Electronic control unit

Abstract

To provide a technique to cause another virtual machine to properly execute a process on behalf of a malfunctioning virtual machine.SOLUTION: An electronic control apparatus 2 includes a hypervisor 100 and a plurality of virtual machines 110-160. The virtual machines include a target virtual machine 120 and a substitute virtual machine 160 set thereto. A determination unit 104 of the hypervisor determines whether the target virtual machine is normal or abnormal. A copying unit 106 of the hypervisor copies, when the target virtual machine is normal, data stored in a storage region of a volatile memory 30 allocated to the target virtual machine to a storage region of a volatile memory allocated to the substitute virtual machine. When the target virtual machine is abnormal, a substitution unit 106 of the substitutive virtual machine is substituted to execute a process on behalf of the target virtual machine on the basis of the data copied to the storage region of the volatile memory allocated to the substitutive virtual machine.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] This disclosure relates to a technology for substituting the processing of a virtual machine.

Background Art

[0002] In the technology described in Patent Document 1 below, in a microcontroller having a multi-core CPU, while the first core and the second core execute pre-assigned processing, they monitor whether the other core is normal or abnormal. Then, when one core becomes abnormal, the other core substitutes for the processing being executed by the one core.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] When one core becomes abnormal and the other core substitutes for the processing being executed by the one core, the other core takes over and uses the data stored by the one core. However, it is difficult to determine whether the data stored by one core when the one core becomes abnormal is normal or abnormal.

[0005] As a result of the inventors' detailed examination, it has been found that when using data for which it is impossible to determine whether it is normal or abnormal as described above, there is a problem that the other core cannot appropriately substitute for the processing being executed by the one core. The same problem occurs even when the core is replaced with a virtual machine.

[0006] One aspect of this disclosure is desirably to provide a technology in which another virtual machine appropriately substitutes for the processing of an abnormal virtual machine.

Means for Solving the Problems

[0007] An electronic control device (2-6) according to one aspect of the present disclosure comprises a hypervisor (100) and a plurality of virtual machines (110-170) whose operation is controlled by the hypervisor.

[0008] Each of the multiple virtual machines is configured with at least one target virtual machine (120, 130) whose status as normal or abnormal is monitored, and at least one substitute virtual machine (160, 170) that takes over the processing of the target virtual machine if the target virtual machine is abnormal.

[0009] One substitute virtual machine takes over the processing of one or more target virtual machines. The hypervisor comprises a determination unit (104, S420) and a copying unit (106, S422).

[0010] The determination unit determines whether the target virtual machine is normal or abnormal. If the determination unit determines that the target virtual machine is normal, the copy unit copies the data stored in the memory areas (34, 36) allocated to the target virtual machine in the volatile memory (30) to the memory areas (42, 44) allocated to the substitute virtual machine in the volatile memory.

[0011] The substitute virtual machine includes a substitute unit (162, 172, S430) configured to take over the processing of the target virtual machine based on data copied to the storage area allocated to the substitute virtual machine in volatile memory when the determination unit determines that the target virtual machine is abnormal.

[0012] With this configuration, when the target virtual machine is functioning normally, the data of the target virtual machine that has been copied to the storage area allocated to the substitute virtual machine in volatile memory will remain normal.

[0013] Therefore, when the target virtual machine malfunctions, the substitute virtual machine can appropriately substitute for the processing of the target virtual machine based on the normal data of the target virtual machine copied to the memory area assigned to the substitute virtual machine.

Brief Description of the Drawings

[0014] [Figure 1] Block diagram showing the configuration of the electronic control device according to the first embodiment. [Figure 2] Schematic diagram for explaining the substitution of processing when the virtual machine malfunctions. [Figure 3] Schematic diagram showing the configuration of the memory. [Figure 4] Sequence diagram showing the substitution processing. [Figure 5] Explanatory diagram for explaining the scheduling of the virtual machine. [Figure 6] Flowchart showing the processing executed by the target virtual machine. [Figure 7] Flowchart showing the processing executed by the hypervisor. [Figure 8] Flowchart showing the processing executed by the substitute virtual machine. [Figure 9] Block diagram showing the configuration of the electronic control device according to the second embodiment. [Figure 10] Schematic diagram showing the configuration of the memory. [Figure 11] Explanatory diagram for explaining the scheduling of the virtual machine. [Figure 12] Block diagram showing the configuration of the electronic control device according to the third embodiment. [Figure 13] Schematic diagram showing the configuration of the memory. [Figure 14] Explanatory diagram for explaining the scheduling of the virtual machine.

Modes for Carrying Out the Invention

[0016] Memory 20 includes RAM 30, ROM 50, and flash memory (not shown). HV100 and VM110~VM160 communicate with each other by writing and reading data from a shared memory area (not shown) configured in RAM 30.

[0017] The six VM110-VM160 virtualize functions that perform vehicle control and other operations, as described later, using software. Figures 1 and 2 illustrate the six VM110-VM160, but this is an example, and the number of VMs is not limited to six.

[0018] As shown in Figure 3, memory areas 32-42 of RAM30 and memory areas 52-62 of ROM50 are allocated to VM110-VM160, respectively. The data in memory area 54 of ROM50 allocated to VM120 has been copied in advance to memory area 62 of ROM50 allocated to VM160.

[0019] Note that in Figure 3, RAM30 and ROM50 are shown as a common memory area for the sake of simplification, but they are, of course, different memory areas. The HV100 comprises a VM control unit 102, a determination unit 104, and a copy unit 106. The VM control unit 102 manages hardware resources such as cores and memory 20 allocated to VM110 to VM160, and controls the operation of VM110 to VM160. In this embodiment, one core is allocated to each of VM110 to VM160.

[0020] As shown in Figure 4, the determination unit 104 determines whether VM120 is normal or abnormal based on the self-diagnosis results from VM120. In other words, VM120 is the target virtual machine that is monitored to determine whether it is normal or abnormal.

[0021] When the determination unit 104 determines that VM120 is functioning correctly, the copy unit 106 copies the data in the memory area 34 of RAM 30 allocated to VM120 to the memory area 42 of RAM 30 allocated to VM160, as shown in Figures 3 and 4. The data in the memory area 34 of RAM 30 that is copied includes the program that VM120 will execute.

[0022] Of the six VMs (VM110-VM160), five (VM110-VM150) perform vehicle control functions such as body control and engine control. VM160 takes over the processing that VM120 was performing when it was functioning correctly if VM120 malfunctions. In other words, VM160 is a substitute virtual machine that takes over the processing of the target virtual machine, VM120, when VM120 malfunctions.

[0023] VM110 and 120 are equipped with execution units 112 and 122 that perform the aforementioned vehicle control. Although not shown in Figures 1 and 2, VM130 to 150 are also equipped with execution units that perform vehicle control. VM120 is further equipped with a diagnostic unit 124 that performs self-diagnosis.

[0024] VM160 includes a substitute unit 162 that takes over the processing that VM120 was performing when it was functioning correctly if VM120 malfunctions. When VM120 is functioning correctly, VM160 is not started by HV100 and remains in a standby state.

[0025] [1-2. Processing] Next, we will explain the processes that microcontroller 2 executes. (1) Scheduling As shown in Figure 5, when VM120 is functioning normally, execution time is allocated to HV100 and VM110-VM150 in a 1ms period. When VM120 is functioning normally, VM160 is in standby mode, so the execution time allocated to VM160 is 0μs.

[0026] If VM120 malfunctions, the 200μs execution time allocated to VM120 is allocated to VM160. Then, VM160 is started at the execution timing of VM120 and takes over VM120's processing. Note that VM160 only takes over VM120's processing and does not perform VM120's self-diagnostic processing.

[0027] (2) Processing of VM120 The flowchart shown in Figure 6 is executed when VM120 is started by HV100. First, in S400, the execution unit 122 of VM120 performs normal processing such as vehicle control. After the completion of normal processing, in S402, the diagnostic unit 124 of VM120 performs RAM diagnostics.

[0028] The diagnostic unit 124, as part of the RAM diagnostic, diagnoses whether the memory area 34 of the RAM 30 allocated to VM120 is normal or abnormal when performing operations such as reading or writing to it, using ECC. ECC stands for Error Correcting Code.

[0029] RAM diagnostics are not limited to ECC; they may also be performed based on whether the written data can be read correctly. In S404, the diagnostic unit 124 determines whether the RAM diagnostic result is normal or not. If the determination in S404 is Yes, that is, if the RAM diagnostic result is normal, the process proceeds to S408.

[0030] If the determination in S404 is No, meaning the RAM diagnostic result is abnormal, in S406 the diagnostic unit 124 requests HV100 to switch the processing of VM120 to VM160 and have it take over. This request can be achieved, for example, by turning on the substitute flag.

[0031] In S408, the diagnostic unit 124 performs a ROM diagnosis. As part of the ROM diagnosis, the diagnostic unit 124 diagnoses whether the storage area 54 of the ROM 50 assigned to VM120 is normal or abnormal, for example, by CRC. CRC stands for Cyclic Redundancy Check.

[0032] ROM diagnosis is not limited to CRC; it can also be performed by checking whether the checksums match. In S410, the diagnostic unit 124 determines whether the ROM diagnostic result is normal or not. If the determination in S410 is Yes, that is, if the ROM diagnostic result is normal, the process proceeds to S414.

[0033] If the result of S410 is No, meaning the ROM diagnosis is abnormal, then in S412 the diagnostic unit 124 requests HV100 to switch the processing of VM120 to VM160 and have it take over.

[0034] In S414, the diagnostic unit 124 performs a flow diagnosis to determine whether or not the steps that should be executed in the processing flow executed by the execution unit 122 have been executed. In S416, the diagnostic unit 124 determines whether the result of the flow diagnosis is normal or not. If the determination in S416 is Yes, that is, if the result of the flow diagnosis is normal, this process ends.

[0035] If the judgment in S416 is No, that is, if the result of the flow diagnosis is abnormal, in S418 the diagnostic unit 124 requests HV100 to switch the processing of VM120 to VM160 and have it take over.

[0036] (3) Processing of HV100 The flowchart shown in Figure 7 is executed by HV100 after the processing of VM120 in Figure 6 is completed.

[0037] In S420, the determination unit 104 of HV100 determines whether or not there is a request to switch the processing of VM120 to VM160. This determination is made, for example, based on whether the aforementioned delegation flag is on or off.

[0038] If the determination in S420 is No, meaning there is no request for a substitute, in S422 the copy unit 106 of HV100 copies the data in the storage area 34 of RAM30 allocated to VM120 to the storage area 42 of RAM30 allocated to VM160. After the execution of S422, this process ends.

[0039] If the determination in S420 is Yes, that is, if there is a request for proxy execution, in S424 the VM control unit 102 of HV100 changes the execution time allocated to VM120 from 200μs to 0μs and stops the execution of VM120.

[0040] In S426, the VM control unit 102 changes the execution time allocated to VM160 from 0μs to 200μs, and switches the processing of VM120 to VM160. In this case, VM160 is started at the same time that VM120 was running.

[0041] (4) Processing of VM160 The flowchart shown in Figure 8 is executed when VM160 is started by HV100. In S430, the substitute unit 162 of VM160 performs the processing of VM120. In this case, VM160 only performs the normal processing of VM120 and does not perform the self-diagnostic processing of VM120.

[0042] In the first embodiment described above, the microcontroller 2 corresponds to the electronic control unit, VM120 corresponds to the target virtual machine, and VM160 corresponds to the substitute virtual machine. Furthermore, S402, S404, S408, S410, S414, and S416 correspond to the processing of the diagnostic unit, S420 corresponds to the processing of the determination unit, S422 corresponds to the processing of the copy unit, and S430 corresponds to the processing of the proxy unit.

[0043] [1-3. Effects] According to the first embodiment described above, the following effects can be obtained. (1a) When the target virtual machine VM120 is functioning normally, the HV100 copies the data from the memory area 34 of the RAM 30 allocated to VM120 to the memory area 42 of the RAM 30 allocated to VM160. In addition, the data from the memory area 54 of the ROM 50 allocated to VM120 has already been copied to the memory area 62 of the ROM 50 allocated to VM160. As a result, even if an abnormality occurs in VM120, VM160 can take over the processing of VM120 based on the normal data of VM120 copied to the memory area 42 of RAM30 and the data of VM120 that had been previously copied to the memory area 62 of ROM50.

[0044] In this case, since VM160 can use the data from when VM120 was functioning normally before it malfunctioned, it can take over the processing that VM120 was performing and perform it appropriately. (1b) VM160 is in a standby state and does not perform any processing when VM120 is functioning normally. When VM120 malfunctions, VM160 does not perform any processing other than the substitute processing that takes over the processing of VM120. This prevents an increase in the processing load on VM160 due to processing other than the substitute processing.

[0045] [2. Second Embodiment] [2-1. Differences from the First Embodiment] The second embodiment has the same basic configuration as the first embodiment, so the differences will be explained below. Note that the same reference numerals as in the first embodiment indicate the same components, and refer to the preceding description.

[0046] In the first embodiment described above, the substitute virtual machine VM160 performed processing on behalf of only one target virtual machine, VM120. In contrast, the second embodiment differs from the first embodiment in that, as shown in Figure 9, VM160 performs processing on two target virtual machines, VM120 and VM130.

[0047] [2-2. Structure] In the microcontroller 4 shown in Figure 9, VM130, like VM120, includes an execution unit 132 and a diagnostic unit 134. Whether VM120 and VM130 are normal or abnormal is determined, as in the first embodiment, by whether the proxy flag set by the diagnostic unit 124 of VM120 and the diagnostic unit 134 of VM130, based on the results of performing RAM diagnosis, ROM diagnosis, and flow diagnosis, is on or off.

[0048] As shown in Figure 10, the data in the storage area 54 of ROM40 allocated to VM120, and the data in the storage area 56 of ROM40 allocated to VM130, have been previously copied to the storage area 62 of ROM40 allocated to VM160.

[0049] The determination unit 104 of HV100 determines whether VM120 and VM130 are normal or abnormal based on the respective substitute flags of VM120 and VM130. If VM120 is functioning correctly, the copy unit 106 copies the data in the memory area 34 of RAM30 allocated to VM120 to the memory area 42 of RAM30 allocated to VM160. Also, if VM130 is functioning correctly, the copy unit 106 copies the data in the memory area 36 of RAM30 allocated to VM130 to the memory area 42 of RAM30 allocated to VM160.

[0050] As shown in Figure 11, if VM120 is abnormal, the VM control unit 102 changes the execution time allocated to VM120 from 100 μs to 0 μs and stops the execution of VM120. Then, the VM control unit 102 adds 100 μs to the execution time allocated to VM160 and switches the processing of VM120 to VM160 to take over.

[0051] Furthermore, if VM130 is abnormal, the VM control unit 102 changes the execution time allocated to VM130 from 100μs to 0μs and stops the execution of VM130. Then, the VM control unit 102 adds 100μs to the execution time allocated to VM160 and switches the processing of VM130 to VM160 to take over.

[0052] The VM160's substitute unit 162 will take over the processing of only one of the VMs, either VM120 or VM130, if only one of them is abnormal. If both VM120 and VM130 are abnormal, it will take over the processing of both. When the substitute unit 162 takes over the processing of both VM120 and VM130, VM160 is allocated a total execution time of 200 μs.

[0053] Furthermore, the VM160's substitute unit 162 only performs the normal processing for VM120 and VM130, and does not perform the self-diagnostic processing for VM120 and VM130. In the second embodiment described above, the microcontroller 4 corresponds to the electronic control unit, VM120 and VM130 correspond to the target virtual machine, and VM160 corresponds to the substitute virtual machine.

[0054] [2-3. Effects] According to the second embodiment described above, the following effects can be obtained. (2a) When the target virtual machines VM120 and VM130 are functioning normally, the HV100 copies the data from storage areas 34 and 36 of RAM30 allocated to VM120 and VM130, respectively, to storage area 42 of RAM30 allocated to VM160.

[0055] Furthermore, the data in storage area 54 of ROM 50 assigned to VM120 and the data in storage area 56 of ROM 50 assigned to VM130 have been previously copied to storage area 62 of ROM 50 assigned to VM160. As a result, even if an abnormality occurs in either VM120 or VM130, VM160 can take over the processing of VM120 and VM130 based on the data copied to the storage area 42 of RAM30 and the storage area 62 of ROM50.

[0056] In this case, since VM160 can use the data from when VM120 and VM130 were functioning normally before they malfunctioned, VM160 can take over the processing that VM120 and VM130 were performing and perform it appropriately.

[0057] (2b) VM160 is in a standby state and does not perform any processing when VM120 and VM130 are functioning normally. When VM120 and VM130 become abnormal, VM160 does not perform any processing other than the substitute processing that takes over the processing of VM120 and VM130. This prevents an increase in the processing load on VM160 due to processing other than the substitute processing.

[0058] (2c) If both VM120 and VM130 fail, as shown in Figure 11, VM160 will execute the processing for both VM120 and VM130 consecutively. Therefore, in a 1ms cycle, HV100 only needs to start VM160 once. This reduces the processing load on HV100.

[0059] [3. Third Embodiment] [3-1. Differences from the second embodiment] The third embodiment has the same basic configuration as the second embodiment, so the differences will be explained below. The same reference numerals as in the second embodiment indicate the same components, and refer to the preceding description.

[0060] In the second embodiment described above, one VM160 was configured as a substitute virtual machine for the two target virtual machines, VM120 and VM130. In contrast, the third embodiment differs from the second embodiment in that, in the microcontroller 6 shown in Figure 12, VM160 is set as a substitute virtual machine if VM120 is abnormal, and VM170 is set as a substitute virtual machine if VM130 is abnormal. [3-2. Structure] The microcontroller 6 shown in Figure 12 is equipped with seven VM110 to VM170. VM170 is equipped with a substitute unit 172, similar to VM160.

[0061] As shown in Figure 13, the data in storage area 54 of ROM 50, which is allocated to VM120, has been previously copied to storage area 62 of ROM 40, which is allocated to VM160.

[0062] The data in storage area 56 of ROM40, which is allocated to VM130, has been previously copied to storage area 64 of ROM40, which is allocated to VM170. If VM120 is functioning correctly, the copy unit 106 of HV100 copies the data in the memory area 34 of RAM30 allocated to VM120 to the memory area 42 of RAM30 allocated to VM160.

[0063] If VM130 is functioning correctly, the copy unit 106 copies the data in the memory area 36 of RAM30 allocated to VM130 to the memory area 64 of RAM30 allocated to VM170.

[0064] As shown in Figure 14, if VM120 is abnormal, the VM control unit 102 changes the execution time allocated to VM120 from 100 μs to 0 μs and stops the execution of VM120. Then, the VM control unit 102 changes the execution time allocated to VM160 from 0 μs to 100 μs and switches the processing of VM120 to VM160 to take over.

[0065] Furthermore, if VM130 is abnormal, the VM control unit 102 changes the execution time allocated to VM130 from 100μs to 0μs and stops the execution of VM130. Then, the VM control unit 102 changes the execution time allocated to VM170 from 0μs to 100μs and switches the processing of VM120 to VM170 to take over.

[0066] Furthermore, the VM160 substitute unit 162 only performs the processing for VM120 and does not execute the VM120 self-diagnostic process. Similarly, the VM170 substitute unit 172 only performs the processing for VM130 and does not execute the VM130 self-diagnostic process.

[0067] In the third embodiment described above, the microcontroller 6 corresponds to the electronic control unit, VM120 and VM130 correspond to the target virtual machine, and VM160 and VM170 correspond to the substitute virtual machine.

[0068] [3-3. Effects] According to the third embodiment described above, the same effects as those of the first embodiment (1a) to (1c) can be obtained. Furthermore, the same effects as those of the first embodiment (1a) to (1c) can be obtained by replacing VM120 and 160 with VM130 and 170, and memory areas 34, 42, 54, and 62 with memory areas 36, 44, 56, and 64, respectively.

[0069] [4. Other Embodiments] Although embodiments of this disclosure have been described above, this disclosure is not limited to the embodiments described above and can be implemented in various modified forms.

[0070] (4a) In the first and second embodiments described above, if the target virtual machine VM120, or VM120 and VM130, are functioning normally, the substitute virtual machine VM160 does not perform any processing.

[0071] In contrast, if the target virtual machine VM120, or both VM120 and VM130, are functioning normally, the substitute virtual machine VM160 may perform some normal vehicle control processing.

[0072] Furthermore, if the target virtual machine VM120, or at least one of VM120 and VM130, becomes abnormal, the substitute virtual machine VM160 may, in addition to normal processing, take over the processing of the abnormal VM.

[0073] Alternatively, VM160, a substitute virtual machine, may stop the normal vehicle control processing it was performing and take over the processing of the abnormal VM. In this case, the normal processing performed by VM160 would be processes such as door opening and closing control, which would not hinder vehicle operation if stopped.

[0074] (4b) In the third embodiment described above, as in the first embodiment, if VM130 is functioning normally, no processing is performed with VM170, which is the substitute virtual machine. In contrast, if the target virtual machine VM130 is functioning normally, the substitute virtual machine VM170 may perform some kind of normal processing, such as vehicle control.

[0075] Furthermore, if the target virtual machine, VM130, becomes abnormal, the substitute virtual machine, VM170, may take over the processing of the abnormal VM in addition to the vehicle control processing. Alternatively, VM170, which is a substitute virtual machine, may stop the vehicle control processing it was performing and take over the processing of VM130. In this case, the normal processing performed by VM170 would be processes such as audio control that would not hinder vehicle operation if stopped.

[0076] (4c) In the embodiment described above, if the target virtual machine becomes abnormal, the substitute virtual machine will perform the normal processing of the target virtual machine, but will not perform self-diagnosis. In contrast, if the target virtual machine becomes abnormal, the substitute virtual machine may perform self-diagnosis in addition to the normal processing of the target virtual machine. If the self-diagnosis reveals that the substitute virtual machine is abnormal, another substitute virtual machine that targets the substitute virtual machine will take over the processing of the abnormal substitute virtual machine.

[0077] The process of another virtual machine taking over the handling of an abnormal virtual machine may be completed in one stage or may proceed through multiple stages. In this case, the other virtual machines taking over the handling of the abnormal virtual machine in the final stage will not perform self-diagnosis.

[0078] (4d) In the embodiments described above, the microcontrollers 2-6, which are electronic control devices, were mounted on the vehicle and performed vehicle control, but the invention is not limited to this. Electronic control devices can be used in any technical field as long as a virtual machine is executed on the electronic control device and other virtual machines take over the processing of abnormal virtual machines.

[0079] (4e) In the embodiments described above, microcontrollers 2 to 6 were each exemplified as electronic control devices, but the invention is not limited to these. For example, the electronic control device may comprise multiple microcontrollers. (4f) The microcontrollers 2 to 6 and the method described herein may be implemented by a dedicated computer provided by configuring a processor and memory programmed to perform one or more functions embodied by a computer program.

[0080] Alternatively, the microcontrollers 2-6 and the methods described herein may be implemented by a dedicated computer provided by configuring a processor with one or more dedicated hardware logic circuits.

[0081] Alternatively, the microcontrollers 2 to 6 and the methods described herein may be implemented by one or more dedicated computers comprising a combination of a processor and memory programmed to perform one or more functions and a processor comprising one or more hardware logic circuits.

[0082] Furthermore, computer programs may be stored on a computer-readable, non-transitional tangible recording medium as instructions executed by the computer. The methods for realizing the functions of each part included in microcontrollers 2-6 do not necessarily have to include software; all of these functions may be realized using one or more hardware components.

[0083] (4g) Multiple functions provided by one component in the above-described embodiment may be realized by multiple components, or one function provided by one component may be realized by multiple components. Alternatively, multiple functions provided by multiple components may be realized by one component, or one function realized by multiple components may be realized by one component. Furthermore, some of the configurations of the above-described embodiments may be omitted. Also, at least some of the configurations of the above-described embodiments may be added to or replaced with the configurations of other above-described embodiments.

[0084] (4h) In addition to the microcontrollers 2-6 described above, this disclosure can also be realized in various forms, such as a system comprising the microcontrollers 2-6, a program for causing the microcontrollers 2-6 to function as a computer, a non-transitional physical recording medium such as semiconductor memory on which this program is recorded, and an electronic control method executed by the microcontrollers 2-6. [Explanation of Symbols]

[0085] 2-6: Microcontroller (Electronic Control Unit), 100: HV (Hypervisor), 104: Judgment Unit, 106: Copy Unit, 110-170: VM (Virtual Machine), 112, 122, 132: Execution Unit, 124, 134: Diagnostic Unit, 162, 172: Proxy Unit

Claims

1. An electronic control device (2-6) comprising a hypervisor (100) and a plurality of virtual machines (110-170) whose operation is controlled by the hypervisor, Each of the aforementioned multiple virtual machines is configured with at least one target virtual machine (120, 130) that is monitored for whether it is normal or abnormal, and at least one substitute virtual machine (160, 170) that takes over the processing of the target virtual machine if the target virtual machine is abnormal. One of the substitute virtual machines performs the processing of one or more of the target virtual machines. The aforementioned hypervisor, A determination unit (104, S420) configured to determine whether the target virtual machine is normal or abnormal, When the determination unit determines that the target virtual machine is normal, a copy unit (106, S422) is configured to copy the data stored in the storage area (34, 36) allocated to the target virtual machine in the volatile memory (30) to the storage area (42, 44) allocated to the substitute virtual machine in the volatile memory, Equipped with, The substitute virtual machine includes a substitute unit (162, 172, S430) configured to perform the processing of the target virtual machine on behalf of the target virtual machine based on the data copied to the storage area allocated to the substitute virtual machine in the volatile memory when the determination unit determines that the target virtual machine is abnormal. Electronic control unit.

2. The electronic control device according to claim 1, The data stored in the storage areas (54, 56) allocated to the target virtual machine in the non-volatile memory (50) is copied to the storage areas (62, 64) allocated to the substitute virtual machine in the non-volatile memory. The substitute unit is configured to, in the event that the target virtual machine is abnormal, to perform the processing of the target virtual machine based on the data copied to the respective storage areas allocated to the substitute virtual machine in the volatile memory and the non-volatile memory. Electronic control unit.

3. The electronic control device according to claim 1, The substitute virtual machine is configured to be in a standby state when the target virtual machine is functioning normally. Electronic control unit.

4. The electronic control device according to claim 1, The proxy unit is configured to perform normal processing other than the proxy processing that takes over the processing of the target virtual machine when the target virtual machine is normal, and to stop the normal processing and perform the proxy processing when the target virtual machine is abnormal. Electronic control unit.

5. The electronic control device according to claim 1, The proxy unit is configured to perform normal processing other than the proxy processing that takes over the processing of the target virtual machine when the target virtual machine is normal, and to perform the proxy processing in addition to the normal processing when the target virtual machine is abnormal. Electronic control unit.

6. The electronic control device according to claim 1, The proxy unit of one of the proxy virtual machines is configured to perform processing on behalf of one of the target virtual machines. Electronic control unit.

7. The electronic control device according to claim 1, The proxy unit of one of the proxy virtual machines is configured to perform processing on behalf of multiple of the target virtual machines. Electronic control unit.

8. An electronic control device according to any one of claims 1 to 7, The target virtual machine further comprises a diagnostic unit (124, 134, S402, S404, S414, S416) configured to diagnose whether at least one of the volatile memory and the steps executed in the processing flow is normal or abnormal as a self-diagnosis. The determination unit is configured to determine whether the target virtual machine is normal or abnormal based on the diagnosis result of the diagnostic unit. Electronic control unit.

9. The electronic control device according to claim 2, The target virtual machine further includes a diagnostic unit (124, 134, S402, S404, S408, S410, S414, S416) configured to diagnose, as a self-diagnosis, whether at least one of the volatile memory, the non-volatile memory, or the steps executed in the processing flow is normal or abnormal. The determination unit is configured to determine whether the target virtual machine is normal or abnormal based on the diagnosis result of the diagnostic unit. Electronic control unit.

Images