Control device, control system, and control method

Abstract

To provide a control device that can simultaneously perform application communication and evaluation and verification communication without straining a communication capacity of a network.SOLUTION: A control device is equipped with a first hypervisor for generating a first virtual machine and a second hypervisor which communicates with the first hypervisor via a gateway and generates a second virtual machine, the control device including a communication control unit configured to dynamically limit at least one of a communication traffic of application communication or a communication traffic of evaluation and verification communication, based on an execution status of the application communication executed between the first hypervisor and the second hypervisor, and an execution status of the evaluation and verification communication executed between the first hypervisor and the second hypervisor during activation of the first virtual machine and the second virtual machine, and based on a communication capacity of the gateway.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present disclosure relates to a control device, a control system, and a control method. [Background technology]

[0002] Recently, in the trend of integrated ECUs that integrate and use multiple ECUs, there is a growing need to evaluate and verify virtual machines (VMs) that operate across multiple ECUs. For example, Patent Document 1 discloses an example of building a virtualization infrastructure that spans multiple ECUs by transferring the virtual CPU context and working memory, which indicate the execution state and execution content of the virtual CPU managed in memory by a hypervisor, to a physically different ECU using a general-purpose network. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2022-31363 Summary of the Invention [Problem to be solved by the invention]

[0004] It is necessary to evaluate and verify whether a virtual machine operating across multiple ECUs is operating correctly. When application communication and evaluation / verification communication are simultaneously performed in such a virtual machine, the amount of communication increases compared to when only application communication is performed, due to the need to communicate the operation time (timestamp) of each step of the virtual machine, operation logs, and the like. However, the control device disclosed in Patent Document 1 did not take into consideration the communication capacity of the communication network provided in the gateway connecting different ECUs. Therefore, when application communication and evaluation / verification communication are simultaneously performed in the control device disclosed in Patent Document 1, there is a risk that the communication capacity of the network will be strained, making it impossible to perform correct evaluation / verification.

[0005] An object of the present disclosure is to provide a control device that can simultaneously perform application communication and evaluation / verification communication without putting a strain on the communication capacity of the network. [Means for solving the problem]

[0006] The control device according to the present disclosure is a control device that can be mounted on a vehicle and includes a first hypervisor that controls the execution of a first virtual machine and a second hypervisor that controls the execution of a second virtual machine that communicates with the first hypervisor via a gateway, and includes a communication control unit that dynamically limits at least one of the communication volume of the application communication and the communication volume of the evaluation and verification communication based on the execution status of the application communication executed between the first hypervisor and the second hypervisor, the execution status of the evaluation and verification communication executed between the first hypervisor and the second hypervisor, and the communication capacity of the gateway during startup of the first virtual machine and the second virtual machine. [Effects of the Invention]

[0007] According to the control device, control system, and control method disclosed herein, application communication and evaluation / verification communication can be performed simultaneously without straining the communication capacity of the network. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a block diagram showing an example of a schematic configuration of a vehicle control system. [Figure 2] FIG. 2 is a functional block diagram illustrating an example of a functional configuration of a hypervisor included in the vehicle control system. [Figure 3] FIG. 3 is a diagram illustrating an outline of communication control performed by the hypervisor according to the first embodiment. [Figure 4] FIG. 4 is a flowchart illustrating an example of the flow of processing performed by the hypervisor according to the first embodiment. [Figure 5] FIG. 5 is a block diagram showing an example of a schematic configuration of a vehicle control system according to the second embodiment. [Figure 6] FIG. 6 is a block diagram showing an example of a schematic configuration of a vehicle control system according to the third embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0009] (First embodiment) Various embodiments of a vehicle control system according to the present disclosure will be described below with reference to the drawings.

[0010] (General configuration of vehicle control system) First, a schematic configuration of a vehicle control system according to all of the embodiments will be described below. The vehicle control system 10a is a system that is mounted on a vehicle and performs desired vehicle control by interoperating an infotainment system, such as a car navigation system, and an ITS (Intelligent Transportation Systems) system.

[0011] The general configuration of a vehicle control system 10a will be described with reference to Fig. 1. Fig. 1 is a block diagram showing an example of the general configuration of a vehicle control system.

[0012] The vehicle control system 10a includes a machine 12a, a machine 12b, a gateway 20, a CPU(1) 24a, a CPU(2) 24b, and a CPU(3) 24c.

[0013] The machine 12a is an example of an information processing device constituting an infotainment system such as a car navigation system. The machine 12a is an example of a control device in the present disclosure. The machine 12b is an example of an information processing device constituting an ITS (Intelligent Transport System). The machine 12b is an example of a control device in the present disclosure. The machines 12a and 12b may be physically separated from each other, or may exist in a single ECU or CPU.

[0014] The machine 12a includes a virtual ECU VM(1) 14a, a virtual ECU VM(2) 14b, and a hypervisor 16a.

[0015] The virtual ECU VM(1) 14a and the virtual ECU VM(2) 14b are virtual machines that execute various applications that run on the machine 12a and perform evaluation and verification of the operations of the applications. Here, evaluation and verification refers to, for example, the process of outputting trace data including various operation logs and timestamps related to the operating state of the machine 12a. The virtual ECU VM(1) 14a and the virtual ECU VM(2) 14b are examples of a first virtual machine in the present disclosure.

[0016] The virtual ECU VM(1) 14a and the virtual ECU VM(2) 14b may run on different operating systems (OSs). The number of virtual ECU VMs included in the machine 12a is not important.

[0017] The hypervisor 16a is software for virtualizing a computer. The hypervisor 16a generates a virtual ECU VM(1) 14a and a virtual ECU VM(2) 14b, which are virtual computers, within a physical machine. The hypervisor 16a is an example of a first hypervisor in the present disclosure.

[0018] The hypervisor 16a includes a memory (2-1) 18a, a memory (2-2) 18b, and a memory (2-3) 18c. The memory (2-1) 18a, the memory (2-2) 18b, and the memory (2-3) 18c are storage areas obtained by dividing a main storage device (e.g., RAM) included in the machine 12a.

[0019] The memory (2-1) 18a is a storage area that stores data (e.g., programs) for causing the virtual ECU VM (2) 14b to run on the CPU (1) 24a. The memory (2-2) 18b is a storage area that stores data for causing the virtual ECU VM (2) 14b to run on the CPU (2) 24b. The memory (2-3) 18c is a storage area that stores data for causing the virtual ECU VM (2) 14b to run on the CPU (3) 24c.

[0020] The CPU(1) 24a, the CPU(2) 24b, and the CPU(3) 24c operate the virtual ECU VM(1) 14a and the virtual ECU VM(2) 14b, respectively, in cooperation with the hypervisor 16a.

[0021] The machine 12b includes a virtual ECU VM(3) 14c, a virtual ECU VM(4) 14d, and a hypervisor 16b.

[0022] The virtual ECU VM(3) 14c and the virtual ECU VM(4) 14d are virtual machines that run various applications, evaluation, and verification on the machine 12b. The virtual ECU VM(3) 14c and the virtual ECU VM(4) 14d are an example of a second virtual machine in the present disclosure. The machine 12b may also include the virtual ECU VM(2) 14b shown in FIG. 1. The virtual ECU VM(2) 14b included in the machine 12b is the virtual ECU VM(2) 14b included in the machine 12a that has been transferred to the machine 12b. In this way, by transferring the virtual ECU VM between different machines, the virtual ECU VM(2) 14b can be operated on the hypervisor 16b. This can enhance the computational performance of the virtual ECU VM(2) 14b.

[0023] The virtual ECU VM(3) 14c and the virtual ECU VM(4) 14d may run on different operating systems. The number of virtual ECU VMs included in the machine 12b is not important.

[0024] The hypervisor 16b is software for virtualizing a computer. The hypervisor 16b generates virtual ECU VM(3) 14c and virtual ECU VM(4) 14d, which are virtual computers, within a physical machine. In the example of FIG. 1, the hypervisor 16b also generates VM(2) 14b. The hypervisor 16b is an example of a second hypervisor in the present disclosure.

[0025] The hypervisor 16b includes a memory (2-3) 18c. The memory (2-3) 18c is transferred from the hypervisor 16a. The memory (2-3) 18c is a storage area that stores data and the like for virtually running the virtual ECU VM (2) 14b included in the machine 12a on the machine 12b as indicated by the dotted line in FIG. 1. In this way, by running the virtual ECU VM (2) 14b on the machine 12b, the computing power of the virtual ECU VM (2) 14b can be increased.

[0026] The gateway 20 controls communication between the machine 12a and the machine 12b. Note that the specific communication method implemented by the gateway 20 is not important. The gateway 20 includes a control mechanism 22. The control mechanism 22 monitors the amount of data flowing between the machine 12a and the machine 12b. Furthermore, when the amount of data flowing between the machine 12a and the machine 12b, i.e., the sum of the amount of communication for application communication C1 and the amount of communication for evaluation and verification communication C2, is equal to or greater than a predetermined ratio of the communication capacity of the gateway 20, the control mechanism 22 outputs a congestion control signal indicating that the communication capacity of the gateway 20 is under pressure. Note that when the gateway 20 is configured, for example, as a LAN (Local Area Network), the control mechanism 22 is, for example, a hub. When the gateway 20 is configured, for example, as a CAN (Control Area Network), the control mechanism 22 is, for example, a VIP (Vehicle Interface Processor).

[0027] In the vehicle control system 10a, the hypervisor 16a and the hypervisor 16b perform application communication C1 with each other via the gateway 20, and execute the application included in the vehicle control system 10a.

[0028] Furthermore, the hypervisors 16a and 16b perform evaluation and verification communication C2 with each other via the gateway 20, and evaluate and verify the operating states of the applications executed by the machines 12a and 12b and the virtual ECUs when the vehicle control system 10a is operating. Note that the vehicle control system 10a may perform monitoring and diagnosis of the operating state when installed in a product such as a vehicle, in addition to evaluation, verification, and analysis in an experimental environment.

[0029] In this embodiment, an example is described in which the control device of the present disclosure is applied to a vehicle control system 10a, but the application range of the control device is not limited to in-vehicle use, and it can be applied to general embedded devices in general, such as home appliances.

[0030] (Hypervisor functional configuration) The functional configuration of the hypervisor 16a will be described using Fig. 2. Fig. 2 is a functional block diagram showing an example of the functional configuration of a hypervisor provided in the vehicle control system. Note that although the functional configuration of the hypervisor 16a will be described here, the hypervisor 16b also has the same functional configuration as the hypervisor 16a.

[0031] The hypervisor 16a realizes the operation control unit 31, information transfer unit 32, communication capacity acquisition unit 33, communication volume determination unit 34, communication control unit 35, application execution unit 36, and evaluation / verification execution unit 37 shown in Figure 2 as functional parts by executing the programs stored in memory (2-1) 18a, memory (2-2) 18b, and memory (2-3) 18c on CPU (1) 24a, CPU (2) 24b, and CPU (3) 24c, respectively.

[0032] The operation control unit 31 controls the activation, suspension, and resumption of the virtual ECU VM(1) 14a and the virtual ECU VM(2) 14b. That is, the operation control unit 31 performs virtual power on / off, and virtual suspension and resumption of the operation of the virtual machines.

[0033] Furthermore, the operation control unit 31 monitors whether the application operation and the evaluation and verification operation are completed.

[0034] The information transfer unit 32 transfers a virtual CPU context for evaluation and verification from the hypervisor 16a to the hypervisor 16b before starting the virtual ECU VM(1) 14a, the virtual ECU VM(2) 14b, the virtual ECU VM(3) 14c, and the virtual ECU VM(4) 14d. The virtual CPU context is the execution state and execution content of the virtual CPU managed in memory by the hypervisor, and is also referred to as parity data in Patent Document 1. The information transfer unit 32 is an example of a transfer unit in the present disclosure.

[0035] The communication capacity acquisition unit 33 acquires the communication capacity of the gateway 20 .

[0036] The communication volume determination unit 34 determines whether the total value of the communication volume of the application communication C1 and the evaluation / verification communication C2 performed between the hypervisor 16a and the hypervisor 16b while the virtual ECU VM(1) 14a, the virtual ECU VM(2) 14b, the virtual ECU VM(3) 14c, and the virtual ECU VM(4) 14d are running is putting a strain on the communication capacity of the gateway 20.

[0037] More specifically, the communication volume determination unit 34 determines whether the communication volume of the gateway 20 is under pressure by comparing the total value of the communication volume of the application communication C1 and the communication volume of the evaluation and verification communication C2 with the communication volume of the gateway 20 acquired by the communication volume acquisition unit 33. The communication volume determination unit 34 may also determine that the communication volume of the gateway 20 is under pressure when receiving a congestion control signal output by the control mechanism 22. This will be described in more detail later (see FIG. 3).

[0038] Furthermore, the communication volume determination unit 34 monitors the volume of data that has not yet been transmitted between the hypervisor 16a and the hypervisor 16b.

[0039] During the activation of the first virtual machines, virtual ECU VM(1) 14a and virtual ECU VM(2) 14b, and the second virtual machines, virtual ECU VM(3) 14c and virtual ECU VM(4) 14d, the communication control unit 35 dynamically limits at least one of the communication volumes of the application communication C1 and the evaluation and verification communication C2, based on the execution status of the application communication C1 executed between the hypervisors 16a and 16b, the execution status of the evaluation and verification communication C2 executed between the hypervisors 16a and 16b, and the communication capacity of the gateway 20. For example, based on the determination result of the communication volume determination unit 34, the communication volume of the application communication C1 and the communication volume of the evaluation and verification communication C2 are controlled so that the sum of the communication volumes of the application communication C1 and the evaluation and verification communication C2 does not exceed the communication capacity of the gateway 20.

[0040] More specifically, when the communication control unit 35 receives a congestion control signal output by the control mechanism 22, it prioritizes the communication for application C1 by limiting the communication volume of the evaluation / verification communication C2.

[0041] Furthermore, when the amount of data not yet transmitted between the hypervisors 16a and 16b is equal to or greater than a predetermined value, the communication control unit 35 suspends the operation of the first virtual machines, virtual ECU VM(1) 14a and virtual ECU VM(2) 14b, and the second virtual machines, virtual ECU VM(3) 14c and virtual ECU VM(4) 14d, to backport the data not yet transmitted between the hypervisors 16a and 16b. Backporting here refers to the operation of sending data back from one machine, which holds newer data in either the virtual ECU context or the device context, to another machine. The condition for suspending the operation of the first virtual machine and the second virtual machine is not limited to when the amount of data not yet transmitted between the hypervisors 16a and 16b is equal to or greater than a predetermined value, and the condition for suspending the operation may be set as appropriate.

[0042] Furthermore, when the amount of data not yet transmitted between the hypervisor 16a and the hypervisor 16b falls below a predetermined value, the communication control unit 35 resumes the operations of the first virtual machines, virtual ECU VM(1) 14a and virtual ECU VM(2) 14b, and the second virtual machines, virtual ECU VM(3) 14c and virtual ECU VM(4) 14d. Note that the condition for resuming the operations of the first virtual machine and the second virtual machine is not limited to when the amount of data not yet transmitted between the hypervisor 16a and the hypervisor 16b falls below a predetermined value, and the condition for resuming the operations may be set as appropriate.

[0043] The application execution unit 36 ​​causes the virtual ECU VM(1) 14a, the virtual ECU VM(2) 14b, the virtual ECU VM(3) 14c, and the virtual ECU VM(4) 14d to execute applications.

[0044] The evaluation and verification execution unit 37 causes the virtual ECU VM(1) 14a, the virtual ECU VM(2) 14b, the virtual ECU VM(3) 14c, and the virtual ECU VM(4) 14d to execute evaluation and verification related to the operation of the vehicle control system 10a.

[0045] (Communication Control Overview) An overview of communication control performed by the hypervisor 16a will be described with reference to Fig. 3. Fig. 3 is a diagram illustrating an overview of communication control performed by the hypervisor of the first embodiment.

[0046] At time ta, the machine 12a starts the hypervisor 16a. Then, the information transfer unit 32 of the hypervisor 16a transmits (transfers) the virtual CPU context to the hypervisor 16b before the virtual ECU VM(1) 14a, the virtual ECU VM(2) 14b, the virtual ECU VM(3) 14c, and the virtual ECU VM(4) 14d start.

[0047] At time tb, when the transmission of the virtual CPU context is completed, the operation control unit 31 of the hypervisor 16a starts the virtual ECU VM(1) 14a, the virtual ECU VM(2) 14b, the virtual ECU VM(3) 14c, and the virtual ECU VM(4) 14d. The communication volume determination unit 34 of the hypervisor 16a determines whether the total volume of the application communication C1 and the evaluation / verification communication C2 between the hypervisors 16a and 16b is placing a strain on the communication capacity of the gateway 20. The communication control unit 35 of the hypervisor 16a controls the total volume of the application communication C1 and the evaluation / verification communication C2 so that the total volume of the application communication C1 and the evaluation / verification communication C2 does not exceed the communication capacity of the gateway 20. Specifically, when the virtual ECU VM to be evaluated is operating, the communication control unit 35 of the hypervisor 16a reduces the communication volume of the evaluation / verification communication C2 and prioritizes the application communication C1.

[0048] Then, at time tc, when it is determined that the unsent data related to the evaluation / verification communication C2 is equal to or greater than a predetermined value, the operation control unit 31 of the hypervisor 16a stops the timing operation to temporarily suspend the operation of the ECU VM to be evaluated. Then, while the operation of the ECU VM to be evaluated is suspended, the communication control unit 35 communicates the data that has not been backported between the hypervisor 16a and the hypervisor 16b.

[0049] Furthermore, when it is determined at time td that the unsent data related to the evaluation / verification communication C2 is less than the predetermined value, the operation control unit 31 of the hypervisor 16a resumes the timing operation. Then, the communication control unit 35 causes the hypervisor 16a to repeat the communication control performed between time tb and time tc.

[0050] (Processing flow performed by the hypervisor) The flow of processing performed by the hypervisor 16a will be described with reference to Fig. 4. Fig. 4 is a flowchart showing an example of the flow of processing performed by the hypervisor of the first embodiment. Note that the hypervisor 16b executes the same processing as shown in Fig. 4 by cooperating with the hypervisor 16a.

[0051] The operation control unit 31 starts up the hypervisor 16a (step S11).

[0052] The information transfer unit 32 transfers the virtual CPU context and memory contents from the hypervisor 16a to the hypervisor 16b (step S12).

[0053] The operation control unit 31 starts up the virtual ECU VM(1) 14a and the virtual ECU VM(2) 14b (step S13).

[0054] The communication control unit 35 alternately executes the application communication C1 and the evaluation / verification communication C2 (step S14).

[0055] The operation control unit 31 determines whether the application operation and the evaluation and verification operation are completed (step S15). If it is determined that the application operation and the evaluation and verification operation are completed (step S15: Yes), the hypervisor 16a ends the processing of Fig. 4. On the other hand, if it is not determined that the application operation and the evaluation and verification operation are completed (step S15: No), the process proceeds to step S16.

[0056] If it is determined in step S15 that the application operation and the evaluation and verification operation are not completed, the communication amount determination unit 34 determines whether a congestion control signal has been received from the gateway 20 (step S16). If it is determined that a congestion control signal has been received from the gateway 20 (step S16: Yes), the process proceeds to step S17. On the other hand, if it is not determined that a congestion control signal has been received from the gateway 20 (step S16: No), the process returns to step S14.

[0057] If it is determined in step S16 that a congestion control signal has been received from the gateway 20, the communication control unit 35 performs communication control that prioritizes application operation (step S17).

[0058] The communication volume determination unit 34 determines whether the amount of untransmitted evaluation and verification data is equal to or greater than a predetermined value when a predetermined time has elapsed since receiving the congestion control signal (step S18). If it is determined that the amount of untransmitted evaluation and verification data is equal to or greater than the predetermined value (step S18: Yes), the process proceeds to step S19. On the other hand, if it is not determined that the amount of untransmitted evaluation and verification data is equal to or greater than the predetermined value (step S18: No), the process returns to step S14.

[0059] If it is determined in step S18 that the amount of untransmitted evaluation and verification data is equal to or greater than the predetermined value, the operation control unit 31 suspends the operations of the virtual ECU VM(1) 14a and the virtual ECU VM(2) 14b (step S19).

[0060] The communication control unit 35 backports the evaluation and verification data that has not yet been transmitted (step S20).

[0061] The communication volume determination unit 34 determines whether the amount of untransmitted evaluation and verification data is less than a predetermined value (step S21). If it is determined that the amount of untransmitted evaluation and verification data is less than the predetermined value (step S21: Yes), the process proceeds to step S22. On the other hand, if it is not determined that the amount of untransmitted evaluation and verification data is less than the predetermined value (step S21: No), the process returns to step S20.

[0062] If it is determined in step S21 that the amount of untransmitted evaluation and verification data is less than the predetermined value, the operation control unit 31 resumes the operations of the virtual ECU VM(1) 14a and the virtual ECU VM(2) 14b (step S22), and then returns to step S14 to repeat the above-described processing.

[0063] (Operation and effect of the first embodiment) As described above, the machine 12a (control device) according to the first embodiment includes a hypervisor 16a (first hypervisor) that generates a virtual ECU VM(1) 14a (first virtual machine) and a virtual ECU VM(2) 14b (first virtual machine), a virtual ECU VM(3) 14c (second virtual machine) that communicates with the first hypervisor via the gateway 20, and a virtual ECU VM(4) 14d (second virtual machine) that communicates with the first hypervisor via the gateway 20. The control device is equipped with a hypervisor 16b (second hypervisor) that generates a VM(4) 14d (second virtual machine) and is mountable on a vehicle, and is further equipped with a communication control unit 35 that dynamically limits at least one of the communication volume of the application communication C1 and the communication volume of the evaluation and verification communication C2 based on an execution status of the application communication C1 executed between the hypervisors 16a and 16b, an execution status of the evaluation and verification communication C2 executed between the hypervisors 16a and 16b, and the communication capacity of the gateway 20, while the first virtual machine and the second virtual machine are running. Therefore, the application communication and the evaluation and verification communication can be performed simultaneously without straining the communication capacity of the network.

[0064] Furthermore, in the machine 12a (control device) according to the first embodiment, when the total value of the communication volume of the application communication C1 and the evaluation and verification communication C2 executed between the hypervisor 16a (first hypervisor) and the hypervisor 16b (second hypervisor) during the activation of the virtual ECU VM(1) 14a (first virtual machine), the virtual ECU VM(3) 14c (second virtual machine), and the virtual ECU VM(4) 14d (second virtual machine) puts pressure on the communication capacity of the gateway 20, the communication control unit 35 controls the communication volume of the application communication C1 and the communication volume of the evaluation and verification communication C2 so that the total value of the communication volume of the application communication C1 and the communication volume of the evaluation and verification communication C2 does not exceed the communication capacity of the gateway 20. Therefore, the application communication and the evaluation and verification communication can be performed simultaneously without putting pressure on the communication capacity of the network.

[0065] Furthermore, in the machine 12a (control device) according to the first embodiment, the communication control unit 35 determines whether the communication capacity of the gateway 20 is being squeezed, based on a congestion control signal indicating that the communication volume of the gateway 20 has exceeded a threshold. Therefore, it is possible to easily determine whether the communication capacity of the gateway 20 is being squeezed.

[0066] Furthermore, in the machine 12a (control device) according to the first embodiment, the communication control unit 35 prioritizes the application communication C1 when it receives a congestion control signal. At this time, the application executed by the virtual ECU does not need to take the congestion control signal into consideration. Therefore, the communication capacity can be controlled without affecting the operation of the application communication C1.

[0067] Furthermore, the machine 12a (control device) according to the first embodiment further includes an information transfer unit 32 (transfer unit) that transfers the execution state and execution contents of the virtual CPU for evaluation and verification from the hypervisor 16a (first hypervisor) to the hypervisor 16b (second hypervisor) before starting the virtual ECU VM(1) 14a (first virtual machine), the virtual ECU VM(2) 14b (first virtual machine), the virtual ECU VM(3) 14c (second virtual machine), and the virtual ECU VM(4) 14d (second virtual machine). Therefore, information for evaluation and verification can be shared between the hypervisors 16a and 16b.

[0068] Furthermore, in the machine 12a (control device) according to the first embodiment, when the amount of unsent data between the hypervisor 16a (first hypervisor) and the hypervisor 16b (second hypervisor) is equal to or greater than a predetermined value, the communication control unit 35 suspends the operations of the virtual ECU VM(1) 14a, the virtual ECU VM(2) 14b (first virtual machine), and the virtual ECU VM(3) 14c, the virtual ECU VM(4) 14d (second virtual machine) to transmit the unsent data between the hypervisor 16a (first hypervisor) and the hypervisor 16b (second hypervisor). Therefore, when unsent data in the evaluation / verification communication C2 accumulates, the operation between the first virtual machine and the second virtual machine is suspended, thereby enabling the unsent data to be transmitted and received without affecting the operation of the application communication C1.

[0069] Furthermore, in the machine 12a (control device) according to the first embodiment, the communication control unit 35 resumes operation of the virtual ECU VM(1) 14a, the virtual ECU VM(2) 14b (first virtual machine), and the virtual ECU VM(3) 14c, the virtual ECU VM(4) 14d (second virtual machine) when the amount of unsent data between the hypervisor 16a (first hypervisor) and the hypervisor 16b (second hypervisor) falls below a predetermined value. Therefore, because normal communication operation can be easily resumed, even when the application communication C1 and the evaluation / verification communication C2 are continuously performed, the operation status can be evaluated and verified over a long period of time.

[0070] (Second embodiment) Next, a vehicle control system 10b according to a second embodiment will be described.

[0071] (General configuration of vehicle control system) The schematic configuration of the vehicle control system 10b will be described using Fig. 5. Fig. 5 is a block diagram showing an example of the schematic configuration of the vehicle control system of the second embodiment. For simplicity of explanation, Fig. 5 omits the CPU(1) 24a, CPU(2) 24b, and CPU(3) 24c shown in Fig. 1. The internal structure of the gateway 20 is also omitted.

[0072] In a typical embedded device, all hypervisors have devices used by the hypervisor under their control. Therefore, a specific device can be controlled only by a specific hypervisor. In the vehicle control system 10b of this embodiment, if a specific device does not exist under the control of a hypervisor that executes processing using the specific device, the hypervisor has a function of virtually generating a device.

[0073] The general configuration of the vehicle control system 10b is almost the same as the general configuration of the vehicle control system 10a described in the first embodiment, but differs in that it has the function of virtually generating devices used by the hypervisor under the control of the hypervisor.

[0074] 5, device (A) 19a exists under hypervisor 16a, and device (B) 19b exists under hypervisor 16b. Device (A) 19a and device (B) 19b include devices used for evaluation and verification, such as serial ports. Devices also include input / output devices such as displays and speakers, and communication devices such as Wi-Fi and Bluetooth (registered trademark).

[0075] In this case, the device (A) 19a does not exist under the control of the hypervisor 16b, and therefore the hypervisor 16b cannot use the device (A) 19a.

[0076] In the vehicle control system 10b, the hypervisor 16b has a function of virtually generating a device (A) 19a under its control. In Fig. 5, the device (A) 19a virtually generated under the control of the hypervisor 16b is depicted with a dotted line to indicate that it is a virtual device.

[0077] 5, the memory (2-A) 18d is a storage area that stores data for the virtual ECU VM (2) 14b to use the device (A) 19a. The hypervisor 16a transfers the memory (2-3) 18c and the memory (2-A) 18d to the hypervisor 16b, thereby enabling the hypervisor 16b to execute processing using the device (A) 19a that is virtually generated under its control.

[0078] Furthermore, since the device (A) 19a generated under the control of the hypervisor 16b is a virtual device, when the hypervisor 16b performs processing using the device (A) 19a, it performs evaluation and verification communication C3 to send usage data of the device (A) 19a back to the hypervisor 16a. In order to prevent the amount of communication generated at this time from straining the network capacity, the communication between the hypervisors 16a and 16b is managed by the communication control method described in the first embodiment.

[0079] In this way, the hypervisor 16b operates as if the device (A) 19a exists under its control.

[0080] (Hypervisor functional configuration) Next, the functional configuration of the hypervisors 16a and 16b included in the vehicle control system 10b will be described. Each of the hypervisors 16a and 16b includes a virtual device generation unit 38 (not shown) in addition to the functional configuration shown in FIG.

[0081] When a device used by the virtual CPU context does not exist under the control of the hypervisor 16a (first hypervisor) or the hypervisor 16b (second hypervisor) that receives the virtual CPU context, the virtual device generation unit 38 virtually generates the corresponding device. Note that the virtual device generation unit 38 is an example of a generation unit in the present disclosure.

[0082] (Operation and effect of the second embodiment) As described above, the machine 12b (control device) according to the second embodiment further includes a virtual device generation unit 38 (generation unit) that virtually generates a device under the control of the hypervisor 16b (second hypervisor) that receives the execution state and execution contents of the evaluation / verification virtual CPU when the device used by the virtual CPU does not exist under the control of the hypervisor 16b. Therefore, even if the device used by the hypervisors 16a and 16b when performing processing does not exist under the control of the hypervisors 16a and 16b, the processing can be executed as if the device existed.

[0083] (Third embodiment) Next, a vehicle control system 10c according to a third embodiment will be described.

[0084] (General configuration of vehicle control system) The schematic configuration of the vehicle control system 10c will be described using Fig. 6. Fig. 6 is a block diagram showing an example of the schematic configuration of the vehicle control system of the third embodiment. For simplicity of explanation, Fig. 6 omits the CPU(1) 24a, CPU(2) 24b, and CPU(3) 24c shown in Fig. 1. The internal structure of the gateway 20 is also omitted.

[0085] The hypervisor 16a included in the vehicle control system 10c has a function of entrusting the execution of some of its own functions to a VM host 15, which is an example of a virtual machine.

[0086] Specifically, the VM host 15 performs some of the functions of the hypervisor 16a by performing the virtual power on / off of the machine 12a, the virtual suspension and resumption of operation, and communication control based on congestion control signals obtained from the gateway 20, which were previously performed by the hypervisor 16a in the first and second embodiments.

[0087] Furthermore, the VM host 15 may collect information from the virtual ECU VM(1) 14a instead of the hypervisor 16a. That is, the VM host 15 may perform information communication C4 from the virtual ECU VM(1) 14a to the VM host 15 via the hypervisor 16a.

[0088] The VM host 15 may perform information communication C4 from the virtual ECU VM(2) 14b via the hypervisor 16a to collect information about the virtual ECU VM(2) 14b.

[0089] In the vehicle control system 10c, the machine 12b may include a virtual machine having the same functions as the VM host 15.

[0090] (Hypervisor functional configuration) Next, the functional configuration of the hypervisor 16a included in the vehicle control system 10c will be described. Each hypervisor 16a delegates some of the functions of the functional configuration shown in FIG. 2 to the VM host 15. The functional configuration of the hypervisor 16a differs depending on which functions are delegated to the VM host 15. For example, when the functions of the communication control unit 35 are delegated to the VM host 15, the hypervisor 16a has a functional configuration in which the communication control unit 35 is deleted from the functional configuration shown in FIG. 2. Furthermore, when the functions of the communication amount determination unit 34 and the communication control unit 35 are delegated to the VM host 15, the hypervisor 16a has a functional configuration in which the communication amount determination unit 34 and the communication control unit 35 are deleted from the functional configuration shown in FIG. 2.

[0091] The hypervisor 16a has an information transmission / reception unit 39 (not shown) that has an information transmission / reception function for performing information communication C4 with the VM host 15, and an information transmission / reception function for performing information communication C4 from the virtual ECU VM(1) 14a to the VM host 15 via the hypervisor 16a.

[0092] By providing the VM host 15, when a modification (for example, a change in specifications) occurs in the hypervisor 16a, it is possible to deal with the modification with little effort by simply changing the VM host 15. Furthermore, a malfunction of the VM host 15 does not affect the virtual ECU VM(1) 14a and the virtual ECU VM(2) 14b.

[0093] On the other hand, providing a VM host 15 requires information communication C4, which increases overhead and may slow down operation. However, the amount of overhead can be reduced by using a hardware support mechanism, for example, so the benefits of providing the VM host 15 are greater.

[0094] (Operation and effect of the third embodiment) As described above, the machine 12a (control device) according to the third embodiment includes the VM host 15 (virtual machine) that communicates with the hypervisor 16a and performs part of the processing performed by the hypervisor 16a. Therefore, modification work such as specification changes can be performed without modifying the hypervisor 16a, and can be handled with little effort.

[0095] Although the embodiments of the present invention have been described above, the above-described embodiments are presented as examples and are not intended to limit the scope of the present invention. This novel embodiment can be embodied in various other forms. Furthermore, various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. Furthermore, this embodiment is included within the scope and spirit of the invention, and is also included in the inventions and their equivalents described in the claims.

[0096] The present disclosure may be configured as follows.

[0097] (1) A control device that can be mounted on a vehicle, the control device comprising: a first hypervisor that controls execution of a first virtual machine; and a second hypervisor that controls execution of a second virtual machine and communicates with the first hypervisor via a gateway, a communication control unit that dynamically limits at least one of the amount of communication for the application and the amount of communication for the evaluation and verification based on an execution status of communication for the application executed between the first hypervisor and the second hypervisor, an execution status of communication for evaluation and verification executed between the first hypervisor and the second hypervisor, and a communication capacity of the gateway while the first virtual machine and the second virtual machine are running; Control device. (2) The communication control unit When the total value of the communication volume of the application communication and the communication volume of the evaluation and verification communication executed between the first hypervisor and the second hypervisor during the activation of the first virtual machine and the second virtual machine puts pressure on the communication capacity of the gateway, the communication volume of the application communication and the communication volume of the evaluation and verification communication are controlled so that the total value of the communication volume of the application communication and the communication volume of the evaluation and verification communication does not exceed the communication capacity of the gateway. The control device described in (1) above. (3) the communication control unit determines whether the communication capacity of the gateway is being strained based on a congestion control signal indicating that the communication volume of the gateway has exceeded a threshold. The control device according to (1) or (2). (4) The communication control unit When the congestion control signal is received, the application communication is given priority. The control device described in (3) above. (5) a transfer unit that transfers an execution state and execution content of a virtual CPU for evaluation and verification from the first hypervisor to the second hypervisor before starting the first virtual machine and the second virtual machine; The control device according to any one of (1) to (4). (6) a generating unit configured to virtually generate a device under the second hypervisor when the device used by the virtual CPU does not exist under the second hypervisor that receives the execution state and execution content of the evaluation / verification virtual CPU; The control device according to any one of (1) to (5). (7) The communication control unit When the amount of data not yet transmitted between the first hypervisor and the second hypervisor is equal to or greater than a predetermined value, the operation of the first virtual machine and the second virtual machine is suspended, and the data not yet transmitted between the first hypervisor and the second hypervisor is transmitted. The control device according to any one of (1) to (6). (8) The communication control unit When an amount of data not yet transmitted between the first hypervisor and the second hypervisor falls below a predetermined value, the operation of the first virtual machine and the second virtual machine is resumed. The control device according to (7) above. (9) The control device a virtual machine that communicates with the first hypervisor and performs part of the processing performed by the first hypervisor; The control device according to any one of (1) to (8). (10) A control system that can be mounted on a vehicle, comprising: a first hypervisor that controls execution of a first virtual machine; and a second hypervisor that controls execution of a second virtual machine that communicates with the first hypervisor via a gateway, a communication control unit that dynamically limits at least one of the amount of communication for the application and the amount of communication for the evaluation and verification based on an execution status of communication for the application executed between the first hypervisor and the second hypervisor, an execution status of communication for evaluation and verification executed between the first hypervisor and the second hypervisor, and a communication capacity of the gateway while the first virtual machine and the second virtual machine are running; Control system. (11) A control method performed by a control device that can be mounted on a vehicle, the control device including a first hypervisor that controls execution of a first virtual machine, and a second hypervisor that controls execution of a second virtual machine and communicates with the first hypervisor via a gateway, the method comprising: performing a communication control process that dynamically limits at least one of the amount of communication for the application and the amount of communication for the evaluation and verification based on an execution status of communication for the application executed between the first hypervisor and the second hypervisor, an execution status of communication for evaluation and verification executed between the first hypervisor and the second hypervisor, and a communication capacity of the gateway while the first virtual machine and the second virtual machine are running; Control method. [Explanation of symbols]

[0098] 10a, 10b, 10c Vehicle control system 12a, 12b Machine (control device) 14a Virtual ECU VM(1) (First Virtual Machine) 14b Virtual ECU VM(2) (First Virtual Machine) 14c Virtual ECU VM(3) (Second Virtual Machine) 14d Virtual ECU VM(4) (Second Virtual Machine) 15 VM host (virtual machine) 16a Hypervisor (First Hypervisor) 16b Hypervisor (Secondary Hypervisor) 20 Gateway 22 Control Mechanism 31 Operation control section 32 Information Transfer Unit (Transfer Unit) 33 Communication capacity acquisition unit 34 Communication amount determination unit 35 Communication control section 36 Application execution unit 37 Evaluation and Verification Department 38 Virtual Device Generation Unit (Generation Unit) 39 Information Transmitting and Receiving Unit Communications for C1 applications C2, C3 evaluation and verification communication C4 Information and Communications

Claims

1. A control device that can be mounted on a vehicle, the control device comprising: a first hypervisor that controls execution of a first virtual machine; and a second hypervisor that controls execution of a second virtual machine and communicates with the first hypervisor via a gateway, a communication control unit that dynamically limits at least one of the amount of communication for the application and the amount of communication for the evaluation and verification based on an execution status of communication for the application executed between the first hypervisor and the second hypervisor, an execution status of communication for evaluation and verification executed between the first hypervisor and the second hypervisor, and a communication capacity of the gateway while the first virtual machine and the second virtual machine are running; Control device.

2. The communication control unit When a total value of a communication volume of the application communication and a communication volume of the evaluation / verification communication executed between the first hypervisor and the second hypervisor during the activation of the first virtual machine and the second virtual machine puts pressure on the communication capacity of the gateway, the communication volume of the application communication and the communication volume of the evaluation / verification communication are controlled so that the total value of the communication volume of the application communication and the communication volume of the evaluation / verification communication does not exceed the communication capacity of the gateway. The control device according to claim 1 .

3. the communication control unit determines whether the communication capacity of the gateway is being strained based on a congestion control signal indicating that the communication volume of the gateway has exceeded a threshold. The control device according to claim 2 .

4. The communication control unit When the congestion control signal is received, the application communication is given priority. The control device according to claim 3 .

5. a transfer unit that transfers an execution state and execution content of a virtual CPU for evaluation and verification from the first hypervisor to the second hypervisor before starting the first virtual machine and the second virtual machine. The control device according to claim 1 .

6. a generating unit configured to virtually generate a device under the second hypervisor when a device used by the virtual CPU does not exist under the second hypervisor that receives the execution state and execution content of the evaluation / verification virtual CPU; The control device according to claim 5 .

7. The communication control unit when an amount of data not yet transmitted between the first hypervisor and the second hypervisor is equal to or greater than a predetermined value, interrupting the operation of the first virtual machine and the second virtual machine, and transmitting the data not yet communicated between the first hypervisor and the second hypervisor; The control device according to claim 1 .

8. The communication control unit when an amount of data not yet transmitted between the first hypervisor and the second hypervisor falls below a predetermined value, restarting the operations of the first virtual machine and the second virtual machine; The control device according to claim 7.

9. The control device a virtual machine that communicates with the first hypervisor and performs part of the processing performed by the first hypervisor; The control device according to claim 1 .

10. A control system that can be mounted on a vehicle, comprising: a first hypervisor that controls execution of a first virtual machine; and a second hypervisor that controls execution of a second virtual machine and communicates with the first hypervisor via a gateway, a communication control unit that dynamically limits at least one of the amount of communication for the application and the amount of communication for the evaluation and verification based on an execution status of communication for the application executed between the first hypervisor and the second hypervisor, an execution status of communication for evaluation and verification executed between the first hypervisor and the second hypervisor, and a communication capacity of the gateway while the first virtual machine and the second virtual machine are running; Control system.

11. A control method performed by a control device that can be mounted on a vehicle, the control device including a first hypervisor that controls execution of a first virtual machine, and a second hypervisor that controls execution of a second virtual machine and communicates with the first hypervisor via a gateway, the method comprising: performing a communication control process that dynamically limits at least one of the communication volume of the application communication and the communication volume of the evaluation and verification communication based on an execution status of the application communication executed between the first hypervisor and the second hypervisor, an execution status of the evaluation and verification communication executed between the first hypervisor and the second hypervisor, and a communication capacity of the gateway while the first virtual machine and the second virtual machine are running; Control method.

Images