in the periodic task of the next QM processing, and when a check is performed by ASIL processing after the QM processing unit 111 rewrites the value of the QM label 121 and before writing the value of the QM label 121 to the QM duplication label 122, the following state occurs. That is, at the timing when the check is performed, a new value is written to the QM label 121 by the periodic task of the next QM processing, but the value of the QM duplication label 122 remains "0x01". Therefore, the value of the QM label 121 does not match the value of the QM duplication label 122. However, in the QM buffer 123 and the QM duplication buffer 124, "0x01" written in the periodic task described above is maintained as it is until the value of the QM label 121 is newly written together with the QM duplication label 122 by the periodic task of the next QM processing. Therefore, the values ​​of the QM buffer 123 and the QM duplication buffer 124 match, making it possible to suppress the detection of unnecessary errors.

[0040] [Effects of this embodiment] As described above, according to the present embodiment, the RAM 12 of the electronic control device 1 includes the QM buffer 123 and the QM duplex buffer 124. When the QM processing unit 111 duplicates and writes the calculated value of the QM label 121 to the QM duplex label 122 in the periodic task of the QM processing, the same value is also written to the QM buffer 123 and the QM duplex buffer 124. When the ASIL processing unit 122 checks the value of the QM label 121 and the value of the QM duplex label 122 in the periodic task of the ASIL processing, if the two do not match, the check is performed using the QM buffer 123 and the QM duplex buffer 124. Therefore, even when a check is performed by the ASIL processing in a state in which the duplex processing of the value of the QM label 121 to the QM duplex label 122 has not been completed, it is possible to suppress the detection of an error. Therefore, for example, in a case where a delay occurs in the QM processing but the calculation of the QM processing itself is performed normally, it is possible to suppress the erroneous detection of an unnecessary error. As a result, the reliability of the operation of the electronic control device 1 is further improved.

[0041] In the electronic control device 1 of the present embodiment, ASIL processing and QM processing based on ISO26262 are executed as an example, but the present invention can be applied to other configurations as long as the electronic control device is configured to execute multiple periodic tasks with different priorities. More specifically, the present invention can be applied to any electronic control device that executes ASIL processing and QM processing, as long as the electronic control device has a configuration in which a periodic task of a high-priority process checks the consistency of a calculated value written to memory by a periodic task of a low-priority process.

[0042] Furthermore, in the electronic control device 1 of this embodiment, the RAM 12 is divided by the memory protection function of the MPU 113 to control access and detect errors, but this configuration is not essential to the implementation of the present invention. In other words, the present invention can be implemented as long as the configuration allows processes with different priorities to use different memory areas and allows a program (function) to be executed that performs error processing when the values ​​in the multiple areas do not match.

[0043] In addition, the electronic control device 1 of this embodiment controls the engine 2 as an example, but the control target of the electronic control device to which the present invention can be applied is not limited to this. For example, the control target may be an electric drive unit (motor) of a hybrid vehicle, an electric vehicle, or the like, as a drive source for running the vehicle. Furthermore, the control target of the electronic control device 1 is not limited to the drive source for running the vehicle, and the present invention can also be applied to an electronic control device that performs control processing of other in-vehicle devices that generate periodic tasks.

[0044] The above-described embodiments of the present invention are merely some of the possible implementations within the technical scope of the present invention, and are disclosed as examples of the present invention, and do not limit the technical scope of the present invention. Furthermore, the functional configurations and physical configurations in each embodiment are not limited to the above-described aspects, and for example, each function or physical resource can be integrated and implemented, or conversely, can be further distributed and implemented, and further, some of the configurations can be added, deleted, or replaced with other configurations. [Explanation of symbols]

[0045] 1...electronic control device, 10...microcomputer, 11...CPU, 12...RAM, 13...ROM, 111...QM processing unit, 112...ASIL processing unit, 113...MPU, 121...QM label, 122...QM duplicated label, 123...QM buffer, 124...QM duplicated buffer, 125...ASIL label

Claims

1. An electronic control device for a vehicle, comprising: a processor that executes a periodic task of a first process for controlling a vehicle and a periodic task of a second process that is a process having a higher priority than the first process and uses a calculated value obtained by the periodic task of the first process; and a memory that is electrically rewritable, the memory includes a first area and a second area that can be written by the first process, a spare area for the first area, and a spare area for the second area; the processor is configured to, when executing a periodic task of the first processing, write the arithmetic value of the periodic task to the first area of ​​the memory, and then, during a period until the periodic task is terminated, write the arithmetic value in duplicate to the second area and write the arithmetic value to a spare area of ​​the first area and a spare area of ​​the second area; and, when executing a periodic task of the second processing, check consistency of the arithmetic value based on a value in the first area and a value in the second area and a value in the spare area of ​​the first area and a value in the spare area of ​​the second area. Electronic control device for vehicles.

2. 2. The electronic control device for a vehicle according to claim 1, wherein the processor is configured to determine whether the value in the first area and the value in the second area match when executing the periodic task of the second process, and if the value in the first area and the value in the second area do not match, to further determine whether the value in the reserve area of ​​the first area and the value in the reserve area of ​​the second area match, and if the value in the reserve area of ​​the first area and the value in the reserve area of ​​the second area match, not to detect an error in checking the normality of the calculated value.

3. the memory includes a third area that cannot be written to by the first process but can be written to by the second process; 3 . The electronic control device for a vehicle according to claim 1 , wherein the processor writes the value in the first area to the third area when executing the periodic task of the second process.

4. 4. The electronic control device for a vehicle according to claim 1, wherein the first processing is a QM processing, and the second processing is an ASIL processing.

5. a processor that executes a periodic task of a first process for controlling a vehicle and a periodic task of a second process that is a process having a higher priority than the first process and uses a calculated value of the periodic task of the first process; and a memory that is electrically rewritable and includes a first area and a second area that can be written to by the first process, a spare area for the first area, and a spare area for the second area, when executing a periodic task of the first process, writing the arithmetic value of the periodic task to the first area of ​​the memory, and then, during a period until the periodic task is terminated, writing the arithmetic value in the second area in a duplicated manner and writing the arithmetic value to a spare area of ​​the first area and a spare area of ​​the second area; checking consistency of the calculated value based on the value of the first area and the value of the second area and the value of the reserve area of ​​the first area and the value of the reserve area of ​​the second area when executing the periodic task of the second process; A control method using an electronic control device for a vehicle.

Images