Electronic control unit

Abstract

To prevent the execution rate of processing requiring real-time ability from lowering even in the case of switch-over of a memory device to which an update program is to be executed.SOLUTION: An electronic control device 1 includes a plurality of schedulers that assign each of processing in an update program acquired through communication I / F 3 such that CPUs 0 and 1 execute it. The CPUs 0 and 1 access one of ROM 0 and ROM 1 as an active memory. A control device of an OTA (On The Air) controller selects a scheduler depending upon a selection of an inactive memory which the CPU 0 or 11 is not accessing. The CPU 0 or 1 connected through a dedicated bus 11(0) or 11(1) to the active memory by a selected scheduler is allowed to execute the processing requiring real-time ability, and the other of the CPU 1 or 0 is allowed to execute processing not requiring real-time ability.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present invention relates to an electronic control device having a configuration in which each of a plurality of CPUs and each of a plurality of memories are connected by dedicated buses.

Background Art

[0002] The program of an electronic control device mounted on a vehicle such as an automobile may be updated due to addition of functions or repair of defects. Conventionally, the program of the electronic control device was updated by bringing the vehicle to a dealer or the like. However, since the convenience of vehicle users was not good, a technique for updating the program by the user himself / herself by means of so-called OTA (On The Air) using wireless communication has been proposed.

[0003] When updating the program by OTA, it is desirable to be able to update even while the vehicle is running. To achieve this, two storage areas secured by the non-volatile memory of the electronic control device are used alternately, and the program on the non-active side is updated during the execution of the program. For example, by switching the area to be activated at the timing of restart such as ON / OFF of the ignition switch, it is possible to update the program even while the vehicle is running.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] In this case, depending on the connection relationship with devices such as the CPU and the memory, the processing speed may decrease due to the switching of the active side, which may affect the functions.

[0006] For example, if the memory device that is activated to run an updated program is switched, and processing via the dedicated bus becomes impossible, the speed of processing that requires real-time performance will decrease.

[0007] The present invention has been made in view of the above circumstances, and its purpose is to provide an electronic control device that can prevent a decrease in the execution speed of processing that requires real-time performance, even when the memory device on which the updated program is executed is switched. [Means for solving the problem]

[0008] According to the electronic control device described in claim 1, each scheduler assigns each process in the update program, obtained via a communication unit (3) that performs wireless communication with the outside, to be executed by a plurality of CPUs (6(0), 6(1)). Each of the plurality of CPUs is connected to one of the plurality of memories (8(0), 8(1)) via a dedicated bus (11), and to the other memories via a shared bus (5), and accesses one of the plurality of memories as active memory. The selection unit (13) selects a scheduler according to the selection of the active memory.

[0009] When multiple memory locations are available, the memory accessed by multiple CPUs to execute programs becomes active memory, while the other memory locations become inactive memory. The updated program is written to one of the inactive memory locations. When execution of the updated program begins, the aforementioned inactive memory location is switched to active memory. The scheduler selected by the selection unit causes the CPU connected to the active memory via a dedicated bus to execute processes that require real-time processing, while the other CPUs execute processes that do not require real-time processing.

[0010] With this configuration, even when a program is updated and inactive memory is switched to active memory, the CPU connected to the active memory via a dedicated bus will always execute processes that require real-time performance. Therefore, it is possible to prevent a decrease in the execution speed of processes that require real-time performance. [Brief explanation of the drawing]

[0011] [Figure 1] This is one embodiment and a functional block diagram showing the configuration of the electronic control unit. [Figure 2] A flowchart illustrating the execution process from OTA program update to scheduler determination. [Figure 3] Flowchart showing OTA update process [Figure 4] A diagram showing an example of a scheduler. [Figure 5] Flowchart showing the program rewriting process [Figure 6] Flowchart showing normal processing [Figure 7] Flowchart showing the initialization process [Figure 8] Flowchart showing the scheduler determination process [Modes for carrying out the invention]

[0012] The following describes one embodiment. As shown in Figure 1, the electronic control unit 1 of this embodiment includes an OTA controller 2, and the OTA controller 2 obtains update programs, etc., by wirelessly communicating with an external device 4, such as an OTA center, via a communication interface (I / F) 3, which is a communication unit. The OTA controller 2 and the communication I / F 3 are connected via a shared bus 5. The shared bus 5 is connected to CPUs 6(0) and 6(1), RAM 7, ROMs 8(0) and 8(1), data flash 9, and timers 10, etc. Note that ROMs 8 and 9 are ROMs whose data can be rewritten, and are so-called flash memories.

[0013] The ROM 8 is a dual-port memory, and the CPU 6(0) and ROM 8(0), and the CPU 6(1) and ROM 8(1) are directly connected via dedicated buses 11(0) and 11(1), respectively. That is, the electronic control device 1 is supplied with operating power from the power supply circuit 12. The OTA controller 2 has a control device 13 which is a selection unit and a storage device 14 inside. Note that the update program etc. may be referred to as "rewrite data".

[0014] Next, the operation of this embodiment will be described. As shown in FIG. 2, the electronic control device 1 sequentially executes an OTA update process (S1), a normal process (S2), and a scheduler determination process (S3). Hereinafter, each of these processes will be described.

[0015] <OTA Update Process> As shown in FIG. 3, the control device 13 of the OTA controller 2 receives rewrite data from the external device 4 via the communication I / F 3 and stores it in the storage device 14 (S11). Note that the rewrite data includes a scheduler which is a program for allocating each process in the update program to be executed by the CPUs 6(0) and 6(1). More specifically, the scheduler determines which of the CPUs 6(0) and 6(1) will execute the time-periodic processing and interrupt processing of each function. Specifically, it calls in the order designed for the periodic execution process, and is the configuration setting of the real-time OS regarding the interrupt process (OK?).

[0016] In this embodiment, as shown in FIG. 4, the update program has two types of schedulers for different CPUs 6 to be executed, and can select a scheduler according to the ROM 8 which becomes the active side, and change the CPU 6 that executes the scheduler function of each function. The "active side" is either one of the ROM 8(0) or 8(1) accessed by the CPUs 6(0) and 6(1). The unaccessed side is referred to as the "non-active side". The active side corresponds to the active memory, and the non-active side corresponds to the inactive memory.

[0017] Scheduler No. 1 is selected when the active surface is ROM8(0). The CPU6(0) is made to execute processes that require real-time performance, and the CPU6(1) is made to execute processes that do not require real-time performance. "Processes that require real-time performance" are, for example, fuel injection control of an engine when assuming application to vehicle control, and "processes that do not require real-time performance" are, for example, control of a car air conditioner. At this time, the CPU6(0) accesses the ROM8(0) via the dedicated bus 11(0), and the CPU6(1) accesses the ROM8(0) via the shared bus 5.

[0018] On the other hand, Scheduler No. 2 is the opposite of the above. It is selected when the active surface is ROM8(1). The CPU6(1) is made to execute processes that require real-time performance, and the CPU6(0) is made to execute processes that do not require real-time performance. At this time, the CPU6(1) accesses the ROM8(1) via the dedicated bus 11(1), and the CPU6(0) accesses the ROM8(1) via the shared bus 5.

[0019] Next, it is determined whether the CPU6 is executing a program, that is, whether it is operating (S12). For example, the control device 13 monitors the state of the CPU6 and determines that the program is being executed when the state of the bus accessing the ROM8 or when the interface is being called. In the electronic control device 1, the case where the CPU6 stops operating is, for example, when assuming application to an ECU (Electronic Control Unit) mounted on a vehicle, it is a case where the ignition switch is turned off when the vehicle is parked.

[0020] If the CPU 6 is not operating (No), perform the program rewriting process (S14). Details of this rewriting process will be described later. On the other hand, if it is operating (Yes), after stopping the functions of the CPU 6 and the RAM 7 that are not used for program rewriting (S13), proceed to step S14. "Stopping the function of the CPU 6" means, for example, shifting to the HALT mode. Also, "stopping the function of the RAM 7" means, for example, stopping the supply of the backup power if it is a SRAM, or stopping the refresh operation if it is a DRAM. Then, make the same determination as in step S12 (S15). If it is operating (Yes), wait until the operation stops. When it stops (No), switch the active surface (S16).

[0021] <Program Rewriting Process> As shown in FIG. 5, when the control device 13 determines the active surface (S21), it saves a part of the rewrite data acquired via the communication I / F 3 in the storage device 14 (S22). Next, the control device 13 checks the congestion status of the shared bus 5 (S23). The congestion status of the bus 5 is determined, for example, by the number of bus requests output to the arbiter when using an arbiter that mediates requests for the use right of the bus by a plurality of bus masters. If the congestion level of the shared bus 5 is below the expected value and not congested (Yes), start writing to the ROM 8 of the data saved in the storage device 14 (S24). If it exceeds the expected value (No), wait until the congestion is alleviated.

[0022] In step S24, the control device 13 writes the rewrite data saved in the storage device 14 to the ROM 8 of the non-active surface. At this time, the scheduler is included in the rewrite data and can be used on either active surface. Finally, check whether the writing is completed (S25). If the writing fails, return to step S22 and perform the data writing process again.

[0023] <Normal Process> As shown in Figure 6, normal processing starts after initialization processing (S31) (S32). Initialization processing is performed by one of the CPUs 6, while the other waits until initialization is complete. Each CPU 6 starts normal processing based on the scheduler determined during initialization processing. Normal processing is the execution of a program by the CPU 6 to realize the functions assigned to the electronic control unit 1.

[0024] <Initialization process> As shown in Figure 7, the initialization process determines the active side of ROM 8 (S41). However, since the active side is also determined during the program rewriting process shown in Figure 5, the result of that determination may be stored in the storage device 14 and that result may be referenced. Next, the scheduler abnormality is determined (S42). The CPU 6 refers to the scheduler determination result stored in the data flash 9 and determines whether or not there is an abnormality in the scheduler. If there is no abnormality in the scheduler (No), a scheduler based on the active side is selected (S44).

[0025] On the other hand, if there is an abnormality in the scheduler (Yes), select another scheduler (S43). That is, instead of setting the scheduler based on the active plane, select a different scheduler. For example, if scheduler No. 1 shown in Figure 3 is set and an abnormality occurs, select scheduler No. 2.

[0026] <Scheduler Anomaly Detection Process> As shown in Figure 8, if the processing speed of normal processing exceeds the expected value (S51; No), the scheduler is judged as normal and the judgment result is OK (S52). On the other hand, if the processing speed of normal processing is below the expected value and slow, or if it significantly exceeds the expected value and the speed is abnormally fast (S51; Yes), the scheduler is judged as abnormal and the judgment result is NG (S54). Here, the processing speed is measured using the timer 10 for each CPU 6 that performs normal processing. In the case where the speed significantly exceeds the expected value and is abnormally fast, if the expected value is set as the lower limit expected value, an upper limit expected value that is larger than the lower limit expected value is set, and the processing speed is compared and judged against this upper limit expected value.

[0027] Finally, the judgment result is written to the data flash 9 (S53) and the judgment process ends. This scheduler judgment process is intended to be performed after the normal processing is completed, before the power is cut off and the electronic control unit 1 is shut down. As shown in Figure 7, this judgment result is referenced the next time the electronic control unit 1 is started up and normal processing begins.

[0028] As described above, according to this embodiment, in the electronic control unit 1, each scheduler assigns each process in the update program acquired via the communication unit to be executed by the CPUs 6(0) and 6(1). The CPUs 6(0) and 6(1) are connected to the ROMs 8(0) and 8(1) respectively via dedicated buses 11(0) and 11(1), and are also connected to the ROMs 8(1) and 8(0) via a shared bus 5. The CPUs 6(0) and 6(1) access one of the ROMs 8(0) and 8(1) as active memory.

[0029] The control unit 13 of the OTA controller 2 selects a scheduler according to the selection of the active memory and ROM 8 being accessed by CPUs 6(0) and 6(1). The selected scheduler causes CPU 6 connected to the ROM 8, which is the active memory, via a dedicated bus 11 to execute processes that require real-time processing, and causes the other CPUs 6 to execute processes that do not require real-time processing.

[0030] With this configuration, even when a program is updated and inactive memory is switched to active memory, the CPU 6, which is connected to the active memory via a dedicated bus 11, will always execute processes that require real-time performance. Therefore, it is possible to prevent a decrease in the execution speed of processes that require real-time performance.

[0031] Furthermore, the control device 13 measures the speed at which the process executed by the selected scheduler is completed. If the measured speed is slower than the lower limit expected value, the control device 13 determines the scheduler to be abnormal and stores the determination result in the data flash 9. The control device 13 also determines the scheduler to be abnormal if the measured speed is faster than the upper limit expected value, which is set to a value faster than the lower limit expected value. This makes it possible to take measures such as avoiding the use of a scheduler that has been determined to be abnormal.

[0032] (Other embodiments) There may be three or more sets of CPU and ROM components. It can also be applied to control systems other than vehicle control. This disclosure is described in accordance with the embodiments, but it is understood that this disclosure is not limited to such embodiments or structures. This disclosure also includes various modifications and variations within the equivalence. In addition, various combinations and forms, as well as other combinations and forms that include only one, more, or fewer of those elements, fall within the scope and concept of this disclosure. [Explanation of Symbols]

[0033] In the drawing, 1 represents the electronic control unit, 3 the communication interface, 5 the shared bus, 6 the CPU, 8 the ROM, 11 the dedicated bus, and 13 the control unit.

Claims

1. Multiple CPUs (6(0), 6(1)), Multiple memory locations (8(0), 8(1)), Multiple schedulers that assign each process in the update program obtained via a communication unit (3) that performs wireless communication with the outside to be executed by the multiple CPUs, It includes a selection unit (13) for selecting one of these multiple schedulers, Each of the aforementioned multiple CPUs is connected to one of the multiple memories via a dedicated bus (11) and to the other memories via a shared bus (5). One of the multiple memories is accessed as active memory, and the memory not accessed by the multiple CPUs is treated as inactive memory. The selection unit selects the scheduler according to the selection of the active memory. An electronic control device that, when the inactive memory is switched to active memory and the execution of the update program is started, causes the selected scheduler to have the CPU connected to the active memory via a dedicated bus execute processing that requires real time, and the other CPUs execute processing that does not require real time.

2. The electronic control device according to claim 1, wherein the selection unit measures the speed at which the process executed by the selected scheduler is completed, and if the measured speed is slower than the lower limit expected value, it determines that the scheduler is abnormal and stores the determination result.

3. The electronic control device according to claim 2, wherein the selection unit determines the scheduler to be abnormal when the measured speed is faster than the upper limit expected value which is set to a value faster than the lower limit expected value.

Images