Vehicle control device and control method

Abstract

A vehicle control device according to the present invention includes a first computation unit that is supplied with power from a first power supply system and has a first environment that is a first execution environment in which an application can be executed, and a second calculation unit that is supplied with power from a second power supply system and has a second environment that is a second execution environment in which an application can be executed. The first calculation unit includes a first redundant execution control unit that controls execution of an application in the first environment. The second calculation unit includes a second redundant execution control unit that controls execution of an application in the second environment. The first redundant execution control unit and the second redundant execution control unit cause a specific application, which is an application that satisfies a predetermined condition, to be executed at the same time in the first environment and the second environment.

Description

Vehicle control device and control method

[0001] The present invention relates to a vehicle control device and a control method.

[0002] In the automotive field, electronic control devices (ECDs) are widely used, using microcomputers and software to control sensors, actuators, and other components for managing the vehicle's driving status. With the recent advances in technologies such as autonomous driving and electrification, the functionality required of ECDs is increasing. Furthermore, as the number of ECDs installed in automobiles increases, the reliability of ECDs is also increasing. For example, in an autonomous driving system, when the system is responsible for autonomous driving level 3 or higher, fault tolerance is required to enable continued control even in the event of a power supply failure. Patent Document 1 (JP-A-2005-102222) discloses a redundant system installed in an autonomously driving vehicle, the redundant system having at least a first power supply system and a second power supply system different from the first power supply system. The redundant system includes a main control device for driving the vehicle autonomously, and a sub-controller for driving the vehicle that replaces the main control device for driving the vehicle when an abnormality is detected in the main control device for driving the vehicle. The main control device for driving the vehicle is connected to the first power supply system but not the second power supply system, and the sub-controller for driving the vehicle is connected to the second power supply system but not the first power supply system.

[0003] International Publication No. 2022 / 118459

[0004] The invention described in Patent Document 1 leaves room for improvement in power supply redundancy and execution redundancy.

[0005] A vehicle control device according to a first aspect of the present invention comprises a first calculation unit that is supplied with power from a first power supply system and has a first environment, which is a first execution environment in which an application can be executed, and a second calculation unit that is supplied with power from a second power supply system and has a second environment, which is a second execution environment in which an application can be executed, wherein the first calculation unit comprises a first application control unit that controls execution of the application in the first environment, and the second calculation unit comprises a second application control unit that controls execution of the application in the second environment, and the first application control unit and the second application control unit execute a specific application, which is an application that satisfies predetermined conditions, in the first environment and the second environment at the same time. A control method according to a second aspect of the present invention is a control method executed by a vehicle control device that includes a first calculation unit that is supplied with power from a first power supply system and has a first environment that is a first execution environment in which an application can be executed, and a second calculation unit that is supplied with power from a second power supply system and has a second environment that is a second execution environment in which an application can be executed, wherein the first calculation unit includes a first application control unit that controls execution of the application in the first environment, the second calculation unit includes a second application control unit that controls execution of the application in the second environment, and the first application control unit and the second application control unit execute a specific application that satisfies predetermined conditions in the first environment and the second environment at the same time.

[0006] According to the present invention, it is possible to efficiently achieve power supply redundancy and execution redundancy in a vehicle control device. Problems, configurations, and effects other than those described above will become apparent from the following description of the embodiments.

[0007] FIG. 1 is a diagram illustrating the configuration of an ECU; FIG. 2 is a diagram illustrating the configuration of a second application control unit; FIG. 3 is a diagram illustrating an example of a first application list and a first request table; FIG. 4 is a diagram illustrating an example of a first execution schedule and a second execution schedule;

[0008] -Embodiments- Hereinafter, embodiments of a vehicle control device and a control method will be described with reference to FIGS.

[0009] 1 is a configuration diagram of an ECU (Electronic Control Unit) 9, which is a vehicle control device. A first battery 31 and a second battery 32 are connected to the ECU 9. The ECU 9 includes a first calculation unit 1, a second calculation unit 2, a first power supply IC 311 connected to the first battery 31 to supply power to the first calculation unit 1, and a second power supply IC 321 connected to the second battery 32 to supply power to the second calculation unit 2. The first calculation unit 1 and the second calculation unit 2 are, for example, independent SoCs (System on Chip).

[0010] The first calculation unit 1 and the second calculation unit 2 have substantially the same configuration and there is no particular difference in performance, but for ease of explanation, the first calculation unit 1 may be referred to as the "main" and the second calculation unit 2 as the "sub." Both the first battery 31 and the second battery 32 are power sources that supply power to the ECU 9. These two batteries may also be referred to as the "first power supply system" and the "second power supply system."

[0011] The ECU 9 further includes an inter-control / arithmetic unit communication unit 41, a first communication line 42, a second communication line 43, a first in-vehicle communication unit 44, and a second in-vehicle communication unit 45. The inter-control / arithmetic unit communication unit 41 connects the first calculation unit 1 and the second calculation unit 2. The first communication line 42 connects the second calculation unit 2 and the first power supply IC 311. The second communication line 43 connects the first calculation unit 1 and the second power supply IC 321. The first in-vehicle communication unit 44 receives power from the first battery 31 and is a communication path for communicating with other control devices in the vehicle. The second in-vehicle communication unit 45 receives power from the second battery 32 and is a communication path for communicating with other control devices in the vehicle.

[0012] The first and second calculation units 1 and 2 have substantially the same configuration, and components with similar names perform the same operation. Below, the first calculation unit 1 will be described in detail as a representative of the first and second calculation units 1 and 2, and differences will be described for the second calculation unit 2. The first calculation unit 1 includes a first main core 16 and a first sub-core 17 that perform calculations, and a first self-fault determination unit 18. The first main core 16 and the first sub-core 17 are named differently merely for convenience of explanation. The first main core 16 and the first sub-core 17 may have the same hardware configuration or different hardware configurations. The first main core 16 and the first sub-core 17 may be different calculation cores included in the same physical package, or may be calculation cores included in different physical packages.

[0013] The first self-failure determination unit 18 operates independently of the first main core 16 and the first sub-core 17 and detects a failure in the first calculation unit 1. The first self-failure determination unit 18 is, for example, a microcomputer. The first self-failure determination unit 18 diagnoses, for example, the normality of the volatile memory and non-volatile memory that make up the first calculation unit 1. When the first self-failure determination unit 18 finds an area that cannot be rewritten or an area into which a value different from the written value is read, it determines that a failure has occurred in the first calculation unit 1.

[0014] The first main core 16 and the first sub-core 17 deploy programs stored in a ROM (not shown) into a RAM (not shown) and execute the programs, thereby realizing a first OS 15, a first hypervisor 14, a first result comparison unit 11, a first application control unit 12, and a first other-side failure determination unit 13. The OS 15 is an operating system, and the first hypervisor 14, the first result comparison unit 11, the first application control unit 12, and the first other-side failure determination unit 13 are executed on the first OS 15.

[0015] The first hypervisor 14 is an execution environment for a virtual machine (VM). An image of the virtual machine is stored in a storage device (not shown) provided in the first calculation unit 1 or in a storage device in the vehicle connected via the first in-vehicle communication unit 44. Each virtual machine executes one application. Therefore, in this embodiment, each virtual machine is considered to be the same as an application. Therefore, the first hypervisor 14 can also be called an execution environment for the application.

[0016] There are a wide variety of virtual machines that can run on the first hypervisor 14. In this embodiment, virtual machines are identified by a combination of "VM" and a number. In FIG. 1, VM1 to VM4 are running on the first hypervisor 14, but this is not limiting. Virtual machines will be described in detail later. The first result comparison unit 11 compares the calculation results of the first calculation unit 1 with the calculation results of the second calculation unit 2. The first application control unit 12 controls the execution of applications in the first calculation unit 1, i.e., virtual machines. The first other-side fault determination unit 13 determines a fault in the second calculation unit 2.

[0017] The second calculation unit 2 includes a second main core 26 and a second sub-core 27 that perform calculations, and a second self-failure determination unit 28. The second self-failure determination unit 28 operates independently of the second main core 26 and the second sub-core 27 and detects a failure of the second calculation unit 2. The second main core 26 and the second sub-core 27 implement a second OS 25, a second hypervisor 24, a second result comparison unit 21, a second application control unit 22, and a second other-side failure determination unit 23 by loading a program stored in a ROM (not shown) into a RAM (not shown) and executing the program. The second other-side failure determination unit 23 determines a failure of the first calculation unit 1.

[0018] 1 , VM1, VM2, VM5, and VM6 are running on the second hypervisor 24. VM1 and VM2 are the same as VM1 and VM2 running on the first hypervisor 14 of the first calculation unit 1. That is, VM1 and VM2 are redundantly executed in the first calculation unit 1 and the second calculation unit 2.

[0019] 2 is a diagram showing the configuration of the first application control unit 12 in the first computing unit 1. The first application control unit 12 includes, as its functions, a first normal schedule unit 121 that creates an application execution schedule under normal circumstances, a first degeneration determination unit 122 that determines whether to transition to degeneration control when an abnormality occurs, and a first degeneration schedule unit 123 that creates an application execution schedule under degeneration control. The first application control unit 12 has data including a first execution schedule 124, a first application list 125, and a first request table 126. The first application control unit 12 executes applications in the first hypervisor 14 based on the first execution schedule 124.

[0020] The first execution schedule 124 is an execution schedule of applications in the first calculation unit 1. The first execution schedule 124 is created by the first normal schedule unit 121 or the first degenerate schedule unit 123. The first application list 125 is a list of applications to be executed in the first calculation unit 1. The first requirement table 126 stores the ASIL (Automotive Safety Integrity Level) level (hereinafter referred to as the "required level") required by each application. Note that the ASIL level will also be referred to as the "functional safety level" hereinafter. The first requirement table 126 stores at least the required levels of the applications listed in the first application list 125.

[0021] 3 is a diagram showing the configuration of the second application control unit 22 in the second computing unit 2. The second application control unit 22 includes a second normal scheduler 221 that creates an application execution schedule under normal circumstances, a second degeneration determination unit 222 that determines whether to transition to degeneration control when an abnormality occurs, and a second degeneration scheduler 223 that controls execution scheduling under degeneration control. The second application control unit 22 has the following data: a second execution schedule 224, a second application list 225, and a second request table 226. The second application control unit 22 executes applications in the second hypervisor 24 based on the second execution schedule 224.

[0022] The second execution schedule 224 is an execution schedule of applications in the second calculation unit 2. The second execution schedule 224 is created by the second normal schedule unit 221 or the second degenerate schedule unit 223. The second application list 225 is a list of applications to be executed in the second calculation unit 2. The second request table 226 stores the request level required by each application. The second request table 226 stores at least the request levels of the applications listed in the second application list 225.

[0023] 4 is a diagram showing an example of the first application list 125 and the first request table 126 in the first calculation unit 1. The first application list 125 stores VM1 to VM4 and VM7 to VM8. The first request table 126 lists the request levels of each of the applications VM1 to VM10, including the applications listed in the first application list 125. Only VM1 and VM2 have a request level of 6 or higher, while VM3 and onwards have a request level of 5 or lower.

[0024] Fig. 5 is a diagram showing two examples of the first execution schedule 124 and the second execution schedule 224. The top two rows of Fig. 5 show a first example of the first execution schedule 124 and the second execution schedule 224, and the bottom two rows of Fig. 5 show a second example of the first execution schedule 124 and the second execution schedule 224. In Fig. 5, the sub-numbers 1 and 2 are added to distinguish between the first and second examples.

[0025] The first execution schedule 124 shows the applications to be executed for each time slot (L0, L1, ...) which is the calculation period for each of the first main core 16 and the first secondary core 17. The second execution schedule 224 shows the applications to be executed for each time slot for each of the second main core 26 and the second secondary core 27.

[0026] 5, it is described that in time slot L0, both the first main core 16 and the second main core 26 execute application VM1. In the same time slot L0, the first secondary core 17 and the second secondary core 27 execute different applications. It is also described that in time slot L2, all cores execute different applications.

[0027] 5, the first execution schedule 1241-2 is empty, and the second execution schedule 2241-2 is written to execute VM1 at the same time on two cores. Specifically, in time slot L0, VM1 is assigned to the second main core 26 and the second secondary core 27, and in time slot L1, VM2 is assigned to the second main core 26 and the second secondary core 27.

[0028] 6 is a flowchart showing the processing of the first normal scheduler 121 in the first calculation unit 1. In the following explanation, specific operations will be explained using the values ​​of the first application list 125 and the first request table 126 shown in FIG.

[0029] First, in step S301, the first normal scheduler 121 initializes a variable i to "1." In the following step S302, the first normal scheduler 121 reads the i-th item in the first application list 125. For example, at the time of the first execution, the first item, i.e., "VM1" in the example of FIG. 4, is read. In the following step S303, the first normal scheduler 121 refers to the first request table 126 and determines whether the request level of the application read in step S302 is greater than 5. If the first normal scheduler 121 determines that the request level is greater than 5, the process proceeds to step S304, and if the first normal scheduler 121 determines that the request level is 5 or less, the process proceeds to step S305.

[0030] In step S304, the first normal scheduler 121 registers the application read in step S302 in the first execution schedule 124 so that it will be executed redundantly in coordination with the second calculation unit 2, and then the process proceeds to step S306. Redundant execution means that the same application is executed by both the first calculation unit 1 and the second calculation unit 2 in the same time slot. For example, since the required level of "VM1" is "9," the first normal scheduler 121 registers it in time slot L0 of the first execution schedule 124 in step S304 in coordination with the second normal scheduler 221 of the second calculation unit 2.

[0031] In step S305, the first regular schedule unit 121 registers the application read in step S302 in the first execution schedule 124 so that it is executed independently, and then proceeds to step S306. In this case, simultaneous execution with the second calculation unit 2 is not necessary, so the application read in step S302 is simply registered.

[0032] In step S306, the first normal scheduler 121 determines whether or not the first application list 125 has been read to the end. If the first normal scheduler 121 determines that the first application list 125 has been read to the end, the process shown in Fig. 6 ends, and if the first normal scheduler 121 determines that the first application list 125 has not been read to the end, the process proceeds to step S307. In step S307, the first normal scheduler 121 increments the variable i, i.e., increases it by "1", and returns to step S302. This concludes the explanation of Fig. 6.

[0033] The processing of the second normal scheduler 221 is substantially the same as the processing of the first normal scheduler 121 shown in FIG. 6 . There are three differences: First, the target in steps S302 and S306 is the second application list 225 instead of the first application list 125; Second, in step S304, adjustment is made with the first calculation unit 1 instead of the second calculation unit 2; and Third, in steps S304 and S305, registration is made with the second execution schedule 224 instead of the first execution schedule 124.

[0034] 7 is a flowchart showing the processing of the first result comparison unit 11. For example, immediately after the end of each time slot of the first execution schedule 124, the first result comparison unit 11 is executed for each calculation result in the time slot that was previously completed. For example, in the example of the first execution schedule 1241-1 shown in the upper part of FIG. 5, VM1 and VM3 were executed in time slot L0. Therefore, immediately after time slot L0, the first result comparison unit 11 is executed individually for VM1 and VM3 in time slot L0.

[0035] First, in step S311, the first result comparison unit 11 determines whether the target application was executed redundantly. This determination can be made, for example, from the name of the executed application and the first request table 126. If the first result comparison unit 11 determines that the target application was executed redundantly, the process proceeds to step S312. If the first result comparison unit 11 determines that the target application was not executed redundantly, the process ends as shown in FIG. 7. For example, the first result comparison unit 11 executed for VM1 proceeds to step S312, and the first result comparison unit 11 executed for VM3 ends the process shown in FIG. 7.

[0036] In step S312, the first result comparison unit 11 obtains the calculation result of the target application in its own calculation unit, i.e., the first calculation unit 1. In the following step S313, the first result comparison unit 11 obtains the calculation result of the same target application in the other calculation unit, i.e., the second calculation unit 2. In the following step S314, the first result comparison unit 11 determines whether the calculation results of its own calculation unit and the other calculation unit are the same. In other words, it determines whether the calculation results of the applications executed by the first calculation unit 1 and the second calculation unit 2 are the same. If the first result comparison unit 11 determines that the calculation results are the same, it ends the processing shown in FIG. 7 , but if it determines that the calculation results are not the same, it proceeds to step S315.

[0037] In step S315, the first result comparison unit 11 operates the first self-fault determination unit 18 to determine a self-fault. In the following step S316, the first result comparison unit 11 determines whether or not a self-fault has occurred. If the first result comparison unit 11 determines that a self-fault has occurred, the process proceeds to step S317, and if it determines that no self-fault has occurred, the process shown in FIG. 7 ends. In step S317, the first result comparison unit 11 notifies the other unit of its own fault and ends the process shown in FIG. 7. Specifically, the first result comparison unit 11 notifies the second calculation unit 2 that there is a fault in the first calculation unit 1.

[0038] The processing of the second result comparison unit 21 is substantially the same as the processing of the first result comparison unit 11 shown in FIG. 7. There are three differences: First, the targets of the self calculation unit and the other calculation unit are reversed in steps S312 and S313; Second, the second self fault determination unit 28 is operated in step S315; and Third, the destination to which the fault is notified in step S317 is the first calculation unit 1.

[0039] 8 is a flowchart showing the processing of the first other-terminal failure determination unit 13. First, in step S321, the first other-terminal failure determination unit 13 checks communication with the other power supply IC. Specifically, the first other-terminal failure determination unit 13 communicates with the second power supply IC 321 using the second communication line 43 connecting the first calculation unit 1 and the second power supply IC 321. In the following step S322, the first other-terminal failure determination unit 13 determines whether communication with the other power supply IC was successful. If the first other-terminal failure determination unit 13 determines that communication with the second communication line 43 was successful, the first other-terminal failure determination unit 13 proceeds to step S323, and if it determines that communication with the second communication line 43 was not successful, the first other-terminal failure determination unit 13 proceeds to step S325.

[0040] In step S323, first other-party fault judgment unit 13 determines whether or not a self-fault has been notified from the other party, i.e., whether or not a notification corresponding to step S117 in Fig. 7 has been received from second calculation unit 2. If first other-party fault judgment unit 13 determines that a self-fault has been notified from second calculation unit 2, it proceeds to step S325, and if it determines that a self-fault has not been notified from second calculation unit 2, it proceeds to step S324. In step S324, first other-party fault judgment unit 13 determines that second calculation unit 2 is normal and ends the processing shown in figure *. In step S325, first other-party fault judgment unit 13 determines that second calculation unit 2 has failed and ends the processing shown in figure *.

[0041] The processing of the second other-terminal failure determination unit 23 is substantially the same as the processing of the first other-terminal failure determination unit 13 shown in FIG. 8 . There are three differences: First, the target in steps S321 and S322 is the first power supply IC 311 instead of the second power supply IC 321; Second, in step S323, it is determined whether or not a notification of an internal failure has been received from the first calculation unit 1; and Third, in steps S324 and S325, it is the first calculation unit 1 instead of the second calculation unit 2 that is determined to be normal or abnormal.

[0042] FIG. 9 is a flowchart showing the processing of the first degeneration determination unit 122. First, in step S331, the first degeneration determination unit 122 refers to the processing result of the first other-side fault determination unit 13 and determines whether the second calculation unit 2 is normal. If the first degeneration determination unit 122 determines that the second calculation unit 2 is normal, the processing shown in FIG. 9 ends. If the first degeneration determination unit 122 determines that the second control unit 2 is abnormal, the processing proceeds to step S332. In step S332, the first degeneration determination unit 122 shifts the first calculation unit 1 to degeneration control and terminates the processing shown in FIG. 9. As described above, when shifting to degeneration control, the first degeneration schedule unit 123 creates the first execution schedule 124 instead of the first normal schedule unit 121.

[0043] The processing of the second degeneration determination unit 222 is substantially the same as the processing of the first degeneration determination unit 122 shown in Fig. 9. There are two differences: the first is that the processing result of the second other-side fault determination unit 23 is referenced in step S331; and the second is that the second calculation unit 2 is the target to be shifted to degeneration control in step S332.

[0044] 10 is a flowchart showing the processing of the first degenerate scheduler 123. The same processing as that of the first normal scheduler 121 shown in FIG. * is assigned the same step number, and a description thereof will be omitted. First, in step S341, the first degenerate scheduler 123 integrates the first application list 125 and the second application list 225 to create an integrated application list. In the following step S301, the variable i is initialized to "1." In the following step S302A, the first degenerate scheduler 123 reads the i-th application in the integrated application list created in step S341.

[0045] In step S304A, which is executed when a positive determination is made in step S303, the first degenerate scheduler 123 registers the application read in step S302A in the first execution schedule 124 so that the application is executed redundantly within the first calculation unit 1. In this case, a schedule is created so that the first main core 16 and the first sub-core 17 execute the application redundantly within the first calculation unit 1. The process of step S305 is the same as that of the first normal scheduler 121. In step S306A, the first degenerate scheduler 123 determines whether the integrated application list has been read to the end. If the first degenerate scheduler 123 determines that the integrated application list has been read to the end, the process shown in FIG. 10 ends. If the first degenerate scheduler 123 determines that the integrated application list has not been read to the end, the process proceeds to step S307.

[0046] The processing of the second degenerate scheduler 223 is substantially the same as the processing of the first degenerate scheduler 123 shown in Fig. 10. The differences are the following points marked with *. The first point is that in step S304A, registration is performed so that redundant execution is performed inside the second calculation unit 2. The second point is that the registration target in steps S304A and S305 is the second execution schedule 224, not the first execution schedule 124.

[0047] The first embodiment described above provides the following advantageous effects. (1) The ECU 9, which is a vehicle control device, is supplied with power from a first battery 31, which is a first power supply system, and includes a first calculation unit 1 having a first hypervisor 14, which is a first execution environment in which applications can be executed, and a second calculation unit 2 having a second hypervisor 24, which is a second execution environment in which applications can be executed, and is supplied with power from a second power supply system. The first calculation unit 1 includes a first application control unit 12 that controls execution of applications in the first hypervisor 14. The second calculation unit 2 includes a second application control unit 22 that controls execution of applications in the second hypervisor 24. The first application control unit 12 and the second application control unit 22 cause the first hypervisor 14 and the second hypervisor 24 to simultaneously execute specific applications, which are applications that satisfy predetermined conditions. In this way, the first calculation unit 1 and the second calculation unit 2, which are connected to different batteries, are provided within the ECU 9, thereby redundantly executing applications. Therefore, a single ECU 9 can ensure power supply redundancy while also ensuring execution redundancy for a specific application.

[0048] (2) The first application control unit 12 includes a first normal scheduler 121 that determines the functional safety level required by an application and creates a first execution schedule 124 so that applications whose functional safety levels are higher than a predetermined threshold are executed simultaneously as specific applications. The second application control unit 22 includes a second normal scheduler 221 that determines the functional safety level required by an application and creates a second execution schedule 224 so that applications whose functional safety levels are higher than the predetermined threshold are executed simultaneously as specific applications. The first application control unit 12 executes the application in the first hypervisor 14 based on the first execution schedule 124. The second application control unit 22 executes the application in the second hypervisor 24 based on the second execution schedule 224.

[0049] (3) The first calculation unit 1 includes a first other-side fault determination unit 13 that detects an abnormality in the second calculation unit 2, and a first degeneration scheduler 123 that causes the first calculation unit 1 to execute degeneration control when the first other-side fault determination unit 13 detects an abnormality in the second calculation unit 2. The second calculation unit 2 includes a second other-side fault determination unit 23 that detects an abnormality in the first calculation unit 1, and a second degeneration scheduler 223 that causes the second calculation unit 2 to execute degeneration control when the second other-side fault determination unit 23 detects an abnormality in the first calculation unit 1. Therefore, when an abnormality occurs in one of the first calculation unit 1 or the second calculation unit 2, the other performs degeneration control.

[0050] (4) The first calculation unit 1 includes a first own failure judgment unit 18 that detects a failure of the first calculation unit 1 and transmits the failure to the second calculation unit 2. The second calculation unit 2 includes a second own failure judgment unit 28 that detects a failure of the second calculation unit 2 and transmits the failure to the first calculation unit 1. When the first other-side failure judgment unit 13 receives a failure of the second calculation unit 2 from the second own failure judgment unit 28, it considers that an abnormality in the second calculation unit 2 has been detected. When the first other-side failure judgment unit 23 receives a failure of the first calculation unit 1 from the first own failure judgment unit 18, it considers that an abnormality in the first calculation unit 1 has been detected.

[0051] (5) When the calculation result of the specific application in the first calculation unit 1 differs from the calculation result of the specific application in the second calculation unit 2, the first calculation unit 1 causes the first own fault determination unit 18 to detect a fault in the first calculation unit (S314: NO, S315 in FIG. 7 ). When the calculation result of the specific application in the first calculation unit 1 differs from the calculation result of the specific application in the second calculation unit 2, the second calculation unit 2 causes the second own fault determination unit 28 to detect a fault in the second calculation unit 2. This allows the device to detect its own fault at an appropriate time.

[0052] (6) The first other-terminal failure determination unit 13 determines a failure of the second calculation unit 2 based on the communication state with the second power supply IC 321 connected to the second battery 32. The second other-terminal failure determination unit 23 determines a failure of the first calculation unit 1 based on the communication state with the first power supply IC 311 connected to the first battery 31. Therefore, a failure can be determined based on the communication state.

[0053] (7) The first calculation unit 1 receives power from a first power supply IC 311 connected to the first battery 31. The second calculation unit 2 receives power from a second power supply IC 321 connected to the second battery 32. The ECU 9 includes a first communication line 42 connecting the first power supply IC 311 and the second calculation unit 2, and a second communication line 43 connecting the second power supply IC 321 and the first calculation unit 1. The second other-side fault determination unit 23 determines that an abnormality has occurred in the first battery 31 when a predetermined response is not received from the first power supply IC 311 via the first communication line 42. The first other-side fault determination unit 13 determines that an abnormality has occurred in the second battery 32 when a predetermined response is not received from the second power supply IC 321 via the second communication line 43. Therefore, a failure in the other calculation unit can be determined based on the absence of a response from the power supply IC.

[0054] (8) The first calculation unit 1 includes a first main core 16 and a first sub-core 17 that can independently execute calculations. The second calculation unit 2 includes a second main core 26 and a second sub-core 27 that can independently execute calculations. The degeneration control in the first calculation unit 1 means that the first main core 16 and the first sub-core 17 execute a specific application simultaneously in the first calculation unit 1. The degeneration control in the second calculation unit 2 means that the second main core 26 and the second sub-core 27 execute a specific application simultaneously in the second calculation unit 2. Therefore, if an abnormality occurs in one of the first calculation unit 1 and the second calculation unit 2, the other executes the specific application redundantly within the calculation unit. In other words, by providing the first calculation unit 1 and the second calculation unit 2 connected to different batteries inside the ECU 9 and performing redundant execution according to the functional safety level, it is possible to ensure power supply redundancy and execution redundancy required for functional safety with a single ECU 9. This has the effect of ensuring reliability during so-called minimum risk maneuver operations, such as driving to a safe area or stopping the vehicle when one battery system fails. In addition, because control calculations are being executed before a failure occurs, there is the effect of eliminating real-time issues such as switching or launching applications when transitioning to degenerate control.

[0055] (Variation 1) In the above-described embodiment, one calculation unit, which is an SoC, is connected to each battery. However, multiple SoCs may be connected to one battery, or the number of connected SoCs may vary.

[0056] FIG. 11 is a diagram showing the configuration of an ECU 9A in Modification 1. The ECU 9A differs from the embodiment in that it includes a third calculation unit 3. For convenience of illustration, detailed configurations of the first calculation unit 1 and the second calculation unit 2 are omitted in FIG. 11. Also, the second communication line 43 and the first in-vehicle communication unit 44 are present, as in the embodiment. The configuration unique to this modification will be described below.

[0057] The third calculation unit 3 includes a third main core 36 and a third sub-core 37 that perform calculations, and a third self-failure determination unit 38. The third self-failure determination unit 38 operates independently of the third main core 36 and the third sub-core 37 and detects a failure of the third calculation unit 3. The third main core 36 and the third sub-core 37 implement an OS 35, a hypervisor 34, a third result comparison unit 11-2, a third application control unit 12-2, and a third other-side failure determination unit 33 by loading a program stored in a ROM (not shown) into a RAM (not shown) and executing the program. The OS 35 is an operating system, and the hypervisor 34, the third result comparison unit 11-2, the third application control unit 12-2, and the first other-side failure determination unit 13 are executed on the OS 35. The first other-side failure determination unit 13 operates on the second calculation unit 2 and is therefore common to the first calculation unit 1 and the third calculation unit 3.

[0058] The ECU 9A further includes a second inter-control arithmetic unit communication unit 41-2, a third communication line 43T, and a third in-vehicle communication unit 44T. The second inter-control arithmetic unit communication unit 41-2 is a communication path connecting the third arithmetic unit 3 and the second arithmetic unit 2. The third communication line 43T is a communication path connecting the third arithmetic unit 3 and the second power supply IC 321. The third in-vehicle communication unit 44T is supplied with power from the first battery 31 and is a communication path through which the third arithmetic unit 3 communicates with other control devices in the vehicle.

[0059] When the third calculation unit 3 does not detect an abnormality in the second calculation unit 2, it redundantly executes applications with a requirement level of 6 or higher together with the second calculation unit 2. When the third calculation unit 3 detects an abnormality in the second calculation unit 2, it redundantly executes applications with a requirement level of 6 or higher inside the third calculation unit 3 using the third main core 36 and the third sub-core 37.

[0060] According to this variant example 1, in a configuration in which the calculation processing of apps is concentrated in one ECU 9A, even if the processing performance of the calculation unit is required to be very high, by using multiple SoCs and providing redundancy between different batteries, it is possible to achieve both reliability and calculation performance.

[0061] (Variation 2) In the above-described embodiment, the first self-failure determination unit 18 is activated when the first result comparison unit 11 satisfies a predetermined condition (YES in S314 of FIG. 7 ). However, the first self-failure determination unit 18 may be activated based on other conditions. For example, the first self-failure determination unit 18 may be activated at predetermined time intervals. The second result comparison unit 21 may also be activated at predetermined time intervals, similar to the first result comparison unit 11.

[0062] In the above-described embodiments and modifications, the functional block configurations are merely examples. Some functional configurations shown as separate functional blocks may be integrated, or a configuration shown in a single functional block diagram may be divided into two or more functions. Furthermore, some of the functions of each functional block may be provided by other functional blocks.

[0063] (Variation 3) In the above-described embodiment, the application execution environment is a hypervisor, and the application is considered to be equivalent to a virtual machine. However, a different configuration may be used. For example, the application execution environment may be a Docker, and the application may be considered to be equivalent to a Docker container. Furthermore, the application execution environment may be a function call function, and the application may be considered to be equivalent to a function.

[0064] In the above-described embodiments and modifications, the program is stored in a ROM (not shown), but the program may be stored in a non-volatile memory (not shown). Furthermore, the ECU 9 may have an input / output interface (not shown), and the program may be loaded from another device via the input / output interface and a medium available to the ECU 9 when necessary. Here, the medium refers to, for example, a storage medium detachable from the input / output interface, or a communication medium, i.e., a wired, wireless, or optical network, or a carrier wave or digital signal propagating through the network. Furthermore, some or all of the functions realized by the program may be realized by a hardware circuit or an FPGA.

[0065] The above-described embodiments and modifications may be combined with each other. Although various embodiments and modifications have been described above, the present invention is not limited to these. Other embodiments conceivable within the scope of the technical concept of the present invention are also included within the scope of the present invention.

[0066] 1: First calculation unit 2: Second calculation unit 9, 9A: ECU 11: First result comparison unit 12: First application control unit 13: First other-side failure determination unit 14: First hypervisor 16: First main core 17: First sub-core 18: First self-failure determination unit 21: Second result comparison unit 22: Second application control unit 23: Second other-side failure determination unit 24: Second hypervisor 26: Second main core 27: Second sub-core 28: Second self-failure determination unit 31: First battery 32: Second battery 121: First normal schedule unit 122: First degeneration determination unit 123: First degeneration schedule unit 124: First execution schedule 126: First request table 221: Second normal schedule unit 222: Second degeneration determination unit 223: Second degeneration schedule unit 224: Second execution schedule 226: Second request table 311: First power supply IC 321: Second power supply IC

Claims

1. A vehicle control device comprising: a first calculation unit which is supplied with power from a first power supply system and has a first environment which is a first execution environment in which an application can be executed; and a second calculation unit which is supplied with power from a second power supply system and has a second environment which is a second execution environment in which an application can be executed, wherein the first calculation unit comprises a first application control unit which controls execution of an application in the first environment; the second calculation unit comprises a second application control unit which controls execution of an application in the second environment; and the first application control unit and the second application control unit cause a specific application which satisfies a predetermined condition to be executed in the first environment and the second environment at the same time.

2. A vehicle control device as described in claim 1, wherein the first application control unit includes a first normal schedule unit that determines a functional safety level required by an application and creates a first execution schedule so that applications whose functional safety levels are higher than a predetermined threshold are executed as the specific application at the same time; the second application control unit includes a second normal schedule unit that determines the functional safety level required by an application and creates a second execution schedule so that applications whose functional safety levels are higher than a predetermined threshold are executed as the specific application at the same time; the first application control unit executes an application in the first environment based on the first execution schedule; and the second application control unit executes an application in the second environment based on the second execution schedule.

3. A vehicle control device as described in claim 1, wherein the first calculation unit comprises: a first other-side fault judgment unit that detects an abnormality in the second calculation unit; and a first degenerate control unit that executes degenerate control in the first calculation unit when the first other-side fault judgment unit detects an abnormality in the second calculation unit; and the second calculation unit comprises: a second other-side fault judgment unit that detects an abnormality in the first calculation unit; and a second degenerate control unit that executes degenerate control in the second calculation unit when the second other-side fault judgment unit detects an abnormality in the first calculation unit.

4. A vehicle control device as described in claim 3, wherein the first calculation unit further includes a first self-failure judgment unit that detects a failure of the first calculation unit and transmits it to the second calculation unit, the second calculation unit further includes a second self-failure judgment unit that detects a failure of the second calculation unit and transmits it to the first calculation unit, the first other-failure judgment unit assumes that an abnormality has been detected in the second calculation unit when a failure of the second calculation unit is transmitted from the second self-failure judgment unit, and the second other-failure judgment unit assumes that an abnormality has been detected in the first calculation unit when a failure of the first calculation unit is transmitted from the first self-failure judgment unit.

5. A vehicle control device as described in claim 4, wherein the first calculation unit causes the first self-fault judgment unit to detect a fault in the first calculation unit when the calculation result of the specific application in the first calculation unit differs from the calculation result of the specific application in the second calculation unit, and the second calculation unit causes the second self-fault judgment unit to detect a fault in the second calculation unit when the calculation result of the specific application in the first calculation unit differs from the calculation result of the specific application in the second calculation unit.

6. A vehicle control device as described in claim 3, wherein the first other-side fault judgment unit judges a fault in the second calculation unit based on the state of the second power supply system, and the second other-side fault judgment unit judges a fault in the first calculation unit based on the state of the first power supply system.

7. A vehicle control device as described in claim 6, wherein the first calculation unit is supplied with power from a first power supply IC connected to the first power supply system, and the second calculation unit is supplied with power from a second power supply IC connected to the second power supply system, and further comprising a first communication line connecting the first power supply IC and the second calculation unit, and a second communication line connecting the second power supply IC and the first calculation unit, wherein the second other-side fault judgment unit judges that there is an abnormality in the first power supply system when a predetermined response is not obtained from the first power supply IC via the first communication line, and the first other-side fault judgment unit judges that there is an abnormality in the second power supply system when a predetermined response is not obtained from the second power supply IC via the second communication line.

8. A vehicle control device as described in claim 3, wherein the first calculation unit includes a first main core and a first sub-core capable of independently executing calculations, the second calculation unit includes a second main core and a second sub-core capable of independently executing calculations, the degeneracy control in the first calculation unit means that the specific application is executed at the first main core and the first sub-core at the same time in the first calculation unit, and the degeneracy control in the second calculation unit means that the specific application is executed at the second main core and the second sub-core at the same time in the second calculation unit.

9. A vehicle control device as described in claim 1, further comprising a third calculation unit that is supplied with power from the first power supply system and has a third environment, which is a third execution environment in which an application can be executed, the third calculation unit comprising a third application control unit that controls execution of the application in the third environment, and the third application control unit and the second application control unit execute the specific application in the third environment and the second environment at the same time.

10. A control method executed by a vehicle control device including a first calculation unit that is supplied with power from a first power supply system and has a first environment, which is a first execution environment in which an application can be executed, and a second calculation unit that is supplied with power from a second power supply system and has a second environment, which is a second execution environment in which an application can be executed, wherein the first calculation unit includes a first application control unit that controls execution of an application in the first environment, the second calculation unit includes a second application control unit that controls execution of an application in the second environment, and the first application control unit and the second application control unit cause a specific application, which is an application that satisfies a predetermined condition, to be executed in the first environment and the second environment at the same time.

Images