On-vehicle control device, control method, and computer program

Abstract

To allow an in-vehicle control device including a plurality of virtual machines to function more efficiently.SOLUTION: An in-vehicle control device mounted on a vehicle comprises: a physical resource including a control unit, a storage unit, and a communication unit; and a management unit which allocates the physical resource for each allocation time, and generates a plurality of virtual machines. The plurality of virtual machines includes: a first virtual machine which communicates with an external device disposed outside the in-vehicle control device and which executes processing which cannot be carried over to the next cycle; and a second virtual machine which executes processing which can be carried over to the next cycle. When a prescribed condition indicative of degradation of the external device is satisfied, the management unit executes a first control to extend the allocation time of the first virtual machine and reduce the allocation time of the second virtual machine.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The present disclosure relates to an in-vehicle control device, a control method, and a computer program. [Background technology]

[0002] Virtualization technology that configures one computer as if it were multiple computers has been known for some time. For example, Patent Document 1 discloses a technology that configures multiple VMs (Virtual Machines) in an ECU (Electronic Control Unit) installed in a vehicle using a hypervisor function.

[0003] In Patent Document 1, a VM configuration unit included in an ECU switches VMs based on the allocated time set for each VM. For example, after a processing time of 60 msec is allocated to a body control VM, a processing time of 40 msec is allocated to a multimedia VM.

[0004] If a VM's processing time exceeds its allocated time, the excess processing is postponed to the next cycle, and the accumulation of postponed processing can cause processing delays. When the processing time of a body control VM exceeds its allocated time, the VM configuration unit of Patent Document 1 adds the excess time (the time obtained by subtracting the processing time from the allocated time) of other VMs with lower priority than the body control VM to the allocated time of the body control VM. For example, if the processing of a multimedia VM has 15 msec of excess time, the VM configuration unit shortens the allocated time of the multimedia VM to 25 msec and extends the allocated time of the body control VM to 75 msec. This technique of Patent Document 1 suppresses processing delays. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Patent Publication No. 2021-60923 Summary of the Invention [Problem to be solved by the invention]

[0006] For example, when a VM performs processing that cannot be carried over to the next cycle (real-time processing), the VM's allocated time may be the expected processing time plus a certain amount of margin time. In such a VM, if the processing time exceeds the allocated time, the processing that was being performed up to that point may end in failure, and it may become necessary to restart the processing in the next cycle, etc.

[0007] The technology of Patent Document 1 does not take real-time processing into consideration, so there is a risk that the spare time that needs to be secured will be used as allocated time for other VMs, which may result in processing failures in the VM whose allocated time has been reduced (i.e., the VM with less spare time).

[0008] When a VM communicates with a device other than the ECU that constitutes the VM (for example, an external device such as a sensor), the processing time of the VM may increase due to the aging of the external device. Conventionally, excessive margin time was set in anticipation of the increase in processing time due to aging, which meant that the functions of the ECUs that constitute multiple VMs could not be efficiently utilized.

[0009] The present disclosure has been made in consideration of the above circumstances, and aims to enable an in-vehicle control device including multiple virtual machines to function more efficiently. [Means for solving the problem]

[0010] The vehicle control device of the present disclosure is an vehicle control device mounted on a vehicle, and includes physical resources including a control unit, a memory unit, and a communication unit, and a management unit that allocates the physical resources for each allocation time to generate multiple virtual machines, wherein the multiple virtual machines include a first virtual machine that communicates with an external device located outside the vehicle control device and executes processing that cannot be carried over to the next cycle, and a second virtual machine that executes processing that can be carried over to the next cycle, and the management unit executes a first control that extends the allocation time of the first virtual machine and shortens the allocation time of the second virtual machine when a predetermined condition indicating deterioration of the external device is met.

[0011] The control method disclosed herein is a control method for controlling an on-board control device mounted on a vehicle, and includes a generation step of allocating physical resources including a control unit, a memory unit, and a communication unit for each allocated time to generate multiple virtual machines, and a control step of extending the allocated time of a first virtual machine among the multiple virtual machines and shortening the allocated time of a second virtual machine among the multiple virtual machines when a predetermined condition indicating deterioration of an external device provided outside the on-board control device is met, wherein the first virtual machine is a virtual machine that communicates with the external device and executes processing that cannot be carried over to the next cycle, and the second virtual machine is a virtual machine that executes processing that can be carried over to the next cycle.

[0012] The computer program of the present disclosure is a computer program for controlling an on-board control device installed in a vehicle, the computer program causing a computer to execute a generation step of allocating physical resources including a control unit, a memory unit, and a communication unit for each allocated time to generate multiple virtual machines, and a control step of extending the allocated time of a first virtual machine among the multiple virtual machines and shortening the allocated time of a second virtual machine among the multiple virtual machines when a predetermined condition indicating deterioration of an external device provided outside the on-board control device is met, wherein the first virtual machine is a virtual machine that communicates with the external device and executes processing that cannot be carried over to the next cycle, and the second virtual machine is a virtual machine that executes processing that can be carried over to the next cycle. [Effects of the Invention]

[0013] According to the present disclosure, an in-vehicle control device including multiple virtual machines can function more efficiently. [Brief explanation of the drawings]

[0014] [Figure 1] FIG. 1 is a schematic diagram illustrating an on-board control device according to the first embodiment and its peripheral configuration. [Figure 2] FIG. 2 is a diagram illustrating the problem to be solved by the first embodiment. [Figure 3] FIG. 3 is a flowchart illustrating the control method according to the first embodiment. [Figure 4] FIG. 4 is a diagram illustrating an update table according to the first embodiment. [Figure 5] FIG. 5 is a diagram illustrating a change in the allocated time according to the first embodiment. [Figure 6] FIG. 6 is a flowchart illustrating a control method according to the second embodiment. [Figure 7] FIG. 7 is a diagram illustrating a change in the allocated time according to the second embodiment. [Figure 8]FIG. 8 is a diagram illustrating a change in the allocated time according to the second embodiment. [Figure 9] FIG. 9 is a diagram illustrating a margin time according to a modified example. DETAILED DESCRIPTION OF THE INVENTION

[0015] <Summary of Embodiments of the Present Disclosure> The following provides an outline of embodiments of the present disclosure.

[0016] (1) The vehicle control device of the present disclosure is an in-vehicle control device mounted on a vehicle, and includes physical resources including a control unit, a memory unit, and a communication unit, and a management unit that allocates the physical resources for each allocated time to generate multiple virtual machines, the multiple virtual machines including a first virtual machine that communicates with an external device located outside the vehicle control device and executes processing that cannot be carried over to the next cycle, and a second virtual machine that executes processing that can be carried over to the next cycle, and the management unit executes a first control to extend the allocated time of the first virtual machine and shorten the allocated time of the second virtual machine when a predetermined condition indicating deterioration of the external device is met.

[0017] Even if the processing time of the first virtual machine becomes longer than the initially allocated time due to deterioration of the external device, the management unit determines the deterioration of the external device based on predetermined conditions and extends the allocated time of the first virtual machine, thereby preventing the processing of the first virtual machine from failing. With this configuration, it is possible to prevent the initial setting of excessive margin time for the first virtual machine while allowing the processing of the first virtual machine to continue even after long-term use, thereby allowing the on-board control device to function efficiently.

[0018] (2) The predetermined condition may include a time that a predetermined time or more has elapsed since a reference time point, a time that the external device has operated for a predetermined time or more since the reference time point, or a time that the vehicle has traveled a predetermined distance or more since the reference time point. The reference time point may include a time point when use of the external device starts or a time point when the allocated time of the first virtual machine is extended.

[0019] With this configuration, the management unit can more easily determine the deterioration of the external device.

[0020] (3) The memory unit may store a first allocation time and a second allocation time longer than the first allocation time, and the management unit may set the allocation time of the first virtual machine to the first allocation time before the specified condition is satisfied, and set the allocation time of the first virtual machine to the second allocation time when the specified condition is satisfied.

[0021] The management unit can set the first allocated time and the second allocated time stored in advance as the allocated time of the first virtual machine, thereby reducing the processing load of the management unit for calculating the allocated time.

[0022] (4) The memory unit may store a table that corresponds information regarding the specified conditions with an allocation time of the first virtual machine, including the first allocation time and the second allocation time, and the management unit may extend the allocation time of the first virtual machine based on the allocation time obtained by referring to the table in the first control.

[0023] By storing the allocated time in advance as a table, the processing load for calculating the allocated time in the management unit can be reduced.

[0024] (5) After executing the first control, the management unit may further execute a second control to further change the allocated time of each of the first virtual machine and the second virtual machine, and the second control may include control to acquire a processing time of the first virtual machine in a first cycle, and control to extend the allocated time of the first virtual machine and shorten the allocated time of the second virtual machine in cycles after the first cycle when a margin time calculated based on the acquired processing time and the allocated time set for the first virtual machine or a rate of change in the margin time falls below a first predetermined value.

[0025] With this configuration, the first control extends the allocated time of the first virtual machine to an allocated time that takes into account an increase in processing time due to aging of the external device, and then the allocated time of the first virtual machine can be further extended to take into account a temporary increase in processing time due to disturbances in the external device, etc. This makes it possible to set the allocated time of the first virtual machine more in line with the current situation, thereby enabling the on-board control device to perform its functions more efficiently.

[0026] (6) The management unit may execute the second control when the number of retries of the first virtual machine to communicate with the external device increases.

[0027] With this configuration, the management unit executes the second control when an increase in the processing time of the first virtual machine is expected, thereby reducing the control load on the management unit.

[0028] (7) After executing the second control, the management unit may further execute a third control to change the allocated time of each of the first virtual machine and the second virtual machine, and the third control may include a control to acquire a processing time of the first virtual machine in a second cycle subsequent to the first cycle, and a control to set a margin time calculated based on the acquired processing time and the allocated time of the first virtual machine changed in the first control to the first predetermined value. Greater thanWhen the average time of the first virtual machine exceeds a second predetermined value, the average time of the second virtual machine is reduced and the average time of the second virtual machine is increased in the second and subsequent cycles.

[0029] As the idle time of the first virtual machine increases, the management unit shortens the allocated time of the first virtual machine, thereby preventing excessive idle time and allowing the vehicle control device to perform its functions more efficiently.

[0030] (8) The management unit may execute the third control when the number of retries of the first virtual machine to communicate with the external device decreases.

[0031] With this configuration, the management unit executes the third control when a reduction in the processing time of the first virtual machine is expected, thereby reducing the control load on the management unit.

[0032] (9) The control method disclosed herein is a control method for controlling an on-board control device mounted on a vehicle, and includes a generation step of allocating physical resources including a control unit, a memory unit, and a communication unit for each allocated time to generate multiple virtual machines, and a control step of extending the allocated time of a first virtual machine among the multiple virtual machines and shortening the allocated time of a second virtual machine among the multiple virtual machines when a predetermined condition indicating deterioration of an external device provided outside the on-board control device is met, wherein the first virtual machine is a virtual machine that communicates with the external device and executes processing that cannot be carried over to the next cycle, and the second virtual machine is a virtual machine that executes processing that can be carried over to the next cycle.

[0033] Even if the processing time of the first virtual machine becomes longer than the initially allocated time due to deterioration of the external device, the control step determines the deterioration of the external device based on a predetermined condition and extends the allocated time of the first virtual machine, thereby preventing the processing of the first virtual machine from failing. With this configuration, it is possible to prevent the initial setting of excessive margin time for the first virtual machine while allowing the processing of the first virtual machine to continue even after long-term use, thereby allowing the on-board control device to function efficiently.

[0034] (10) A computer program of the present disclosure is a computer program for controlling an on-board control device mounted on a vehicle, the computer program causing a computer to execute a generation step of allocating physical resources including a control unit, a memory unit, and a communication unit for each allocated time to generate multiple virtual machines, and a control step of extending the allocated time of a first virtual machine among the multiple virtual machines and shortening the allocated time of a second virtual machine among the multiple virtual machines when a predetermined condition indicating deterioration of an external device provided outside the on-board control device is met, wherein the first virtual machine is a virtual machine that communicates with the external device and executes processing that cannot be carried over to the next cycle, and the second virtual machine is a virtual machine that executes processing that can be carried over to the next cycle.

[0035] Even if the processing time of the first virtual machine becomes longer than the initially allocated time due to deterioration of the external device, the control step determines the deterioration of the external device based on a predetermined condition and extends the allocated time of the first virtual machine, thereby preventing the processing of the first virtual machine from failing. With this configuration, it is possible to prevent the initial setting of excessive margin time for the first virtual machine while allowing the processing of the first virtual machine to continue even after long-term use, thereby allowing the on-board control device to function efficiently.

[0036] <Details of the embodiment of the present disclosure> Hereinafter, the details of the embodiments of the present invention will be described with reference to the drawings.

[0037] [1. First embodiment] [1.1 On-board control device and its peripheral configuration] FIG. 1 is a schematic diagram illustrating an on-board control device 1 according to the first embodiment and its peripheral configuration. The on-board control device 1 is a device mounted on a vehicle V1, and is also referred to as an ECU (Electronic Control Unit). The vehicle V1 is, for example, an automobile, but the type of the vehicle V1 is not particularly limited. In addition to the on-board control device 1, the vehicle V1 is also mounted with a plurality of external devices 30. The plurality of external devices 30 includes a plurality of ECUs 31, a plurality of sensors 32, and a plurality of communication devices 33.

[0038] The ECU 31 is, for example, a device (operation system ECU) that controls each part of the vehicle V1 (for example, a braking system, doors, a battery, an air conditioner, etc.). The function of the ECU 31 is not particularly limited, and the ECU 31 may be a device (cognition system ECU) that communicates with a sensor 32 and monitors the state of each part of the vehicle V1. The ECU 31 is connected to, for example, a communication unit 16 (described later) via a communication line 31a.

[0039] The sensor 32 is, for example, a LiDAR (Light Detection and Ranging) for monitoring the periphery of the vehicle V1. The sensor 32 is not particularly limited, and may be a temperature sensor that detects the temperature inside the vehicle V1 or a human presence sensor that detects that a person has gotten into the vehicle V1. The sensor 32 is connected to, for example, the communication unit 16 (described later) via a communication line 32a.

[0040] The communication device 33 is, for example, a TCU (Telematics Communication Unit), and performs wireless communication with the external device 4 via a network such as the Internet. The communication device 33 is connected to, for example, a communication unit 16 (described later) via a communication line 33a.

[0041] The external device 4 is a device installed outside the vehicle V1. The external device 4 is, for example, a server including a control unit, a storage unit, and a communication unit. The storage unit of the external device 4 stores, for example, a program or data for controlling the on-board control device 1 and the ECU 31. For example, the manufacturer of the on-board control device 1 or the ECU 31 modifies the program or data as needed and stores the modified program or data in the storage unit of the external device 4 as needed. The communication unit of the external device 4 transmits the modified program or data to the communication device 33 as update data.

[0042] The in-vehicle control device 1 is an ECU that functions as multiple VMs (Virtual Machines) 13 using a virtualization technology described below. That is, the in-vehicle control device 1 is an integrated ECU that functions as multiple virtual ECUs. The functions of each of the multiple VMs 13 are not particularly limited. For example, the VM 13 may be a device that relays update data input from a communication device 33 to the ECU 31. In this case, the VM 13 may, for example, relay data transmitted or received by multiple ECUs 31 present on multiple local area networks (LANs) in a network environment in which multiple different LANs exist within the vehicle V1, like a central gateway (CGW). Furthermore, the VM 13 may be a device that controls each part of the vehicle V1, or a device that monitors the status of each part of the vehicle V1, similar to the ECU 31 described above.

[0043] [1.2 Internal structure of the on-board control unit] The on-board control device 1 includes various physical resources 11 and a management unit 12 that allocates the physical resources 11 to generate multiple VMs 13. The physical resources 11 include a control unit 14, a storage unit 15, a communication unit 16, and a reading unit 17. The control unit 14, the storage unit 15, the communication unit 16, and the reading unit 17 are electrically connected to one another by, for example, a bus.

[0044] The control unit 14 is, for example, a central processing unit (CPU), or may be a graphics processing unit (GPU) or an integrated circuit such as a field-programmable gate array (FPGA).

[0045] The storage unit 15 has a volatile memory and a nonvolatile memory, and stores various data. The volatile memory is, for example, a random access memory (RAM). The nonvolatile memory includes, for example, a flash memory, a hard disk drive (HDD), a solid state drive (SSD), or a read only memory (ROM).

[0046] The storage unit 15 stores, in non-volatile memory, for example, a computer program 15a, a virtualized operating system 15b (hereinafter referred to as "virtualized OS 15b"), and a guest operating system 15c (hereinafter referred to as "guest OS 15c").

[0047] The reading unit 17 reads information from a computer-readable recording medium 18. The recording medium 18 is, for example, an optical disc such as a CD or a DVD, or a USB flash memory. The reading unit 17 is, for example, an optical drive or a USB terminal. A plurality of computer programs 15a, a virtualized OS 15b, and a plurality of guest OSs 15c are recorded on the recording medium 18, and by having the reading unit 17 read the recording medium 18, the plurality of computer programs 15a, the virtualized OS 15b, and the plurality of guest OSs 15c are stored in the non-volatile memory of the storage unit 15.

[0048] The plurality of computer programs 15a include a program for realizing the function of the management unit 12, and a program (application program) for realizing an application 13b (described later) in the plurality of VMs 13.

[0049] The multiple guest OSs 15c are OSs for running the VMs 13. The guest OSs 15c are not particularly limited, and may be, for example, Autosar (registered trademark), Linux (registered trademark), Android (registered trademark), QNX (registered trademark), or Ubuntu (registered trademark).

[0050] The computer programs 15a, the virtualized OS 15b, and the guest OSs 15c may be transmitted from the external device 4 and stored in the storage unit 15 via the communication device 33 and the communication unit 16.

[0051] The communication unit 16 includes a first communication interface that connects to the plurality of ECUs 31 via communication lines 31a, a second communication interface that connects to the plurality of sensors 32 via communication lines 32a, and a third communication interface that connects to the communication device 33 via communication line 33a. The communication standards of the communication lines 31a, 32a, and 33a are not particularly limited, but may be, for example, CAN or Ethernet (registered trademark). The communication standards of the communication lines 31a, 32a, and 33a may be the same or different.

[0052] The control unit 14 reads out the computer program 15a, the virtualized OS 15b, and the guest OS 15c from the storage unit 15, and executes various calculations and processes based on these 15a to 15c, thereby realizing various functions described below. The various operations of the management unit 12 and the multiple VMs 13 are realized by the calculations and processes of the control unit 14.

[0053] The management unit 12 appropriately allocates the physical resources 11 based on the virtualized OS 15b to create a plurality of virtual environments in which a plurality of VMs 13 can operate. The virtualized OS 15b is, for example, a hypervisor (registered trademark). Note that the virtualized OS 15b may be other virtualization software. For example, the virtualized OS 15b may be host-type virtualization software or container-type virtualization software.

[0054] Each of the multiple VMs 13 includes virtual hardware configured by allocating physical resources 11 for each allocation time. The virtual hardware includes, for example, a virtual control unit, a virtual memory unit, and a virtual communication unit. The VM 13 runs a guest OS 13a on the virtual hardware and various applications 13b on this guest OS, thereby functioning like a real physical ECU (e.g., ECU 31). The guest OS 13a corresponds to one guest OS 15c allocated by the management unit 12 among the multiple guest OSs 15c stored in the memory unit 15.

[0055] The multiple VMs 13 include VM 21, VM 22, and VM 23. Hereinafter, when there is no need to distinguish between VM 21, VM 22, and VM 23, they will be collectively referred to as "VM 13." In the example of FIG. 1, the management unit 12 generates these three VMs 13, but the management unit 12 may generate four or more VMs 13.

[0056] The VM 21 is a VM that communicates with the external device 30. The VM 21 is a VM that executes processing that requires real-time performance (real-time processing). The VM 21 is a VM that transmits a request signal to the external device 30 and receives data transmitted from the external device 30 in response to the request signal. For example, the VM 21 is a VM that receives data from a sensor 32, performs various processes on the data, and then transmits the data to the other VMs 22 and 23. The VM 21 may be a VM that relays various data, such as update data, provided from the external device 4 via the communication device 33 to the other VMs 22 and 23 and the ECU 31.

[0057] The VM22 is a VM that does not communicate with the external device 30. More specifically, the VM22 is a VM that completes processing within the on-board control device 1. The VM22 is also a VM that executes real-time processing. For example, the VM22 is a VM that determines the state of each part of the vehicle V1 based on data transmitted from the VM21 to the VM22. The VM22 transmits, for example, data related to the determination result to the VM21.

[0058] The VM 23 is a VM that executes processing that does not relatively require real-time performance. The VM 23 is, for example, a VM for managing the quality of the on-board control device 1. For example, the VM 23 may collect processing information of the VMs 21 and 22 (for example, a history of the processing content, processing time, etc.) and evaluate whether the VMs 21 and 22 are functioning efficiently.

[0059] [1.3 Problems to be Solved by the First Embodiment] 2 is a diagram illustrating the problem to be solved by the first embodiment. In FIG. 2, (a) and (b) are timing charts showing the allocated time of each of the VMs 21, 22, and 23. The management unit 12 allocates the operation time of each of the VMs 21, 22, and 23 for each predetermined cycle T. In other words, the management unit 12 functions as a scheduler.

[0060] See Fig. 2(a). In a predetermined cycle T1 (hereinafter also referred to as "first cycle T1"), the management unit 12 first allocates physical resources 11 to the VM 21 for an allocation time X11. The VM 21 executes a predetermined process using the allocated physical resources 11. Hereinafter, the time during which the VM actually executes the process is referred to as "processing time." The VM 21 executes the predetermined process by spending a processing time Z11 during the allocation time X11.

[0061] In the first cycle T1, the VM21 executes a process (real-time process) that cannot be carried over to the next cycle T2 (hereinafter also referred to as the "second cycle T2"). In other words, if the process of the VM21 does not end within the allocated time X11, the process fails. In other words, the process of the VM21 is a process that cannot be interrupted and resumed across cycles. For this reason, the allocated time X11 is set longer than the processing time Z11 so that the processing time Z11 falls within the allocated time X11 (X11 > Z11). Hereinafter, the time of the allocated time that is not used for VM processing will be referred to as "blank time." The blank time Y11 included in the allocated time X11 can be calculated by subtracting the processing time Z11 from the allocated time X11 (Y11 = X11 - Z11).

[0062] Similarly, in the first cycle T1, the VM 22 executes a process (real-time process) that cannot be carried over to the second cycle T2. Therefore, the allocated time X12 of the VM 22 includes a processing time Z12 during which the VM 22 executes the process and a margin time Y12 that is not used for the process of the VM 22.

[0063] In the first cycle T1, VM23 executes a process that can be carried over to the second cycle T2. That is, if the process of VM23 does not finish after using up the allocated time X13 of VM23, for example, it can be interrupted and resumed in the allocated time X13 of VM23 in the next second cycle T2. Therefore, the allocated time X13 of VM23 is entirely used as processing time and does not include margin time. Note that the allocated time X13 may include margin time.

[0064] When the first cycle T1 ends, the management unit 12 similarly allocates the allocated times X11, X12, and X13 to the VMs 21, 22, and 23, respectively, and executes the second cycle T2.

[0065] 2(a) shows a timing chart in a state where, for example, a brand new external device 30 (for example, a brand new sensor 32) is used. In the case of a brand new external device 30, the external device 30 has hardly deteriorated, so there is no delay in the processing of the VM 21 that communicates with the external device 30, and the processing time Z11 is within the allocated time X11.

[0066] 2(b) shows a timing chart in a state where an aged and deteriorated external device 30 is being used. When the external device 30 deteriorates, for example, the signal output from the external device 30 becomes unstable, and it may take a longer time for the VM 21 to receive data from the external device 30 (for example, the sensor 32).

[0067] More specifically, if the signal output from the external device 30 is an abnormal signal (the signal strength is weak or extremely strong, or the value indicated by the signal is extremely low or extremely high), the VM 21 that receives the signal requests the external device 30 to transmit the signal again (communication retry). If the number of times that the VM 21 retries communication with the external device 30 increases, the time until the VM 21 receives the desired data (normal data) from the external device 30 increases accordingly. This increases the processing time Z11 of the VM 21.

[0068] 2(b), if the processing time Z11 becomes longer than the allocated time X11, the VM 21 is forced to interrupt the processing midway, and the processing of the VM 21 fails. For example, if the processing of the VM 21 is to receive the current value of the sensed data from the sensor 32, and the desired sensed data cannot be received from the sensor 32 within the allocated time X11, the processing fails.

[0069] Then, since the processing of VM21 cannot be carried over to the next second cycle T2, the processing is executed from the beginning in the second cycle T2 as well (the processing is restarted). For example, when VM21 receives the current value of the detection data from the sensor 32, VM21 needs to acquire the value currently detected by the sensor 32. Therefore, after the processing is interrupted in the first cycle T1, in the next second cycle T2, VM21 does not continue to receive the past detection data at the time of the first cycle T1 from the sensor 32, but receives the current value of the detection data of the sensor 32 in the second cycle T2.

[0070] Furthermore, since the sensor 32 has already deteriorated over time, the signal output from the sensor 32 remains unstable even during the allocated time X11 of the second cycle T2, and there is a risk that the processing time Z11 of VM21 will be longer than the allocated time X11 in the second cycle T2, resulting in the processing of VM21 failing.

[0071] In this way, if the processing time Z11 increases due to aging deterioration of the external device 30, there is a risk that the VM 21 will continuously suffer from processing defects. One possible solution to this problem is to set the allocated time X11 of the VM 21 to be excessive in order to ensure extra margin time Y11 in anticipation of the increase in processing time Z11. However, because the margin time Y11 is the time during which the VM 21 does not execute processing, if the margin time Y11 accounts for a large proportion of the allocated time X11 (if the margin time Y11 is long), the functions of the in-vehicle control device 1, which is made up of multiple VMs 13, cannot be efficiently performed.

[0072] Therefore, in this embodiment, the allocated time X11 is not set excessively, but is initially set to an allocated time X11 suitable for the VM 21 that communicates with a brand new external device 30. Then, when a predetermined condition that causes the external device 30 to deteriorate (for example, the passage of a predetermined time) is met, the management unit 12 extends the allocated time X11 of the VM 21. Furthermore, the management unit 12 shortens the allocated time X13 of the VM 23 that executes a process that can be carried over to the next cycle so that the total time of the cycle does not change due to the extension of the allocated time X11.

[0073] That is, the management unit 12 shortens the allocated time X11 of the VM 21 while there is no deterioration in the external device 30 (i.e., while the output of the external device 30 is relatively stable). For example, the initial allocated time X11 is made shorter than the increased processing time Z11 expected when the external device 30 deteriorates. This keeps the proportion of the margin time Y11 in the allocated time X11 relatively small, allowing the in-vehicle control device 1 to efficiently perform its functions. Then, when there is a risk that the external device 30 will deteriorate over time, the management unit 12 extends the allocated time X11 of the VM 21 to suppress processing defects in the VM 21. This allows the in-vehicle control device 1 to function efficiently for a longer period of time.

[0074] The control method by the management unit 12 of the first embodiment will be described in detail below.

[0075] [1.4 Control Method] Fig. 3 is a flowchart illustrating a control method according to the first embodiment. Fig. 3 shows various controls executed by the management unit 12. These controls are realized by the management unit 12 reading the computer program 15a from the storage unit 15 and executing various calculations and processes. The order of the steps shown in Fig. 3 may be changed as appropriate.

[0076] First, the management unit 12 monitors whether or not a predetermined condition that would cause deterioration of the external device 30 is satisfied (step ST11). The management unit 12 may perform the monitoring of step ST11 as needed or periodically (for example, every other week).

[0077] The predetermined conditions include, for example, the following (1), (2), or (3). (1) A predetermined time or more has elapsed since the predetermined reference point P1. (2) The external device 30 has been operating for a predetermined time or longer since the reference time point P1. (3) The vehicle V1 has traveled a distance equal to or greater than a predetermined distance since the reference point P1.

[0078] In the above (1), the management unit 12 determines that the external device 30 has deteriorated based on the time that has passed since the reference time point P1, regardless of whether the external device 30 has been operated or whether the vehicle V1 has been driven. For example, the management unit 12 starts counting from the reference time point P1 using a timer built into the CPU or the like, and determines that the predetermined condition is satisfied when the count reaches or exceeds a predetermined time.

[0079] In the above (2), the management unit 12 determines that the external device 30 has deteriorated based on the operating time of the external device 30. For example, the management unit 12 uses a timer built into the CPU or the like to count from a reference time point P1 only while the external device 30 is operating, and determines that the predetermined condition is satisfied when the count reaches or exceeds a predetermined time.

[0080] In the above (3), the management unit 12 determines that the external device 30 has deteriorated based on the mileage of the vehicle V1. For example, the management unit 12 acquires data on the mileage of the vehicle V1 from a sensor 32 that detects the mileage of the vehicle V1, and determines that the predetermined condition is satisfied when the mileage from the reference time point P1 is equal to or greater than a predetermined distance.

[0081] Here, the reference time point P1 includes, for example, the following (4) or (5). (4) When the external device 30 starts to be used (5) When the allocated time for VM21 is extended

[0082] In the above (4), the management unit 12 sets the reference time P1 as, for example, the time when the external device 30 is newly connected to the in-vehicle control device 1. Therefore, for example, when the old external device 30 is replaced with a new external device 30, the counts of the above (1) to (3) are reset. On the other hand, even if the allocated time of the VM 21 is extended, the counts are not reset.

[0083] In the above (5), the management unit 12 sets the time point when the first control (step ST16) described below is executed as the reference time point P1. Therefore, when the allocated time of the VM 21 is extended in step ST16, the counts of the above (1) to (3) are reset. On the other hand, even if the external device 30 is replaced, the counts are not reset.

[0084] The reference time point P1 may include both the above (4) and (5). That is, the counts of the above (1) to (3) may be reset both when the external device 30 is replaced and when the allocated time of the VM 21 is extended.

[0085] If the predetermined condition is not satisfied (NO in step ST11), the management unit 12 repeats the monitoring in step ST11. On the other hand, if the predetermined condition is satisfied (YES in step ST11), the management unit 12 acquires the updated allocation time (step ST12). Specifically, the management unit 12 acquires the update table shown in FIG. 4 from the storage unit 15.

[0086] 4 is a diagram illustrating an example of an update table according to the first embodiment. The update table is a table in which a predetermined time or a predetermined distance corresponds to each allocated time of VMs 21, 22, and 23, and is stored as parameters in storage unit 15. In the example of FIG. 4, VMs 21 and 23, which are the VMs 13 to be updated, are listed in the first column, and the allocated times of VMs 21, 22, and 23 for each predetermined time are listed in the second and subsequent columns. Details of the update table will be described later.

[0087] The update table may be stored in the external device 4. In this case, when step ST12 is executed, the management unit 12 acquires the update table from the external device 4 via the network and communication device 33. That is, the management unit 12 may acquire the update table in a timely manner using OTA (Over The Air) technology.

[0088] After acquiring the update table, the management unit 12 sets the value of the variable i to "1" (step ST13), and determines whether the variable i is equal to or less than the number N of VMs 13 configured by the on-board control device 1 (step ST14). In the example of Fig. 1, since the number of VMs 13 is three (N = 3), the first step ST14 proceeds to the YES route.

[0089] Next, the management unit 12 determines whether the i-th VM 13 is an update target (step ST15). Here, in the example of FIG. 1, VM 21 is defined as the first VM, VM 22 as the second VM, and VM 23 as the third VM. In the first step ST15, the management unit 12 determines whether VM 21, which is the first VM 13, is an update target. In this example, VMs 21 and 23 are update targets, but VM 22 is not an update target. Therefore, in the first step ST15, the management unit 12 proceeds with the process along the YES route.

[0090] Next, the management unit 12 updates the allocated time of the i-th VM 13 (step ST16). Specifically, the management unit 12 refers to the update table and updates the allocated time of the VM 21. Here, the update table will be specifically described with reference to FIGS. 4 and 5.

[0091] 5A and 5B are diagrams illustrating the updating of the allocated time according to the first embodiment, in which (a) is a timing chart showing the allocated time before updating, and (b) is a timing chart showing the allocated time after updating.

[0092] The update table in FIG. 4 illustrates an example in which the predetermined condition is (1) or (2) above and the reference time point P1 is (4) above. For example, if a time that is equal to or greater than a predetermined time D1 but less than a predetermined time D2 has elapsed since the reference time point P1, the management unit 12 sets the allocated time of VM 21 to "X11," the allocated time of VM 22 to "X12," and the allocated time of VM 23 to "X13." The predetermined time D1 is, for example, "0," and the allocated times X11, X12, and X13 are initial values ​​of the allocated times of VMs 21, 22, and 23. For example, as shown in FIG. 5(a), when the external device 30 is replaced with a new one or the like and use of the external device 30 begins, the management unit 12 refers to the update table in the storage unit 15 and sets the initial allocated times X11, X12, and X13 for VMs 21, 22, and 23.

[0093] If a time that is equal to or greater than predetermined time D2 but less than predetermined time D3 has elapsed since reference time point P1, management unit 12 refers to the third column (column D2) of the update table. Then, as shown in FIG. 5(b), when updating VM21, management unit 12 sets the allocated time to "X21," which is longer than X11, and when updating VM23, management unit 12 sets the allocated time to "X23," which is shorter than X13. Since VM22 is not subject to an allocation time update when the allocated time is equal to or greater than predetermined time D2 but less than predetermined time D3, no value is entered in the update table. The predetermined time D2 is, for example, 30 days, and the predetermined time D3 is, for example, 90 days.

[0094] The increase in the allocated time from X11 to X21 is equal to the decrease in the allocated time from X13 to X23 (X21-X11=X13-X23). Therefore, the cycles before and after updating the allocated time of VMs 21 and 23 are equal (X11+X12+X13=X21+X12+X23).

[0095] Similarly, if a predetermined time D3 or more has passed since the reference time point P1, the management unit 12 refers to the fourth column (column of D3) of the update table and sets the allocated time of VM21 to "X31" and the allocated time of VM23 to "X33." X31 is longer than X21, and X33 is shorter than X23. In this way, the management unit 12 gradually increases the allocated time of VM21 and gradually decreases the allocated time of VM23 as the predetermined time elapses (or as the predetermined distance becomes longer). In this case, too, the increase in the allocated time from X21 to X31 is equal to the decrease in the allocated time from X23 to X33 (X31-X21=X23-X33).

[0096] In the following explanation, consider an example in which the predetermined condition of step ST11 is satisfied when a predetermined time D2 has elapsed since the reference time point P1. In this case, in the first step ST16, the management unit 12 extends the allocated time of VM21 from "X11" to "X21." Next, the management unit 12 adds "1" to the variable i (step ST17). As a result, the variable i becomes "2."

[0097] After step ST17, the management unit 12 returns to step ST14. Since the variable i (=2) is still less than or equal to the number N (=3) of VMs 13, the second step ST14 also proceeds along the YES route. Next, the management unit 12 executes step ST15 for the second time. VM22, which is the second VM 13, does not communicate with the external device 30 and is a VM that performs real-time processing, so it is not an update target. Therefore, in the second step ST15, the management unit 12 proceeds along the NO route and skips step ST16. Next, the management unit 12 adds "1" to the variable i (step ST17). As a result, the variable i becomes "3".

[0098] After the second step ST17, the management unit 12 executes the third step ST14. Since the variable i (=3) is equal to or less than the number N (=3) of VMs 13, the third step ST14 also proceeds to the YES route. Next, the management unit 12 executes the third step ST15, and since VM23 is the update target, proceeds to the YES route and shortens the allocated time of VM23 from "X13" to "X23" by referring to the update table (step ST16). Next, the management unit 12 adds "1" to the variable i, setting the variable i to "4" (step ST17).

[0099] After the third step ST17, the management unit 12 executes the fourth step ST14. Since the variable i (=4) is larger than the number N (=3) of VMs 13, 4 The process proceeds to the NO route in step ST14 for the second time, and the series of controls by the management unit 12 ends. The series of controls from step ST11 to step ST17 described above is also referred to as "first control" as appropriate.

[0100] As described above, the management unit 12 determines the deterioration of the external device 30 based on predetermined conditions in relation to the schedule management of multiple VMs 13, and if deterioration of the external device 30 is expected, extends the allocated time of VM 21 (a VM that communicates with the external device 30 and performs real-time processing).

[0101] 5(b), even if the processing time Z11 of VM21 becomes longer than the initial allocated time X11 due to deterioration of the external device 30, the allocated time can be extended from "X11" to "X21" to prevent the processing of VM21 from failing. With this configuration, it is possible to prevent the margin time Y11 from being set too long initially, while allowing the processing of VM21 to continue even after long-term use, thereby allowing the on-board control device 1 to function efficiently.

[0102] Furthermore, in response to extending the allocated time of VM 21, the management unit 12 shortens the allocated time of VM 23, which executes processing that can be carried over to the next cycle. That is, the management unit 12 frees up additional time to be allocated to VM 21 by shortening the allocated time of VM 23. Because the processing of VM 23 can be interrupted midway and resumed in the next cycle, even if the allocated time of VM 23 is shortened, there is little risk of the functionality of the in-vehicle control device 1 deteriorating (at least, the risk of the functionality of the in-vehicle control device 1 deteriorating is lower than when processing of VM 21 continues to fail).

[0103] Furthermore, since the management unit 12 shortens the allocation time of the VM 23 by the amount corresponding to the extension of the allocation time of the VM 21, the time required for one cycle does not change before and after the update of the allocation time (for example, T1=T2). This reduces the processing load on the management unit 12, allowing more physical resources 11 to be allocated to multiple VMs 13 rather than to the management unit 12, and allowing the on-board control device 1 to function more efficiently.

[0104] [2. Second Embodiment] Next, a second embodiment of the present disclosure will be described. In the second embodiment, the same components as those in the first embodiment will be denoted by the same reference numerals, and the description thereof will be omitted. The second embodiment differs from the first embodiment in the content of the control method by the management unit 12.

[0105] [2.1 Problems to be Solved by the Second Embodiment] In the first embodiment, an increase in the processing time Z11 of the VM 21 caused by the output of the external device 30 becoming unstable due to aging degradation has been described. While the aging degradation of the external device 30 can be recovered by, for example, replacing the external device 30, the degradation basically continues to worsen over time. For this reason, in the first embodiment, the allocated time of the VM 21 is updated from the initial X11 to X21, which is longer than X11, and then updated to X31, which is longer than X21, and so on, so that the allocated time is successively updated to longer times over time.

[0106] On the other hand, apart from deterioration over time, the output of the external device 30 may become temporarily unstable due to external disturbances. If the external device 30 is a sensor 32 that monitors the conditions around the vehicle V1, the output may become temporarily unstable due to the influence of electromagnetic waves around the vehicle V1 (for example, the presence of a radio tower near the vehicle V1), weather (for example, rain, snow, extreme heat, extreme cold), a bad road (for example, a road with many bumps), etc. In such cases, the processing time Z11 required for the VM 21 to receive data from the external device 30 may temporarily increase.

[0107] In this way, if the processing time Z11 increases due to temporary instability in the output of the external device 30 caused by a disturbance or the like, the VM21 may also temporarily suffer from processing failure. For example, if the allocated time X11 for the VM21 is set excessively in anticipation of such a temporary increase in the processing time Z11, the margin time Y11 will be excessive when the processing time Z11 does not increase, reducing the efficiency of the on-board control device 1. On the other hand, if the allocated time X11 for the VM21 is set without considering the temporary increase in the processing time Z11, the VM21 will suffer processing failure when the processing time Z11 increases, reducing the efficiency of the on-board control device 1.

[0108] Therefore, in this embodiment, the allocated time X11 is not set excessively, but is initially set to an appropriate time X11 for the VM 21 that communicates with the external device 30 in a normal state where the output is not unstable. The management unit 12 constantly collects the processing time Z11 of the VM 21 and extends or shortens the allocated time for the VM 21 in accordance with the processing time Z11. For example, when the management unit 12 detects an increase in the processing time Z11, it extends the allocated time X11 for the VM 21 to X41, and when the management unit 12 subsequently detects a decrease in the processing time Z11, it shortens the allocated time X41 for the VM 21 to X51. Furthermore, the management unit 12 shortens or extends the allocated time for the VM 23 that executes a process that can be carried over to the next cycle so that the total time of the cycle does not change due to the extension or shortening of the allocated time for the VM 21.

[0109] That is, while the external device 30 is operating normally with little effect from disturbance (i.e., while the output of the external device 30 is relatively stable), the management unit 12 sets the allocated time X11 of the VM 21 relatively short, thereby keeping the proportion of the margin time Y11 in the allocated time X11 relatively small and efficiently performing the functions of the on-board control device 1. Here, the allocated time X11 is longer than the processing time Z11 under normal conditions and shorter than the processing time Z11 when the output of the external device 30 becomes unstable due to a disturbance.

[0110] The management unit 12 extends the allocated time of the VM 21 only during a period when the processing time Z11 temporarily increases, such as a period when the output of the external device 30 becomes unstable due to a disturbance, thereby suppressing processing defects in the VM 21. Furthermore, when the processing time Z11 decreases, the management unit 12 shortens the allocated time of the VM 21, thereby shortening the margin time of the VM 21 and improving the efficiency of the on-board control device 1. In this way, by flexibly updating the allocated time of the VM 21 in accordance with the processing time Z11 of the VM 21, the on-board control device 1 can function efficiently for a longer period of time.

[0111] The control method by the management unit 12 of the second embodiment will be described in detail below.

[0112] [2.2 Control Method] Fig. 6 is a flowchart illustrating a control method according to the second embodiment. Fig. 6 shows various controls executed by the management unit 12. These controls are realized by the management unit 12 reading the computer program 15a from the storage unit 15 and executing various calculations and processes. The order of the steps shown in Fig. 6 may be changed as appropriate.

[0113] 7 and 8 are diagrams illustrating updating of allocated time according to the second embodiment. Fig. 7 shows the states of cycles T0, T1, and T2 in order from (a). Fig. 8 shows the states of cycles T2, T3, and T4 in order from (a). Cycles T0 to T4 are consecutive cycles in this order; for example, cycle T1 is the cycle following cycle T0, and cycle T2 is the cycle following cycle T1.

[0114] In this example, the output of the external device 30 becomes temporarily unstable between cycles T1 and T2, and then stabilizes again in cycle T3. The output of the external device 30 is stable in cycles T0 and T4. Therefore, the processing time Z11 of the VM 21 that communicates with the external device 30 increases in cycles T1 and T2, and remains at the normal processing time Z11 in the other cycles T0, T3, and T4.

[0115] The management unit 12 executes the control method shown in Fig. 6, for example, at the end of each of cycles T0 to T4. Then, the management unit 12 updates various allocation times in cycles executed after cycle T1 (for example, cycle T2) based on, for example, the execution contents before cycle T1.

[0116] First, the management unit 12 sets the value of the variable i to "1" (step ST20), and determines whether the variable i is equal to or less than the number N of VMs 13 configured by the on-board control device 1 (step ST21). In the example of Fig. 1, since the number of VMs 13 is three (N = 3), the first step ST20 proceeds to the YES route.

[0117] Next, the management unit 12 determines whether the i-th VM 13 is an update target (step ST22). In the first step ST22, the management unit 12 determines whether the VM 21, which is the first VM 13, is an update target. In this example, the VM 21, which communicates with the external device 30 and performs real-time processing, is an update target, and the VMs 22 and 23 are not update targets. Therefore, in the first step ST22, the management unit 12 proceeds with the process along the YES route.

[0118] Next, the management unit 12 acquires the current allocation time of the i-th VM 13 (step ST23). For example, the management unit 12 reads out the allocation time X11 currently set for the VM 21 from the storage unit 15.

[0119] Thereafter, the management unit 12 acquires the processing time of the i-th VM 13 (step ST24). For example, the management unit 12 acquires the processing time Z11 of the VM 21 in cycle T0. More specifically, the management unit 12 acquires the processing start time A1 of the VM 21 and the processing end time A2 of the VM 21 in cycle T0. Then, the management unit 12 subtracts the time A1 from the time A2 to acquire the processing time Z11.

[0120] Next, the management unit 12 calculates the margin time of the i-th VM 13 based on the allocated time and processing time acquired in steps ST23 and ST24, and determines whether the calculated margin time is less than a first predetermined value Th1 (step ST25). For example, the management unit 12 subtracts the processing time Z11 from the allocated time X11 to calculate the margin time Y11 of the VM 21 in the cycle T0 (Y11=X11-Z11). Then, the management unit 12 determines whether the calculated margin time Y11 is less than the first predetermined value Th1 (Y11 <Th1)。

[0121] The first predetermined value Th1 is a value smaller than the margin time Y11 (e.g., the margin time Y11 in FIG. 7(a)) obtained by subtracting the normal processing time Z11 of the VM21 from the allocated time X11 of the VM21, which is set as an initial value, for example. The first predetermined value Th1 is a value within a range of one-third to two-thirds of the margin time Y11 in FIG. 7(a), for example, half the value of the margin time Y11. The normal processing time Z11 is the processing time Z11 of the VM21 when the external device 30 operates normally with almost no influence from external disturbances, for example, the processing time Z11 in FIG. 7(a).

[0122] Therefore, in step ST25, the management unit 12 determines whether the margin time of the i-th VM 13 is shorter than normal by a certain amount or more. In other words, the management unit 12 determines that the processing time of the i-th VM 13 has increased and is likely to exceed the allocated time set for the VM 13. When the management unit 12 determines that the margin time is less than the first predetermined value Th1 (YES in step ST25), it extends the allocated time of the i-th VM 13 (step ST26).

[0123] Because the margin time Y11 of VM21 in cycle T0 is equal to or greater than the first predetermined value Th1, the management unit 12 proceeds to the NO route in step ST25 for the first time. In this case, the management unit 12 determines whether the calculated margin time exceeds the second predetermined value Th2 (step ST27). The second predetermined value Th2 is, for example, a value greater than the margin time Y11 (for example, the margin time Y11 in FIG. 7(a)) obtained by subtracting the normal processing time Z11 of VM21 from the allocated time X11 of VM21 set as an initial value. In other words, the second predetermined value Th2 is a value greater than the first predetermined value Th1. The second predetermined value Th2 is, for example, a value within a range of four-thirds to eight-thirds of the margin time Y11 in FIG. 7(a), for example, twice the margin time Y11.

[0124] Therefore, in step ST27, the management unit 12 determines whether the margin time of the i-th VM 13 is longer than normal by at least a certain amount. In other words, the management unit 12 determines that the processing time of the i-th VM 13 increases once and then decreases, and the processing time becomes shorter than the extended allocated time set for the VM 13, which may result in wasteful control of the on-board control device 1. When the management unit 12 determines that the margin time exceeds the second predetermined value Th2 (YES in step ST27), it shortens the allocated time of the i-th VM 13 (step ST28).

[0125] Since the margin time Y11 of VM21 in cycle T0 is equal to or less than the second predetermined value Th2 (Y11≦Th2), the management unit 12 proceeds to the NO route in the first step ST27. After that, the management unit 12 adds "1" to the variable i (step ST29). As a result, the variable i becomes "2".

[0126] After step ST29, the management unit 12 returns to step ST21. Since the variable i (=2) is still equal to or less than the number N (=3) of VMs 13, the second step ST21 also proceeds along the YES route. Next, the management unit 12 executes step ST22 for the second time. VM22, which is the second VM 13, does not communicate with the external device 30 and is therefore not an update target. Therefore, in the second step ST22, the management unit 12 proceeds with the process along the NO route and skips steps ST23 to ST28. Next, the management unit 12 adds "1" to the variable i (step ST29), and the variable i becomes "3".

[0127] After the second step ST29, the management unit 12 executes the third step ST21, and proceeds to the YES route because the variable i (=3) is equal to or less than the number N (=3) of VMs 13. Next, the management unit 12 executes the third step ST22, and proceeds to the NO route because the VM 23 is not to be updated, and the management unit 12 adds "1" to the variable i, setting the variable i to "4" (step ST29).

[0128] After the third step ST29, the management unit 12 executes the fourth step ST21. Since the variable i (=4) is larger than the number N (=3) of VMs 13, 4 In this control sequence, the VM 21 performs the process in the normal processing time Z11, and therefore the allocation time X11 and the like are not updated.

[0129] Subsequently, at the end of the first cycle T1, the management unit 12 executes the control method shown in Fig. 6. First, the management unit 12 executes steps ST20 to ST24 in the same manner as in cycle T0.

[0130] Next, the management unit 12 calculates the margin time Y11 of the VM 21 based on the allocated time X11 and the processing time Z11 acquired in steps ST23 and ST24, and determines whether the calculated margin time Y11 is less than a first predetermined value Th1 (step ST25).

[0131] 7(b), in the first cycle T1, the processing time Z11 of VM21 increases, and the margin time Y11 of VM21 decreases accordingly. Since the margin time Y11 of VM21 in the first cycle T1 is less than the first predetermined value Th1, the management unit 12 proceeds to the YES route in the first step ST25.

[0132] In this case, the management unit 12 extends the allocated time X11 of the VM 21 (step ST26). For example, the management unit 12 changes the allocated time of the VM 21 to "X41," which is longer than "X11." The updated allocated time X41 may be stored as a predetermined parameter in the storage unit 15, for example, or may be a value calculated based on the current allocated time X11 or processing time Z11.

[0133] For example, the management unit 12 may add a predetermined value (e.g., a first predetermined value Th1) to the current allocation time X11 and set the resulting value as the updated allocation time X41 (X41=X11+Th1). Alternatively, the management unit 12 may add a predetermined value (e.g., a second predetermined value Th2) to the current processing time Z11 and set the resulting value as the updated allocation time X41 (X41=Z11+Th2).

[0134] Furthermore, in step ST26, the management unit 12 shortens the allocated time of VM13 (VM23 in this example) that does not execute real-time processing by the extension of allocated time X11. For example, the management unit 12 changes the allocated time X13 of VM23 to X43, which is shorter than X13. The increase in the allocated time of VM21 (X41-X11) is equal to the decrease in the allocated time of VM23 (X13-X43). This makes it possible to adjust the allocated time of VM21 without changing the time required for one cycle.

[0135] After extending the allocated time X11, the management unit 12 adds "1" to the variable i to set the variable i to "2" (step ST29). After step ST29, the management unit 12 returns to step ST21. Since neither the VMs 22 nor 23 are to be updated, steps ST21, ST22, and ST29 are executed twice each, similar to the processing in cycle T0. 4 By taking the NO route in step ST21 of the first cycle, a series of controls by the management unit 12 in the first cycle T1 is completed.

[0136] The series of update controls in steps ST25 and ST26 by the management unit 12 is also referred to as "second control" as appropriate. In the second control, an increase in processing time Z11 and a decrease in margin time Y11 occur for VM21, so the management unit 12 executes control to extend the allocated time X11 of VM21.

[0137] According to the second control, in a second cycle T2 following the first cycle T1, the management unit 12 allocates the physical resources 11 to the VMs 21, 22, and 23 for each allocation time shown in FIG. 7(c). Because the allocation time of the VM 21 is extended to X41, even if the processing time Z11 increases, the margin time Y41 (=X41-Z11) in the second cycle T2 is equal to or greater than the first predetermined value Th1. In this way, the management unit 12 extends the allocation time of the VM 21 as the processing time of the VM 21 increases, thereby ensuring margin time and suppressing processing failures in the VM 21.

[0138] In particular, the management unit 12 extends the allocated time X11 when the margin time Y11 falls below the first predetermined value Th1. Therefore, the allocated time X11 can be extended while preventing the processing time Z11 of the VM 21 from actually exceeding the allocated time X11, thereby more reliably preventing processing failures in the VM 21. As a result, the functions of the on-board control device 1 can be more efficiently performed.

[0139] Next, control for shortening the extended allocation time X41 will be described with reference to Figures 6 and 8. Figure 8(a) shows cycle T2 from Figure 7(c) again for comparison with cycle T3 and the like described below. In cycle T3, the processing time Z11 of VM21 decreases. Therefore, the management unit 12 reduces the surplus margin time by shortening the allocation time of VM21 in accordance with the decrease in processing time Z11.

[0140] At the end of cycle T3, the management unit 12 executes the control method shown in Fig. 6. First, the management unit 12 executes steps ST20 to ST24 in the same manner as in cycle T0.

[0141] Next, the management unit 12 calculates a margin time Y41 of VM21 based on the allocated time X41 and processing time Z11 of VM21 acquired in steps ST23 and ST24, and determines whether the calculated margin time Y41 is less than a first predetermined value Th1 (step ST25). As shown in Fig. 8(b), in cycle T3, the processing time Z11 of VM21 is reduced, and the margin time Y41 of VM21 is increased by that amount. Then, since the margin time Y41 of VM21 in cycle T3 is equal to or greater than the first predetermined value Th1, the management unit 12 proceeds to the NO route in the first step ST25.

[0142] Next, the management unit 12 determines whether the margin time Y41 exceeds the second predetermined value Th2 (step ST27). In this example, since the margin time Y41 exceeds the second predetermined value Th2 (Y41>Th2), the management unit 12 proceeds to the YES route in step ST27 and shortens the allocated time X41 of the VM 21 (step ST28).

[0143] For example, the management unit 12 changes the allocated time of the VM 21 to "X51" which is shorter than "X41." The updated allocated time X51 may be stored in the storage unit 15 as a predetermined parameter, for example, or may be a value calculated based on the current allocated time X41 or the processing time Z11.

[0144] For example, the management unit 12 may set the updated allocation time X51 to a value obtained by subtracting a predetermined value (e.g., a first predetermined value Th1) from the current allocation time X41 (X51=X41-Th1). Alternatively, the management unit 12 may return the allocation time of VM 21 to the allocation time X11 before extension (X51=X11). Alternatively, the management unit 12 may set the updated allocation time X51 to a value obtained by adding a predetermined value (e.g., a second predetermined value Th2) to the current processing time Z11 (X51=Z11+Th2).

[0145] Furthermore, in step ST28, the management unit 12 extends the allocated time of VM 13 (VM 23 in this example) that does not execute real-time processing by the amount of reduction in allocated time X41. For example, the management unit 12 changes the allocated time X43 of VM 23 to X53, which is longer than X43. The decrease in the allocated time of VM 21 (X41-X51) is equal to the increase in the allocated time of VM 23 (X53-X43). This makes it possible to adjust the allocated time of VM 21 without changing the time required for one cycle.

[0146] After shortening the allocated time X41, the management unit 12 adds "1" to the variable i to set the variable i to "2" (step ST29). After step ST29, the management unit 12 returns to step ST21. Since neither the VMs 22 nor 23 are to be updated, steps ST21, ST22, and ST29 are executed twice each, similar to the processing in cycle T0. 4 By taking the NO route in step ST21 for the second time, a series of controls by the management unit 12 in cycle T3 is completed.

[0147] The series of update controls of steps ST27 and ST28 by the management unit 12 is also referred to as "third control" as appropriate. According to the third control, in cycle T4 following cycle T3, the management unit 12 allocates the physical resources 11 to the VMs 21, 22, and 23 for each allocation time shown in FIG. 8(c). Because the allocation time of VM 21 is shortened to X51, even if the processing time Z11 is reduced, the margin time Y51 (=X51-Z11) in cycle T4 is equal to or less than the second predetermined value Th2. In this way, by the management unit 12 shortening the allocation time of VM 21 as the processing time of VM 21 is reduced, excessive margin time is suppressed, and the functions of the on-board control device 1 can be more efficiently performed.

[0148] [3. Modifications] Modifications of the embodiment will be described below. In the modifications, the same components as those in the embodiment will be denoted by the same reference numerals and the description thereof will be omitted.

[0149] 3.1 Modification of the first embodiment In the first embodiment described above, the management unit 12 extends the allocated time of the VM 21 based on a preset update table. However, an update table does not have to be set. For example, when a predetermined condition is satisfied, the management unit 12 may change the allocated time X11 of the VM 21 to an allocated time X21 (i.e., X21 is 1.2 times X11) obtained by adding a predetermined percentage (e.g., 20%) of X11. In this case, for example, the management unit 12 extends the allocated time by 1.2 times each time the predetermined condition is satisfied, and therefore an update table is not necessary.

[0150] In the first embodiment described above, only one VM 21 is provided. However, the management unit 12 may extend the allocated time for multiple VMs 21. For example, the management unit 12 may extend the allocated time X11 of two VMs 21 to allocated time X21. In this case, the management unit 12 shortens the allocated time X13 of VM 23 by the total time of the extensions of the allocated times for the multiple VMs 21. For example, if the allocated times for two VMs 21 are each extended by (X21-X11) hours, the management unit 12 shortens the allocated time of VM 23 by the total time (X23=X13-2·(X21-X11)).

[0151] In the first embodiment described above, the management unit 12 shortens the allocated time of the VM 23 based on a preset update table. However, the management unit 12 may be configured to calculate an extension of the allocated time of the VM 21 and shorten the allocated time of the VM 23 by the extension.

[0152] 3.2 Modification of the second embodiment [3.2.1 Combination of the first and second embodiments] The first and second embodiments may be combined. For example, the management unit 12 may first execute the first control shown in FIG. 3 and then execute the second control shown in FIG. 6. With this configuration, the allocation time (e.g., X21) is extended by the first control, taking into account an increase in the processing time Z11 due to aging deterioration of the external device 30, and then the allocation time can be further extended (e.g., X21+Th1) by taking into account a temporary increase in the processing time Z11 due to a disturbance or the like of the external device 30. This allows the allocation time to be set in accordance with the current situation, thereby allowing the on-board control device 1 to perform its functions more efficiently.

[0153] [3.2.2 Control based on the number of communication retries] In the second control of the second embodiment described above, it is necessary to acquire the processing time Z11 of the VM 21 at the end of each cycle, as described in step ST24 of Fig. 6. Here, as described above, one cause of an increase in the processing time Z11 is that the number of retries of communication from the VM 21 to the external device 30 increases when the output of the external device 30 becomes unstable due to disturbances or the like.

[0154] Therefore, before executing step ST24, the management unit 12 may count the number of communication retries from the VM 21 to the external device 30 in the current cycle. In this case, step ST24 may be executed only when the number of communication retries has increased by a predetermined value or more compared to the number of communication retries in the previous cycle, and when the number of communication retries has not increased by the predetermined value or more compared to the number of communication retries in the previous cycle, steps ST24 to ST28 may all be skipped and the process may proceed to step ST29.

[0155] That is, the management unit 12 may execute the second control (steps ST25 and ST26) only when the number of communication retries of the VM 21 to the external device 30 increases. With this configuration, the management unit 12 acquires the processing time Z11 only when an increase in the number of communication retries is expected, which would otherwise increase the processing time Z11, and does not acquire the processing time Z11 in other cases, thereby reducing the control load of the management unit 12.

[0156] As mentioned above, as the influence of external disturbances and the like disappears and the output of the external device 30 returns to stability, the number of retries of communication from VM21 to the external device 30 decreases (returns to normal), which is one of the reasons why the processing time Z11 decreases.

[0157] Therefore, before executing step ST24, the management unit 12 counts the number of communication retries from VM21 to the external device 30 in the cycle, and executes step ST24 only if the number of communication retries has decreased by a predetermined value or more from the number of communication retries in the previous cycle, and if the number of communication retries has not decreased by a predetermined value or more from the number of communication retries in the previous cycle, it may skip all of steps ST24 to ST28 and proceed to step ST29.

[0158] That is, the management unit 12 may execute the third control (steps ST27 and ST28) only when the number of communication retries from the VM 21 to the external device 30 has decreased. With this configuration, the management unit 12 acquires the processing time Z11 only when the number of communication retries has increased or decreased beyond a predetermined range, and does not acquire the processing time Z11 in other cases, thereby reducing the control load on the management unit 12.

[0159] [3.2.3 Rate of change of white space time] FIG. 9 is a diagram illustrating the margin time Y11 according to a modified example of the second embodiment. The management unit 12 of the second embodiment described above extends the allocated time of the VM 21 when the margin time Y11 is less than the first predetermined value Th1 (step ST26), and shortens the allocated time of the VM 21 when the margin time Y11 exceeds the second predetermined value Th2 (step ST28). However, the management unit 12 may extend or shorten the allocated time of the VM 21 based on the rate of change of the margin time Y11.

[0160] For example, in step ST25, the management unit 12 calculates an approximation line L1 of the margin time Y11 in a plurality of (e.g., three) consecutive cycles (e.g., cycles T11, T12, and T13 as shown in FIG. 9) by the least squares method. Then, the management unit 12 acquires the slope of the approximation line L1 as the rate of change α1 of the margin time Y11. If the rate of change α1 of the margin time Y11 is lower than a first predetermined value Th11 (here, Th11<0), the management unit 12 extends the allocated time of the VM 21 (step ST26).

[0161] Normally, there is almost no change in the margin time Y11 over multiple consecutive cycles T11, T12, and T13, so the slope (rate of change α1) of the approximate line L1 is "0" or a value close to "0." On the other hand, if the processing time Z11 increases and the margin time Y11 decreases, the slope of the approximate line L1 becomes smaller than 0. For this reason, the management unit 12 may extend the allocated time of VM 21 when the rate of change α1 of the margin time Y11 is below a first predetermined value Th11, which is a negative number.

[0162] Similarly, in step ST27, if the rate of change α1 of the margin time Y11 exceeds a second predetermined value Th12 (here, Th12>0), the management unit 12 shortens the allocated time of VM21 (step ST28). If the processing time Z11 decreases and the margin time Y11 increases, the slope of the approximate line L1 becomes larger than 0. Therefore, the management unit 12 may shorten the allocated time of VM21 if the rate of change α1 of the margin time Y11 exceeds the second predetermined value Th12, which is a positive number.

[0163] [3.2.4 Estimating free time] The management unit 12 of the second embodiment described above extends or shortens the allocated time of the VM 21 based on the actual margin time Y11 in the cycle T1, for example. However, the management unit 12 may predict the margin time Y11 in the next cycle based on a plurality of margin times Y11 in a plurality of consecutive cycles, and extend or shorten the allocated time of the VM 21 based on the predicted value.

[0164] For example, in step ST25, the management unit 12 calculates the approximate line L1 in the same manner as described above. Then, as shown in Fig. 9, when the approximate line L1 is extended to cycle T13 and thereafter, if a value PV1 of the approximate line L1 in cycle T14 next to cycle T13 (or cycle T15 two cycles after cycle T13) falls below a first predetermined value Th21, the management unit 12 extends the allocated time of VM21 (step ST26). Here, the first predetermined value Th21 is, for example, a value approximately equal to the above-mentioned first predetermined value Th1.

[0165] The value PV1 is a predicted value obtained by extending the approximate line L1. By configuring in this way, the management unit 12 can take preemptive measures to extend the allocated time of the VM 21 before the actual margin time Y11 becomes small to a certain extent. This makes it possible to more reliably suppress processing defects in the VM 21.

[0166] Similarly, in step ST27, when the approximate line L1 is extended beyond cycle T13, if the value PV1 of the approximate line L1 in cycle T14 (or cycle T15) next to cycle T13 exceeds a second predetermined value Th22, the management unit 12 shortens the allocated time of VM 21 (step ST28). Here, the second predetermined value Th22 is, for example, a value approximately equal to the above-mentioned second predetermined value Th2.

[0167] With this configuration, the management unit 12 can take preemptive measures to shorten the allocated time of the VM 21 before the actual margin time Y41 becomes large to a certain extent, thereby enabling the on-board control device 1 to perform its functions more efficiently.

[0168] Although the predicted value PV1 of the blank time is obtained based on the approximate line L1 in the above example, the management unit 12 may obtain the predicted value PV1 of the blank time by other methods. For example, the management unit 12 may use a learning model obtained by machine learning or deep learning to predict the blank time in the next cycle based on multiple blank times in multiple consecutive cycles.

[0169] [4. Notes] The above description includes the following additional features.

[0170] [4.1 Appendix 1] An on-board control device mounted on a vehicle, physical resources including a control unit, a storage unit, and a communication unit; a management unit that allocates the physical resources for each allocated time to generate a plurality of virtual machines; Equipped with The plurality of virtual machines a first virtual machine that communicates with an external device provided outside the in-vehicle control device and executes a process that cannot be carried over to the next cycle; a second virtual machine that executes processing that can be carried over to the next cycle; the management unit executes second control to change the allocated time of each of the first virtual machine and the second virtual machine; The second control is Control to acquire a processing time of the first virtual machine in a first cycle; control to extend the allocated time of the first virtual machine and shorten the allocated time of the second virtual machine in the first cycle and subsequent cycles when a margin time calculated based on the acquired processing time and the allocated time set for the first virtual machine or a rate of change in the margin time falls below a first predetermined value; An in-vehicle control device comprising:

[0171] [4.2 Appendix 2] A control method for controlling an on-board control device mounted on a vehicle, comprising: a generating step of allocating physical resources including a control unit, a storage unit, and a communication unit for each allocated time to generate a plurality of virtual machines; a control step of changing the allocated time of each of a first virtual machine and a second virtual machine among the plurality of virtual machines; Equipped with the first virtual machine is a virtual machine that communicates with an external device provided outside the in-vehicle control device and executes a process that cannot be carried over to the next cycle; the second virtual machine is a virtual machine that executes a process that can be carried over to the next cycle; The control step an acquisition step of acquiring a processing time of the first virtual machine in a first cycle; a change step of extending the allocated time of the first virtual machine and shortening the allocated time of the second virtual machine in the first cycle and subsequent cycles when a margin time calculated based on the acquired processing time and the allocated time set for the first virtual machine or a rate of change in the margin time falls below a first predetermined value; A control method comprising:

[0172] [4.3 Appendix 3] A computer program for controlling an on-board control device mounted on a vehicle, The computer program includes: a generating step of allocating physical resources including a control unit, a storage unit, and a communication unit for each allocated time to generate a plurality of virtual machines; a control step of changing the allocated time of each of a first virtual machine and a second virtual machine among the plurality of virtual machines; Execute the first virtual machine is a virtual machine that communicates with an external device provided outside the in-vehicle control device and executes a process that cannot be carried over to the next cycle; the second virtual machine is a virtual machine that executes a process that can be carried over to the next cycle; The control step an acquisition step of acquiring a processing time of the first virtual machine in a first cycle; a change step of extending the allocated time of the first virtual machine and shortening the allocated time of the second virtual machine in the first cycle and subsequent cycles when a margin time calculated based on the acquired processing time and the allocated time set for the first virtual machine or a rate of change in the margin time falls below a first predetermined value; a computer program comprising:

[0173] [5. Supplementary Notes] It should be noted that at least some of the above-described embodiments may be combined with each other in any desired manner. Furthermore, the embodiments disclosed herein should be considered to be illustrative and not restrictive in all respects. The scope of the present disclosure is defined by the claims, and all modifications within the meaning and scope equivalent to the claims are intended to be included. [Explanation of symbols]

[0174] 1. On-board control device 11 Physical Resources 12 Management Department 13 Virtual Machines (VMs) 13a Guest OS 13b Application 14 Control Unit 15 Storage section 15a Computer Programs 15b Virtualized Operating System (Virtualized OS) 15c Guest Operating System (Guest OS) 16 Communications Department 17 Reading unit 18 Recording Media 21 VM 22 VM 23 VM 30 External device 31 ECU 31a communication line 32 sensors 32a communication line 33 Communication equipment 33a communication line 4. External device V1 vehicle T1 cycle (first cycle) T2 Cycle (2nd Cycle) T3 cycle T4 cycle T11 Cycle T12 cycle T13 Cycle T14 Cycle X11 Allotted time X12 Allotted time X13 Allocated Time X21 allotted time X23 Allocated Time X31 Allotted time X33 Allocated Time X41 Allocated Time X43 Allotted time X51 Allocated Time X53 Allocated Time Z11 Processing Time Z12 Processing Time Y11 Free Time Y12 Free Time Y41 Free Time Y51 Free Time P1 Baseline D1 Specific time D2 Predetermined time D3 Specific time Th1 1st predetermined value Th11 1st predetermined value Th21 1st predetermined value Th2 2nd predetermined value Th12 2nd predetermined value Th22 2nd predetermined value A1 Processing start time A2 Processing end time L1 approximate straight line α1 change rate PV1 predicted value

Claims

1. An on-board control device mounted on a vehicle, physical resources including a control unit, a storage unit, and a communication unit; a management unit that allocates the physical resources for each allocated time to generate a plurality of virtual machines; Equipped with The plurality of virtual machines a first virtual machine that communicates with an external device provided outside the vehicle control device and executes a process that cannot be carried over to the next cycle; a second virtual machine that executes processing that can be carried over to the next cycle; the management unit executes a first control to extend an allocated time of the first virtual machine and to shorten an allocated time of the second virtual machine when a predetermined condition indicating deterioration of the external device is satisfied. In-vehicle control device.

2. The predetermined condition is: A predetermined time or more has passed since the reference point in time. The external device has been operating for a predetermined time or longer since the reference time point, or The vehicle has traveled a distance equal to or greater than a predetermined distance since the reference time point. Including, The reference time point is When the external device is started to be used, or When the allocated time of the first virtual machine is extended, The on-board control device according to claim 1 , comprising:

3. the storage unit stores a first allocated time and a second allocated time that is longer than the first allocated time; the management unit sets the allocated time of the first virtual machine to the first allocated time before the predetermined condition is satisfied, and sets the allocated time of the first virtual machine to the second allocated time when the predetermined condition is satisfied; The on-board control device according to claim 1 or 2.

4. the storage unit stores a table in which information about the predetermined condition corresponds to an allocated time of the first virtual machine, the allocated time including the first allocated time and the second allocated time; the management unit extends the allocated time of the first virtual machine based on the allocated time acquired by referring to the table under the first control. The on-board control device according to claim 3 .

5. the management unit further executes second control to further change the allocated times of the first virtual machine and the second virtual machine after executing the first control; The second control is Control to acquire a processing time of the first virtual machine in a first cycle; control to extend the allocated time of the first virtual machine and shorten the allocated time of the second virtual machine in the first cycle and subsequent cycles when a margin time calculated based on the acquired processing time and the allocated time set for the first virtual machine falls below a first predetermined value; Including, The on-vehicle control device according to any one of claims 1 to 4.

6. the management unit executes the second control when the number of retries of communication by the first virtual machine to the external device increases. The on-board control device according to claim 5 .

7. after executing the first control, the management unit further executes second control to further change the allocation times of the first virtual machine and the second virtual machine; The second control is Control to acquire a processing time of the first virtual machine in a first cycle; control to extend the allocated time of the first virtual machine and to shorten the allocated time of the second virtual machine in the first cycle and subsequent cycles when a rate of change in a margin time calculated based on the acquired processing time and the allocated time set for the first virtual machine falls below a first predetermined value; Including, The on-vehicle control device according to any one of claims 1 to 4.

8. The management unit executes the second control when the number of communication retries of the first virtual machine to the external device increases. The on-board control device according to claim 7.

9. the management unit further executes a third control to change the allocated time of each of the first virtual machine and the second virtual machine after executing the second control; The third control is acquiring a processing time of the first virtual machine in a second cycle subsequent to the first cycle; a control for shortening the allocated time of the first virtual machine and extending the allocated time of the second virtual machine in the second and subsequent cycles when a margin time calculated based on the acquired processing time and the allocated time of the first virtual machine changed in the first control exceeds a second predetermined value that is greater than the first predetermined value; The on-board control device according to claim 5 or 6, comprising:

10. the management unit executes the third control when the number of communication retries by the first virtual machine to the external device decreases. The on-board control device according to claim 9 .

11. A control method for controlling an on-board control device mounted on a vehicle, comprising: a generating step of allocating physical resources including a control unit, a storage unit, and a communication unit for each allocated time to generate a plurality of virtual machines; a control step of extending an allocated time of a first virtual machine among the plurality of virtual machines and shortening an allocated time of a second virtual machine among the plurality of virtual machines when a predetermined condition indicating deterioration of an external device provided outside the in-vehicle control device is satisfied; Equipped with the first virtual machine is a virtual machine that communicates with the external device and executes a process that cannot be carried over to the next cycle; A control method, wherein the second virtual machine is a virtual machine that executes processing that can be carried over to the next cycle.

12. A computer program for controlling an on-board control device mounted on a vehicle, The computer program includes: a generating step of allocating physical resources including a control unit, a storage unit, and a communication unit for each allocated time to generate a plurality of virtual machines; a control step of extending an allocated time of a first virtual machine among the plurality of virtual machines and shortening an allocated time of a second virtual machine among the plurality of virtual machines when a predetermined condition indicating deterioration of an external device provided outside the in-vehicle control device is satisfied; Execute the first virtual machine is a virtual machine that communicates with the external device and executes a process that cannot be carried over to the next cycle; A computer program, wherein the second virtual machine is a virtual machine that executes processing that can be carried over to the next cycle.

Images