Operation control device, operation control program, and electronic control device

Abstract

A first processing unit (21) executes switching processing for switching an operating machine that is in operation among a plurality of virtual machines. A second processing unit (22) executes prohibition processing for prohibiting execution of the switching processing and permission processing for permitting execution of the switching processing. The operating machine transmits a prohibition request when starting a specific processing and transmits a permission request when the specific processing is completed. When having received the prohibition request, the second processing unit executes determination processing for determining whether or not the remaining time is equal to or longer than a predetermined set time. As a result of the determination processing, the second processing unit executes the prohibition processing when the remaining time is equal to or longer than the set time, and does not execute the prohibition processing when the remaining time is less than the set time. The second processing unit executes the permission processing when the permission request is received. The operating machine executes the specific processing during a prohibition period in which the prohibition processing is executed.

Description

Motion control device, motion control program, and electronic control device CROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This application is based on Japanese Application No. 2023-200713, filed on November 28, 2023, the contents of which are incorporated herein by reference.

[0002] The present disclosure relates to an operation control device that controls the operation of multiple virtual machines in a time-sharing manner for each operating period of a predetermined operating time, an operation control program to be executed by the operation control device, and an electronic control device equipped with the operation control device.

[0003] For example, a vehicle such as an automobile is equipped with multiple electronic control units (ECUs), which communicate with each other and cooperate to perform various processes. In this specification, the electronic control unit (ECU) may be abbreviated as "ECU." In recent years, the number of ECUs installed in vehicles has tended to increase, leading to the implementation of a method of integrating multiple ECUs into a single ECU. In such an integrated ECU, the functions of multiple ECUs that previously operated independently are installed as multiple virtual machines on a single microcomputer via a hypervisor. In this specification, the microcomputer (MCU) may be abbreviated as "microcomputer."

[0004] In conventional ECUs, the resources of one microcomputer could be monopolized by the functions of one ECU, but in an integrated ECU, the resources of one microcomputer are used by multiple virtual machines. Therefore, the integrated ECU uses time-sharing scheduling, which allocates fixed operating times to multiple virtual machines. With time-sharing scheduling, each of the multiple virtual machines operates independently within a pre-assigned operating time, eliminating the need for cooperative resource allocation between the virtual machines.

[0005] In the above configuration, when a specific virtual machine is running, a switching process is executed to switch the running virtual machine when its operating time is consumed. In other words, in the above configuration, the switching process may be executed regardless of whether the running process has completed. Therefore, in the above configuration, the switching process may be executed during the execution of processes that must be executed continuously, i.e., processes that cannot be interrupted or atomic processes, resulting in the interruption of the processes that cannot be interrupted.

[0006] Examples of prior art related to this problem include the technologies disclosed in Patent Documents 1 and 2. Patent Document 1 discloses a method of dividing tasks into several groups and adaptively time-sharing the processing times of the groups. Patent Document 2 discloses a method of detecting and disabling an interrupt task that occurs during an uninterruptible process, thereby ensuring uninterruptible processing, by executing the interrupt task after the uninterruptible process is completed.

[0007] U.S. Patent No. 9,361,156 JP 2002-157132 A

[0008] However, the conventional technology disclosed in Patent Document 1 does not take into consideration uninterruptible processes, and the conventional technology disclosed in Patent Document 2 does not take into consideration the possibility that an interrupt task may not be executed because a process that is known in advance to cause an interrupt, such as a switching process for switching between running virtual machines, and an uninterruptible process is not completed. For these reasons, it has been difficult for the above conventional technologies to solve the above-mentioned problems.

[0009] An object of the present disclosure is to provide an operation control device, an operation control program, and an electronic control device that can prevent processes that must be executed continuously from being interrupted by a switching process.

[0010] In one aspect of the present disclosure, an operation control device controls a plurality of virtual machines to operate in a time-sharing manner for each operating period, with each virtual machine operating for a predetermined operating time. In this case, one of the plurality of virtual machines currently in operation is referred to as an operating machine. The operation control device includes a first processing unit capable of executing a switching process to switch between the operating machines, and a second processing unit capable of executing a prohibition process to prohibit execution of the switching process and an permission process to permit execution of the switching process. The operating machine is configured to transmit a prohibition request when starting a specific process that must be executed continuously, i.e., an uninterruptible process or an atomic process, and to transmit a permission request when completing the specific process.

[0011] When the second processing unit receives the prohibition request, it executes a determination process to determine whether the remaining time, which is the time from that point until the time when the operation time has elapsed, is equal to or greater than a predetermined set time. If the result of the determination process shows that the remaining time is equal to or greater than the set time, the second processing unit executes the prohibition process, and if the remaining time is less than the set time, it does not execute the prohibition process. Furthermore, when the second processing unit receives the permission request, it executes the permission process. The operating machine executes the specific process during a prohibition period, which is a period during which the prohibition process is being executed.

[0012] According to the above configuration, a switching process for switching the operating machine while the operating machine is executing a specific process is prevented from occurring. This ensures consistent operation until the specific process is completed. Furthermore, according to the above configuration, when the second processing unit executes a determination process to determine that the remaining time is less than the set time, in other words, when it is highly unlikely that the specific process to be started can be completed before the operation time has elapsed, the prohibition process is not executed, and accordingly, the specific process is not executed. This allows a specific process that is unlikely to be completed in a given operation cycle to be executed in the next operation cycle. Thus, according to the above configuration, it is possible to obtain the excellent effect of preventing a specific process, which must be executed continuously, from being interrupted by a switching process.

[0013] The above and other objects, features and advantages of the present disclosure will become more apparent from the following detailed description taken in conjunction with the accompanying drawings. 1 is a diagram schematically illustrating the configuration of an integrated ECU and an ECU according to the first embodiment; FIG. 2 is a timing chart illustrating the operation of each part in a first comparative operation example according to a comparative example; FIG. 3 is a timing chart illustrating the operation of each part in a second comparative operation example according to a comparative example; FIG. 4 is a timing chart illustrating the operation of each part in a first operation example according to the first embodiment; FIG. 5 is a timing chart illustrating the operation of each part in a second operation example according to the first embodiment; 16 is a timing chart showing the operation of each unit in the fifth comparative operation example according to the comparative example; FIG. 17 is a timing chart showing the operation of each unit in the eleventh operation example according to the first embodiment; FIG. 18 is a diagram showing a specific example of allocation of the overall margin time according to the first embodiment; FIG. 19 is a diagram showing an example of the specific content of each process executed when a prohibition request according to the first embodiment is received; FIG. 20 is a diagram showing an example of the specific content of each process executed during the prohibition period according to the first embodiment;22 is a diagram showing an example of the specific content of each process executed when an operation time according to a modified example ends, FIG. 23 is a timing chart showing the operation content of each unit in a twelfth operation example according to the second embodiment, FIG. 24 is a timing chart showing the operation content of each unit in a thirteenth operation example according to the second embodiment, FIG. 25 is a timing chart showing the operation content of each unit in a fourteenth operation example according to the second embodiment, and FIG. 26 is a timing chart showing the operation content of each unit in a fifteenth operation example according to the third embodiment.

[0014] Hereinafter, several embodiments will be described with reference to the drawings. Note that substantially the same components in each embodiment will be denoted by the same reference numerals and the description thereof will be omitted. (First Embodiment) Hereinafter, the first embodiment will be described with reference to FIGS. 1 to 22.

[0015] As shown in FIG. 1 , the integrated ECU 1 of this embodiment is mounted on a vehicle such as an automobile, and the functions of multiple ECUs that previously operated independently are mounted on the chip of a single microcomputer 3 via a hypervisor 2. Specific examples of the multiple ECUs include an engine ECU, an air conditioning ECU, a central gateway ECU, and a body ECU. In this case, the functions of the multiple ECUs are mounted in units called virtual machines. Note that in this specification, the hypervisor may be abbreviated as HV, and the virtual machine may be abbreviated as VM.

[0016] The integrated ECU 1 has functions equivalent to two ECUs, ECU-A and ECU-B. The integrated ECU 1 may have functions equivalent to three or more ECUs. The ECU 4 is not integrated into the integrated ECU 1, but is provided independently like a conventional ECU. The integrated ECU 1 and the ECU 4 are connected via a bus communication line 5, which enables communication between them.

[0017] The ECU 4 includes a microcomputer 6. The microcomputer 6 includes hardware such as a CPU, various storage devices, and various peripherals (not shown). The various peripherals include communication hardware 7 for performing communications. In this specification, hardware may be abbreviated as HW. The ECU 4 includes an ECU-0 application A0 for implementing its main functions. In this specification, application may be abbreviated as app. In the following description and drawings, the ECU-0 app A0 may be abbreviated as app A0.

[0018] The ECU 4 includes a communication driver 8. The communication driver 8 controls the communication HW 7 to perform data communication with other ECUs including the integrated ECU 1 via the bus communication line 5. Both the application A0 and the communication driver 8 are realized by the CPU of the microcomputer 6 executing a computer program stored in a non-transient physical storage medium to perform processing corresponding to the computer program, that is, they are realized by software.

[0019] The integrated ECU 1 includes two VMs, VM 10 and VM 11. In this case, the functions of ECU-A are realized by VM 10, and the functions of ECU-B are realized by VM 11. VM 10 includes an ECU-A application A1 for realizing the main functions of ECU-A. VM 11 includes an ECU-B app A2 for realizing the main functions of ECU-B. In the following description and drawings, the ECU-A app A1 and the ECU-B app A2 may be abbreviated as app A1 and app A2, respectively.

[0020] The HV2 is used to run the VM10 and VM11 on the microcomputer 3. The microcomputer 3 is an example of a computer, and its hardware includes a CPU, various storage devices, and various peripherals (not shown). The various peripherals include a communication HW 12 for communication. The various storage devices include a register 13. The register 13 is a register to be protected, that is, a register for which write protection settings can be made. The VM10 includes a communication driver 14. The VM11 includes a communication driver 15. The communication drivers 14 and 15 control the communication HW 12 to perform data communication with other ECUs, including the ECU 4, via the bus communication line 5.

[0021] In this case, the HV2 functions as an operation control device that controls the operation of each of the multiple VMs 10 and 11 in a time-sharing manner for a predetermined operation time for each operation cycle. In other words, the integrated ECU 1 controls the multiple VMs 10 and 11 using time-sharing scheduling that allocates fixed operation times to the multiple VMs 10 and 11. In this case, the integrated ECU 1 is an example of an electronic control device that includes a microcomputer 3, multiple VMs 10 and 11 that operate on the microcomputer 3, and the HV2 that functions as an operation control device. Note that, in this specification, the multiple VMs 10 and 11 that are currently operating may be referred to as operating machines.

[0022] The HV2, VM10, and VM11 are all realized by the CPU of the microcomputer 3 executing computer programs stored in a non-transient physical storage medium to perform processing corresponding to the computer programs, that is, by software. Of the computer programs described above, the program executed by the HV2 corresponds to an operation control program.

[0023] The HV 2 has two functional blocks, a first processing unit 21 and a second processing unit 22. The first processing unit 21 can execute a switching process to switch between operating machines. Each process executed by the first processing unit 21 corresponds to a first process. The second processing unit 22 can execute a prohibition process to prohibit the execution of the switching process and an permission process to permit the execution of the switching process. Each process executed by the second processing unit 22 corresponds to a second process.

[0024] In this case, the operating machine is configured to send a prohibition request when starting a specific process that must be executed sequentially, i.e., a non-interruptible or atomic process, and to send a permission request when completing the specific process. In this specification, "processes that must be executed sequentially" includes not only processes that will not be successful and will fail if not executed sequentially, but also processes that will not produce the processing results desired by the user if not executed sequentially, i.e., processes for which it is desirable to execute them sequentially.

[0025] When the second processing unit 22 receives a prohibition request, it executes a judgment process to determine whether the remaining time, which is the time from that point until the time when the operation time has elapsed, is equal to or greater than a predetermined set time. If the result of the judgment process shows that the remaining time is equal to or greater than the set time, the second processing unit 22 executes the prohibition process, and if the remaining time is less than the set time, it does not execute the prohibition process. When the second processing unit 22 receives a permission request, it executes the permission process. The operating machine executes a specific process during the prohibition period, which is the period during which the prohibition process is being executed.

[0026] The first processing unit 21 is configured to extend the operating time by a predetermined margin time during the prohibited period. When the first processing unit 21 performs the extension, the second processing unit 22 executes a determination process using the time from the time the prohibition request is received until the time the extended operating time has elapsed as the remaining time. In this embodiment, an available time that can be used as margin time is set for each operating cycle. The first processing unit 21 extends the operating time by consuming the required margin time from the available time. In other words, the margin time is allocated and used from the available time.

[0027] If there is any remaining available time when the operation of the last operating machine in an operation cycle is started, the first processing unit 21 can allocate at least a portion of the remaining time to the operation time of the last operating machine.If the specific process has not been completed when the operation time has elapsed during the prohibited period, the first processing unit 21 can determine that an abnormality has occurred and execute one or both of a switching process and a notification process for notifying the outside of the abnormality.If the specific process has not been completed when the operation time has elapsed during the prohibited period, the first processing unit 21 can determine that an abnormality has occurred and execute a notification process for notifying the outside of the abnormality when it receives a permission request in the next or subsequent operation cycle.

[0028] If the prohibition process is not executed after the operation machine transmits the prohibition request, the first processing unit 21 can cause the operation machine to repeatedly transmit the prohibition request until the prohibition process is executed. If the prohibition process is not executed after the operation machine transmits the prohibition request, the first processing unit 21 can place the operation machine in a standby state or place the operation machine in a state where it can execute a process different from the specific process for a period until the switching process is executed. If the prohibition process is not executed after the operation machine transmits the prohibition request, the first processing unit 21 can execute the switching process before the operation time allocated to the operation machine has elapsed.

[0029] The set time can be set by the following first setting method or second setting method. In the first setting method, the set time is set in advance for each of multiple virtual machines. In this case, the set time can be set based on the time required for a specific process that the virtual machine to be set is likely to execute. If there is only one specific process that the virtual machine is likely to execute, the set time can be set to a time corresponding to the time required for that specific process. Note that the time corresponding to the time required for the specific process includes not only the same time as the time required for the specific process, but also a time that includes a predetermined margin added to that time.

[0030] Furthermore, if there are multiple specific processes that the virtual machine may execute, the set time can be set to the time corresponding to the longest time required for each of the multiple specific processes. Note that the longest time required for each of the multiple specific processes does not only include the same time as the longest time required for each of the multiple specific processes, but also includes a time with a predetermined margin added to that time.

[0031] In the second technique, when the second processing unit 22 receives a prohibition request, it sets the set time based on the time required for the specific process to be started by the operating machine that sent the prohibition request. The set time can be set to a time corresponding to the time required for the specific process to be started by the operating machine that sent the prohibition request. Note that the time corresponding to the time required for the specific process includes not only the same time as the time required for the specific process, but also a time with a predetermined margin added to that time.

[0032] Next, the operation of the above configuration will be described with reference to Figures 2 to 21. In the following description, each term may be expressed in different terms as follows: Specific process → Task Start of switching process → VM switching Operation cycle → HV cycle Available time → Overall margin time

[0033] 2 to 17, the period when the operating machine is VM10 is represented as "VM10," the period when the operating machine is VM11 is represented as "VM11," the period when the first processing unit 21 is executing a switching process is represented as "HV," the period when the operating machine is executing a task is represented as "Task," the period when the microcomputer 3 is transitioning to a mode that reduces power consumption is represented as "Halt," and the period when a prohibited process is being executed is represented as "disable."

[0034] In the following description, in order to compare with the present embodiment, in addition to describing an example of operation according to the present embodiment, a comparative example of operation that is an example of operation according to a comparative example corresponding to the prior art will also be described. Note that the comparative example does not include the second processing unit 22 as compared to the present embodiment, and also omits processes related to the processes executed by the second processing unit 22.

[0035] [1-1] First Comparative Operation Example The first comparative operation example shown in FIG. 2 assumes that the VM 10 starts executing a task during its operating time and completes the task without interruption within the operating time. In this case, the VM 10 starts executing the task when a predetermined time has elapsed since the VM 10 was switched to the operating machine. In this case, the task executed by the VM 10 is completed before the end of the operating time. Thereafter, when the operating time allocated to the VM 10 has elapsed, the first processing unit 21 performs switching processing.

[0036] [1-2] Second Comparative Operation Example The second comparative operation example shown in Figure 3 assumes a case in which VM10 starts executing a task during its operating time and is unable to complete the task within the operating time. In this case, VM10 starts executing the task when a predetermined time has elapsed since it was switched to the operating machine. In this case, the task executed by VM10 is not completed even when the operating time allocated to VM10 has elapsed, but the task is interrupted because the first processing unit 21 performs switching processing at this time.

[0037] The interrupted task is resumed in the next HV cycle. That is, in the next HV cycle, VM10 resumes task execution from the point at which it is switched to the operating machine. In this case, the task executed by VM10 is completed when a predetermined time has elapsed since VM10 was switched to the operating machine. As described above, in the comparative example, if VM switching occurs during task execution, the task is interrupted, and it is conceivable that the expected function will not operate. In contrast, in this embodiment, such a problem is solved by introducing a function that prevents VM switching from occurring during task execution.

[0038] [2-1] First Operation Example The first operation example shown in Fig. 4 assumes that the VM 10 starts executing a task during its operation and completes the task without interruption. In this case, the VM 10 transmits a prohibition request to the HV 2 when a predetermined time has elapsed since the VM 10 was switched to the operating machine. Upon receiving the prohibition request from the VM 10, the HV 2 executes a determination process.

[0039] In this case, the remaining time plus 50 μs, which is the unused time of the total margin time, is assumed to be longer than the set time. In this case, HV2 executes the prohibition process upon receiving the prohibition request. In response to the start of the prohibition process, VM10, which is the operating machine, begins executing a task. In this case, the task will not be completed when the initial operating time allocated to VM10 has elapsed. Therefore, the first processing unit 21 extends the operating time until the task being executed by VM10 is completed. In this case, the operating time is extended by consuming 20 μs from the total margin time.

[0040] According to this first operation example, the VM 10 can continuously complete a task, which is an uninterruptible process, by extending its operation time by 20 μs. The VM 10 transmits a permission request when the task is completed. Upon receiving the permission request, the HV 2 ends the prohibition process and executes the permission process. This causes the first processing unit 21 to execute the switching process. In this way, even if the operation time is extended, real-time performance can be ensured by immediately switching VMs after the task is completed.

[0041] [2-2] Second Operation Example The second operation example shown in FIG. 5 assumes that VM10 and VM11 start executing a task during their operation time and are able to complete the task without interruption. In this case, the operation of VM10 during its operation time is the same as in the first operation example. In this case, VM11 sends a prohibition request to HV2 when a predetermined time has elapsed since VM11 was switched to the operating machine. Upon receiving the prohibition request sent from VM11, HV2 executes a determination process.

[0042] In this case, the remaining time plus 30 μs, which is the unused time of the total margin time, is assumed to be longer than the set time. In this case, the HV2 executes the prohibition process upon receiving the prohibition request. In response to the start of the prohibition process, the VM11, which is the operating machine, begins executing a task. In this case, the task will not be completed when the initial operating time allocated to the VM11 has elapsed.

[0043] Therefore, the first processing unit 21 extends the operation time until the task being executed by the VM 11 is completed. In this case, the operation time is extended by 10 μs from the total margin time. According to this second operation example, the VM 11 can continuously complete the task, which is an uninterruptible process, by extending its operation time by 10 μs. The VM 11 sends a permission request when it completes the task. Upon receiving the permission request, the HV 2 ends the prohibition process and executes the permission process. As a result, the first processing unit 21 executes the switching process.

[0044] In this way, even if the operation time is extended, real-time performance can be ensured by immediately switching VMs after the task is completed. As can be seen from the second operation example, according to the configuration of this embodiment, as long as there is unused time in the overall margin time, the margin time can be allocated in proportion to the amount requested by multiple VMs. By setting the margin time over the entire HV cycle as in this embodiment, the margin time requested by each VM can be adaptively distributed.

[0045] [2-3] Third Operation Example The third operation example shown in FIG. 6 assumes a case where the VM 10 starts executing a task during its operation and does not complete the task. In this case, the VM 10 transmits a prohibition request to the HV 2 a predetermined time after the VM 10 is switched to the operating machine. Upon receiving the prohibition request from the VM 10, the HV 2 executes a determination process.

[0046] In this case, the remaining time plus 50 μs, which is the unused time of the total margin time, is assumed to be longer than the set time. In this case, the HV2 executes the prohibition process upon receiving the prohibition request. In response to the start of the prohibition process, the VM10, which is the operating machine, begins executing a task. In this case, the task will not be completed when the initial operating time allocated to the VM10 has elapsed. Therefore, the first processing unit 21 extends the operating time until the task being executed by the VM10 is completed.

[0047] However, in this case, it is assumed that due to some reason such as an abnormality or a malfunction, the task is not completed even if the entire margin time, i.e., 50 μs, is consumed and the operation time is extended. In this case, the first processing unit 21 determines that an abnormality has occurred and executes a notification process. In the notification process, a fixation error is issued indicating that it has been detected that the prohibited period in which VM switching is prohibited has become fixed. In addition, at this time, the first processing unit 21 executes the switching process while VM switching remains prohibited.

[0048] In this case, VM11 transmits a prohibition request to HV2 when a predetermined time has elapsed since VM11 was switched to the operating machine. Upon receiving the prohibition request from VM11, HV2 executes a determination process. In this case, it is assumed that the remaining time is shorter than the set time because VM10 has used up the entire overall margin time. Therefore, HV2 does not execute the prohibition process, and as a result, VM11 cannot start executing a task in this HV cycle.

[0049] In this way, if the prohibition process is not executed after the VM11, which is the operating machine, sends a prohibition request, the first processing unit 21 puts the VM11, which is the operating machine, in a standby state until the switching process is executed. In this case, the first processing unit 21 can also put the VM11, which is the operating machine, in a state where it can execute a process other than the task until the switching process is executed. Thereafter, when the operating time allocated to the VM11 has elapsed, the first processing unit 21 performs the switching process.

[0050] In the next HV cycle, VM10 resumes task execution from the point at which it is switched to the operating machine. In this case, the task executed by VM10 is completed when a predetermined time has elapsed since VM10 was switched to the operating machine. VM10 transmits a permission request upon completing the task. Upon receiving the permission request, HV2 terminates the prohibition process and executes the permission process. At this time, HV2 also performs a notification process, which issues a fixation error. In this way, the integrated ECU 1 can make decisions such as restarting the VM or suspending the process.

[0051] Thereafter, when the operating time allocated to VM10 has elapsed, the first processing unit 21 performs switching processing. When VM11 is switched to the operating machine, it sends a prohibition request to HV2. When HV2 receives the prohibition request sent from VM11, it performs judgment processing. In this case, it is assumed that the remaining time plus 50 μs, which is the unused time of the total margin time, is longer than the set time. In this case, HV2 performs prohibition processing when it receives the prohibition request. When the prohibition processing starts, VM11, which is the operating machine, starts executing the task.

[0052] In this case, the task executed by VM11 is completed when a predetermined time has elapsed since VM11 was switched to the operating machine. VM11 transmits a permission request when the task is completed. Upon receiving the permission request, HV2 terminates the prohibition process and executes the permission process. Thereafter, when the operating time allocated to VM11 has elapsed, the first processing unit 21 performs the switching process. As can be seen from the third operation example, according to the configuration of this embodiment, by operating VMs with higher priorities in order from the beginning of the HV cycle, it is possible to preferentially allocate margin time to VMs with higher priorities.

[0053] [2-4] Fourth Operation Example The fourth operation example shown in Fig. 7 differs from the third operation example in the following respects. That is, in the fourth operation example, if the prohibition process is not executed after the VM11, which is the operating machine, sends a prohibition request, the first processing unit 21 causes the VM11, which is the operating machine, to repeatedly send a prohibition request until the prohibition process is executed. Note that in Fig. 7, the repeatedly sent prohibition requests are represented by simple arrows.

[0054] [2-5] Fifth Operation Example The fifth operation example shown in FIG. 8 differs from the third operation example in the operation related to VM11. That is, in the fifth operation example, VM11 transmits a prohibition request to HV2 when a predetermined time has elapsed since VM11 was switched to the operating machine. Upon receiving the prohibition request transmitted from VM11, HV2 executes a determination process. In this case, since VM10 has used all of the total margin time, the operation time of VM11 cannot be extended, but the remaining time from that point until the time when the operation time without extension elapses is shorter than the set time.

[0055] In this case, the HV2 executes the prohibition process upon receiving the prohibition request. In response to the start of the prohibition process, the VM11, which is the operating machine, starts executing a task. In this case, the task executed by the VM11 is completed upon the passage of a predetermined time from the start of the prohibition process. The VM11 transmits a permission request upon completion of the task. Upon receiving the permission request, the HV2 ends the prohibition process and executes the permission process. Thereafter, upon the passage of the operating time allocated to the VM11, the first processing unit 21 executes the switching process.

[0056] As can be seen from the fifth operation example, according to the configuration of this embodiment, all of the total margin time is used, and even if there is no margin time, the prohibition processing is performed if there is enough time to complete the task, and as a result, tasks can be completed continuously during that operation time.

[0057] [2-6] Sixth Operation Example The sixth operation example shown in FIG. 9 assumes that the VM 10 starts executing a task during its operation time and completes the task without extending the operation time or interrupting it. In this case, the VM 10 transmits a prohibition request to the HV 2 when a predetermined time has elapsed since the VM 10 was switched to the operating machine. Upon receiving the prohibition request from the VM 10, the HV 2 executes a determination process.

[0058] In this case, the remaining time plus 50 μsec, which is the unused time of the total margin time, is assumed to be longer than the set time. In this case, the HV2 executes the prohibition process at the time when the prohibition request is received. In response to the start of the prohibition process, the VM10, which is the operating machine, starts executing a task. In this case, the task executed by the VM10 is completed when a predetermined time has elapsed since the prohibition process was started. The VM10 sends a permission request upon completing the task. The HV2 ends the prohibition process and executes the permission process at the time when the permission request is received. Thereafter, the first processing unit 21 executes the switching process when the operating time allocated to the VM10 has elapsed.

[0059] [2-7] Seventh Operation Example The seventh operation example shown in FIG. 10 assumes a case where the VM10 attempts to start executing a task during its operating time, but is unable to execute the task during the operating time in that HV cycle and instead executes the task during the operating time in the next HV cycle. In this case, the VM10 transmits a prohibition request to the HV2 when a predetermined time has elapsed since the VM10 was switched to the operating machine. Upon receiving the prohibition request from the VM10, the HV2 executes a determination process.

[0060] In this case, the remaining time plus 50 μs, which is the unused time of the total margin time, is assumed to be shorter than the set time. Therefore, HV2 does not execute the prohibition process, and as a result, VM10 cannot start executing the task in this HV cycle. Then, in the next HV cycle, VM10 sends a prohibition request to HV2 when it is switched to the operating machine. Upon receiving the prohibition request sent from VM10, HV2 executes a determination process. In this case, the remaining time plus 50 μs, which is the unused time of the total margin time, is assumed to be longer than the set time.

[0061] In this case, the HV2 executes the prohibition process upon receiving the prohibition request. In response to the start of the prohibition process, the VM10, which is the operating machine, starts executing a task. In this case, the task executed by the VM10 is completed upon the elapse of a predetermined time from the time the VM10 is switched to the operating machine. The VM10 transmits a permission request upon completing the task. Upon receiving the permission request, the HV2 terminates the prohibition process and executes the permission process. Thereafter, upon the elapse of the operating time allocated to the VM10, the first processing unit 21 executes the switching process.

[0062] As can be seen from the seventh operation example, according to the configuration of this embodiment, when a prohibition request prohibition is sent from the operating machine to the HV, if the HV2 determines that the remaining time is less than the set time, it does not execute the prohibition process, so that tasks that are unlikely to be completed during the operation time of the current HV cycle can be executed during the operation time of the next HV cycle. Thus, according to the configuration of this embodiment, since the time until VM switching is known in advance, real-time performance can be ensured without needlessly extending the operation time or affecting other VMs.

[0063] [2-8] Eighth Operation Example The eighth operation example shown in FIG. 11 assumes a case where there is a surplus in the overall margin time when the last operating machine in the HV cycle starts operating. In this case, since neither VM10 nor VM11 executed a task, the overall margin time is not consumed when VM11 starts operating, and 50 μs remains. The first processing unit 21 allocates at least a portion of this surplus in the overall margin time to the operating time of VM11, the last operating machine. This makes it possible to effectively utilize the resources of the microcomputer 3 and eliminate time when no processing is performed.

[0064] [2-9] Ninth Operation Example The ninth operation example shown in Fig. 12 differs from the seventh operation example in the following respects. Note that, for comparison of the operation examples, the upper part of Fig. 12 also includes a diagram similar to Fig. 10 used in explaining the seventh operation example. That is, as shown in the lower part of Fig. 12, in the ninth operation example, if the prohibition process is not executed after the VM10, which is the operating machine, sends a prohibition request, the first processing unit 21 executes the switching process before the operation time allocated to the VM10, which is the operating machine, has elapsed.

[0065] According to the ninth operation example, if the prohibition process is not executed after the VM10, which is the operating machine, sends a prohibition request, the remaining operating time allocated to the VM10 is shared with another VM 11. In this way, if there is no other process that can be executed in the VM10, time is not wasted in the VM10, and the corresponding time can be allocated as operating time for the other VM 11, thereby enabling the resources of the microcomputer 3 to be used effectively.

[0066] [1-3] Third Comparative Operation Example The third comparative operation example shown in FIG. 13 differs from the second comparative operation example in that the content of the tasks is specified. In this case, the communication between the integrated ECU 1 and the ECU 4 is divided into multiple parts, and all communication data must be transmitted or received from the VM 10 to the ECU 4 within a predetermined time, for example, 100 μs. The VM 10 performs the above-mentioned communication as a task. The communication performed by the VM 10 is divided into two parts.

[0067] In this case, the VM 10 transmits or receives communication data for the first time to the ECU 4 when a predetermined time has elapsed since the VM 10 was switched to the operating machine. Thereafter, the operating time allocated to the VM 10 expires before the VM 10 transmits or receives communication data for the ECU 4 for the second time, and the first processing unit 21 performs switching processing. In other words, the communication processing is interrupted at this point. Then, in the next HV cycle, the VM 10 transmits or receives communication data for the second time to the ECU 4 when the VM 10 is switched to the operating machine.

[0068] In this way, in the third comparative operation example, VM switching occurs after the first transmission or reception of communication data, and the second transmission or reception of communication data is performed in the next HV cycle, so all communication data is not transmitted or received within 100 μs. However, in this case, since the communication processing of the VM 10 is completed normally, the VM 10 does not retransmit or rereceive the communication data, and there is a risk that communication between the integrated ECU 1 and the ECU 4 will remain unsuccessful.

[0069] [2-10] Tenth Operation Example The tenth operation example shown in FIG. 14 differs from the first operation example in that the task content is specified. The specific task content is the same as that of the third comparative operation example. In this case, the VM10 transmits a prohibition request to the HV2 when a predetermined time has elapsed since the VM10 was switched to the operating machine. Upon receiving the prohibition request transmitted from the VM10, the HV2 executes a determination process.

[0070] In this case, the remaining time plus 50 μs, which is the unused time of the total margin time, is assumed to be longer than the set time. In this case, the HV2 executes the prohibition process upon receiving the prohibition request. In response to the start of the prohibition process, the VM10, which is the operating machine, executes the first transmission or reception of communication data to the ECU4. In this case, as in the third comparative operation example, the initial operating time allocated to the VM10 ends before the VM10 executes the second transmission or reception of communication data to the ECU4. However, in this case, the first processing unit 21 extends the operating time until the task being executed by the VM10 is completed.

[0071] Therefore, in the HV cycle, the VM 10 can transmit or receive communication data to or from the ECU 4 for the first time, and then immediately transmit or receive communication data to or from the ECU 4 for the second time. Thus, according to the tenth operation example, all communication data can be transmitted or received within 100 μs. In other words, according to the tenth operation example, communication processing can be completed continuously without being interrupted by VM switching.

[0072] 15 assumes that the specific content of the task is write control to the register 13. The write control to the register 13 includes three processes: "protection release" for releasing the protection setting of the register 13, "write" for writing to the register 13, and "protection reset" for resetting the protection setting of the register 13.

[0073] In this case, the VM 10 starts write control when a predetermined time has elapsed since the VM 10 was switched to the operating machine. That is, the VM 10 first performs protection release processing and then starts write processing. Thereafter, the operating time allocated to the VM 10 ends before the VM 10 completes the write processing, so the first processing unit 21 performs switching processing. That is, in this case, VM switching occurs during the write processing, which causes the write control to be interrupted.

[0074] At this time, the protection setting of register 13 remains released. Therefore, there is a possibility that VM 11, which is subsequently switched to the operating machine, will write to register 13, and if so, the contents of register 13 will be rewritten by the other VM 11. Thereafter, in the next HV cycle, VM 10 will resume the write process at the time when it is switched to the operating machine. However, because the contents of register 13 were rewritten by VM 11 in the previous HV cycle, there is a risk that an error will occur in the setting of register 13.

[0075] [1-5] Fifth Comparative Operation Example The fifth comparative operation example shown in FIG. 16 differs from the fourth comparative operation example in the timing at which VM switching occurs. That is, in the fifth comparative operation example, the operation time allocated to VM 10 ends after the protection release process is executed and before the write process starts, so the switching process is performed by the first processing unit 21. That is, in this case, VM switching occurs after the protection release process is executed, which causes the write control to be interrupted.

[0076] There is a possibility that the VM 11 that is subsequently switched to the operating machine will control writing to the register 13, which will result in another VM 11 resetting protection to the register 13. After that, in the next HV cycle, the VM 10 attempts to start a write process when it is switched to the operating machine, but is unable to perform writing because the register 13 is set to be protected. As a result, the write control of the register 13 by the VM 10 cannot be completed normally.

[0077] [2-11] Eleventh Operation Example The eleventh operation example shown in FIG. 17 assumes, as in the fourth and fifth comparative operation examples, write control of the register 13 as the specific content of the task. In this case, the VM 10 transmits a prohibition request to the HV 2 when a predetermined time has elapsed since the VM 10 was switched to the operating machine. Upon receiving the prohibition request transmitted from the VM 10, the HV 2 executes a determination process. In this case, it is assumed that the remaining time plus 50 μs, which is the unused time of the total margin time, is longer than the set time. In this case, the HV 2 executes the prohibition process upon receiving the prohibition request.

[0078] When the prohibition process starts, the VM10, which is the operating machine, starts write control. That is, the VM10 first performs protection release processing and then starts write processing. After that, the initial operating time allocated to the VM10 ends before the VM10 completes the write processing. In this case, however, the first processing unit 21 extends the operating time until the task being executed by the VM10 is completed.

[0079] Therefore, the VM 10 can continuously execute all processes in the write control in the HV cycle. As described above, according to the configuration of this embodiment, the problems that occur in the fourth and fifth comparison operation examples do not occur, and a series of processes in the write control can be completed normally. Note that, in the eleventh operation example as well, if the determination process results in the time obtained by adding the margin time to the remaining time being shorter than the set time, the write control will be executed in the operation time of the next HV cycle, as in the seventh operation example.

[0080] [3] Allocation of Total Margin Time As shown in Fig. 18, various cases are possible for how the total margin time set for each HV cycle is allocated to and consumed by each of VM10 and VM11. In Case 1, 30 µsec is consumed as margin time in VM10, and the remaining 20 µsec is unused and remains. In Case 2, 30 µsec is consumed as margin time in VM10, and 20 µsec is consumed as margin time in VM11. In other words, Case 2 is a case in which the total margin time is shared between VM10 and VM11, and no remainder of the total margin time occurs.

[0081] In case 3, 20 μsec is consumed as margin time in VM10 and 25 μsec is consumed as margin time in VM11. That is, in case 2, VM10 and VM11 share the total margin time and there is a remainder of 5 μsec in the total margin time. In case 4, 40 μsec is consumed as margin time in VM10 and the remaining 10 μsec is unused and remains as a remainder.

[0082] In case 5, 50 μsec is consumed as margin time in VM10, leaving no remainder in the overall margin time. In case 6, 50 μsec is consumed as margin time in VM11, leaving no remainder in the overall margin time. In case 7, no margin time is consumed in either VM10 or VM11, leaving the entire 50 μsec remainder of the overall margin time. The number of such cases regarding allocation of the overall margin time increases according to the number of VMs installed in the integrated ECU 1.

[0083] [4-1] Specific Contents of Each Process Executed When a Prohibition Request is Received Specifically, each process executed when the HV2 receives a prohibition request can be as shown in Fig. 19. The second processing unit 22 executes the process as shown in Fig. 19 each time a prohibition request is received. In step S101, it is determined whether or not a time T1, which is the time from when the prohibition request is received until the end of the operating time plus an available margin time, is equal to or greater than a set time T2.

[0084] Here, if time T1 is equal to or greater than time T2, step S101 determines "YES" and the process proceeds to step S102. In step S102, prohibition processing is executed. After step S102 is executed, the process ends. On the other hand, if time T1 is less than time T2, step S101 determines "NO", the prohibition processing of step S102 is not executed, and the process ends. According to such processing, the time until VM switching is known in advance, and real-time performance can be ensured without needlessly extending the operation time or affecting other VMs.

[0085] [4-2] Specific Contents of Each Process Executed During the Prohibition Period Specifically, each process executed by the first processing unit 21 of the HV 2 during the prohibition period can be as shown in Fig. 20. The first processing unit 21 executes the process as shown in Fig. 20 at predetermined intervals during the prohibition period. In step S201, it is determined whether the time T3, which is the margin time consumed during the prohibition period, is equal to or greater than the set margin time T4.

[0086] Here, if time T3 is equal to or greater than time T4, step S201 determines "YES" and the process proceeds to step S202. In step S202, a sticking error is issued and notified. Step S202 corresponds to the notification process. After step S202 is executed, the process proceeds to step S203, where a sticking error flag is set. After step S203 is executed, the process proceeds to step S204, where a switching process is performed. After step S204 is executed, the process ends. On the other hand, if time T3 is less than time T4, step S201 determines "NO", and the process ends without executing steps S202 to S204, i.e., without executing the notification process, switching process, and the like.

[0087] According to this process, when the consumed margin time becomes equal to the set margin time, a sticking error is issued and a sticking error flag is set, and then VM switching is performed, thereby ensuring real-time performance for the entire HV 2. Furthermore, according to the above process, issuing a sticking error can be used as a basis for determining whether to cause the VM to execute processing again or to restart the VM.

[0088] Note that the first processing unit 21 can perform each process according to a modified example shown in Fig. 21 instead of each process according to this embodiment shown in Fig. 20. Each process according to the modified example shown in Fig. 21 is executed when the operation time obtained by adding a set margin time to the initial operation time allocated to the VM, i.e., the operation time including the margin, ends, and differs from each process according to this embodiment shown in Fig. 20 in that step S211 is provided instead of step S201. In step S211, it is determined whether or not the state is a prohibited state in which execution of the switching process is prohibited.

[0089] If the VM is in a prohibited state, the result of step S211 is "YES" and the process proceeds to step S202. On the other hand, if the VM is not in a prohibited state, the result of step S211 is "NO" and the process proceeds to step S204, where the switching process is performed and the process ends. According to this modified example, if the VM is in a prohibited state in which the execution of the switching process is prohibited when the operation time including the set margin time has elapsed, a sticking error flag is set, that is, it is determined that the VM is stuck.

[0090] [4-3] Specific Contents of Each Process Executed When a Permission Request is Received Specifically, each process executed when the HV 2 receives a permission request can be as shown in FIG. 22. The second processing unit 22 executes the process as shown in FIG. 22 each time a permission request is received. In step S301, it is determined whether a sticking error flag is set, in other words, whether the sticking error flag is set. In FIG. 22, the fact that the sticking error flag is set is referred to as the error flag being "on." Here, if the sticking error flag is set, "YES" is determined in step S301, and the process proceeds to step S302. In step S302, a sticking error is issued and notified.

[0091] Step S302 corresponds to the notification process. After step S302 is executed, the process proceeds to step S303, where the permission process is executed. After step S303 is executed, this process ends. On the other hand, if the sticking error flag is not set, step S301 becomes "NO," and the process of step S302, i.e., the notification process, is not executed, and the process proceeds to step S303, where the permission process is executed. According to this process, by issuing a sticking error even when the permission process is executed, it is possible to clearly indicate that the execution of the specific process has ended after the prohibition period has stuck.

[0092] According to the present embodiment described above, the following effects can be obtained. The HV 2 included in the integrated ECU 1 of this embodiment controls the operation of the multiple VMs 10 and 11 in a time-sharing manner for pre-allocated operation times for each HV cycle, and includes a first processing unit 21 that can execute a switching process to switch between operating machines, and a second processing unit 22 that can execute a prohibition process to prohibit the execution of the switching process and an authorization process to authorize the execution of the switching process. The VMs 10 and 11 are configured to transmit a prohibition request when starting a specific process and transmit an authorization request when completing the specific process.

[0093] When the second processing unit 22 receives a prohibition request, it executes a determination process to determine whether the remaining time, which is the time from that point until the time when the operation time has elapsed, is equal to or greater than a predetermined set time, and as a result, if the remaining time is equal to or greater than the set time, it executes the prohibition process, but if the remaining time is less than the set time, it does not execute the prohibition process.Furthermore, when the second processing unit 22 receives a permission request, it executes the permission process.The operating machine executes a specific process during the prohibition period, which is the period during which the prohibition process is being executed.

[0094] According to the above configuration, a switching process that switches the operating machine while the operating machine is executing a specific process is prevented from occurring. This ensures consistent operation until the specific process is completed. Furthermore, according to the above configuration, when the second processing unit 22 executes a determination process to determine that the remaining time is less than the set time, in other words, when it is highly unlikely that the specific process to be started can be completed before the operation time has elapsed, the prohibition process is not executed, and accordingly, the specific process is not executed. This allows a specific process that is unlikely to be completed in the current HV cycle to be executed in the next HV cycle. Thus, the configuration of this embodiment provides the excellent effect of preventing a specific process, which must be executed continuously, from being interrupted by a switching process.

[0095] In this embodiment, during the prohibited period in which the execution of the switching process is prohibited, the originally set operating time can be extended by a margin time, and the execution of the specific process by the operating machine continues until the extended operating time has elapsed. In this way, the specific process can be more reliably completed continuously without interruption. Furthermore, in this embodiment, if the specific process is not completed before the extended operating time has elapsed, a notification process and a switching process are performed.

[0096] In this way, the operation time is not extended beyond the set margin time, and a situation in which only a specific VM operates for an unnecessarily long time is prevented, and adverse effects such as a reduction in the operation time of other VMs are prevented, thereby ensuring real-time performance. Furthermore, according to this embodiment, a notification process is performed to notify a sticking error, so that an operating machine that has not completed a specific process can be restarted or the specific process can be re-executed.

[0097] In this embodiment, a total margin time is set for each HV cycle, and the first processing unit 21 extends the operating time by consuming the required margin time from the total margin time. This allows the margin time to be set for the entire HV2, making the setting simple. This also makes it possible to adaptively distribute the margin time required by each VM within the HV cycle. Furthermore, this also makes it possible to prioritize the margin time given to VMs with relatively high priorities by running VMs with higher priorities in order from the beginning of the HV cycle.

[0098] If there is a surplus in the overall margin time when the last operating machine in the HV cycle starts operating, the first processing unit 21 allocates at least a portion of the surplus to the operating time of the last operating machine. This eliminates wasted margin time. If the specific process has not been completed when the operation time has elapsed during the prohibited period, the first processing unit 21 determines that an abnormality has occurred and executes a switching process and a notification process to notify the outside of the abnormality. This prevents the prohibited process from affecting the operation time of other VMs when the specific process is not completed normally, ensuring real-time performance and enabling decisions such as restarting VMs and suspending the specific process to be made.

[0099] If the specific process has not been completed when the operation time has elapsed during the prohibited period, the first processing unit 21 determines that an abnormality has occurred, and executes a notification process to notify the outside of the abnormality when a permission request is received in the next or subsequent HV cycle. In this way, by notifying the user through the notification process that the VM is continuing to operate while the prohibited period is stuck, it is possible to make a decision to restart the VM or to interrupt the specific process.

[0100] The set time can be set in advance for each of the multiple VMs 10 and 11. In this way, the operation time of each VM can be managed uniformly. Alternatively, when the second processing unit 22 receives a prohibition request, the set time can be set based on the time required for the specific process started by the operating machine that sent the prohibition request. In this way, when the specific process cannot be completed successfully for some reason, the extension of the operation time can be minimized, thereby ensuring real-time performance.

[0101] If the prohibition process is not executed after the operating machine sends a prohibition request, the first processing unit 21 can cause the operating machine to repeatedly send a prohibition request until the prohibition process is executed. In this way, the processing can be completed by the VM alone without requesting time from the HV2 until the VM switching. If the prohibition process is not executed after the operating machine sends a prohibition request, the first processing unit 21 can put the operating machine into a standby state until the switching process is executed. In this way, it is possible to reduce power consumption by transitioning the microcomputer 3 to a sleep state or the like.

[0102] If the prohibition process is not executed after the operating machine sends a prohibition request, the first processing unit 21 can make the operating machine in a state in which it can execute a process other than the specific process for a period until the switching process is executed. In this way, it is possible to execute other processes during the time until the VM switching, thereby enabling effective use of the resources of the microcomputer 3. If the prohibition process is not executed after the operating machine sends a prohibition request, the first processing unit 21 can execute the switching process before the operating time allocated to the operating machine has elapsed. In this way, if there is no process executable in the operating machine other than the specific process, it is possible to run another VM, thereby enabling effective use of the resources of the microcomputer 3.

[0103] Second Embodiment A second embodiment will be described below with reference to FIGS. 23 to 25. This embodiment differs from the first embodiment in that the available time is set differently. In this embodiment, an available time is set for each of the multiple VMs 10 and 11. The first processing unit 21 then extends the operating time by consuming the required margin time from the available time corresponding to the operating machine. In other words, the margin time is allocated and used from the available time corresponding to the operating machine.

[0104] Next, the operation of the above configuration will be described. In the following description, the available time may be referred to as the per-VM margin time. In this case, the per-VM margin time is set to 20 μs for both VM10 and VM11.

[0105] [2-12] Twelfth Operation Example The twelfth operation example shown in FIG. 23 assumes that the VM10 starts executing a task during its operation and completes the task without interruption. In this case, the VM10 transmits a prohibition request to the HV2 when a predetermined time has elapsed since the VM10 was switched to the operating machine. Upon receiving the prohibition request from the VM10, the HV2 executes a determination process.

[0106] In this case, it is assumed that the time obtained by adding 20 μs, which is the per-VM margin time corresponding to VM10, to the remaining time is longer than the set time. In this case, HV2 executes the prohibition process at the time when the prohibition request is received. In response to the start of the prohibition process, VM10, which is the operating machine, starts executing a task. In this case, the task will not be completed when the initial operation time allocated to VM10 has elapsed. Therefore, the first processing unit 21 extends the operation time until the task being executed by VM10 is completed. In this case, the operation time is extended by consuming the entire 20 μs, which is the per-VM margin time.

[0107] According to this twelfth operation example, the VM 10 can extend its operation time up to the per-VM margin time, allowing the task, which is an uninterruptible process, to be completed continuously. The VM 10 transmits a permission request when the task is completed. Upon receiving the permission request, the HV 2 ends the prohibition process and executes the permission process. This causes the first processing unit 21 to execute the switching process. In this way, even if the operation time is extended, real-time performance can be ensured by immediately switching VMs after the task is completed.

[0108] [2-13] Thirteenth Operation Example The thirteenth operation example shown in FIG. 24 assumes that VM10 and VM11 start executing a task during their operation time and are able to complete the task without interruption. In this case, the operation of VM10 during its operation time is the same as that of the twelfth operation example. In this case, VM11 sends a prohibition request to HV2 when a predetermined time has elapsed since VM11 was switched to the operating machine. Upon receiving the prohibition request sent from VM11, HV2 executes a determination process.

[0109] In this case, the remaining time plus 20 μs, which is the per-VM margin time for VM11, is assumed to be longer than the set time. In this case, HV2 executes the prohibition process upon receiving the prohibition request. In response to the start of the prohibition process, VM11, which is the operating machine, begins executing a task. In this case, the task will not be completed when the initial operating time allocated to VM11 has elapsed.

[0110] Therefore, the first processing unit 21 extends the operation time until the task being executed by VM11 is completed. In this case, the operation time is extended by consuming 20 μs, which is the entire per-VM margin time. According to this thirteenth operation example, VM11 can extend its operation time up to the per-VM margin time, and can continuously complete the task, which is an uninterruptible process. VM11 sends a permission request when it completes the task. Upon receiving the permission request, HV2 ends the prohibition process and executes the permission process. As a result, the first processing unit 21 executes the switching process.

[0111] In this way, even if the operation time is extended, real-time performance can be ensured by immediately switching VMs after the task is completed. As can be seen from the thirteenth operation example, according to the configuration of this embodiment, a margin time is provided for each VM, so that a VM with a relatively high priority does not monopolize the margin time, and as a result, a margin time of the same extent can be ensured for a VM with a relatively low priority.

[0112] [2-14] Fourteenth Operation Example The fourteenth operation example shown in FIG. 25 is a case where the VM10 starts executing a task during its operation time and does not complete the task. In this case, the VM10 transmits a prohibition request to the HV2 when a predetermined time has elapsed since the VM10 was switched to the operating machine. Upon receiving the prohibition request from the VM10, the HV2 executes a determination process.

[0113] In this case, the remaining time plus 20 μs, which is the per-VM margin time corresponding to VM10, is assumed to be longer than the set time. In this case, HV2 executes the prohibition process at the time when the prohibition request is received. In response to the start of the prohibition process, VM10, which is the operating machine, starts executing a task. In this case, the task will not be completed when the initial operation time assigned to VM10 has elapsed. Therefore, the first processing unit 21 extends the operation time until the task being executed by VM10 is completed.

[0114] However, in this case, it is assumed that due to some reason such as an abnormality or a malfunction, the task is not completed even if the operation time is extended by consuming the entire 20 μs of the per-VM margin time. In this case, the first processing unit 21 determines that an abnormality has occurred and executes a notification process. In the notification process, a fixation error is issued indicating that it has been detected that the prohibited period in which VM switching is prohibited has become fixed. In addition, at this time, the first processing unit 21 executes the switching process while VM switching remains prohibited.

[0115] In this case, VM11 transmits a prohibition request to HV2 when a predetermined time has elapsed since VM11 was switched to the operating machine. When HV2 receives the prohibition request transmitted from VM11, it executes a determination process. In this case, it is assumed that the remaining time plus 20 μs, which is the per-VM margin time corresponding to VM11, is longer than the set time. In this case, HV2 executes the prohibition process when it receives the prohibition request. In conjunction with the start of the prohibition process, VM11, which is the operating machine, starts executing a task.

[0116] In this case, the task will not be completed when the initial operation time allocated to VM11 has elapsed. Therefore, the first processing unit 21 extends the operation time until the task being executed by VM11 is completed. In this case, the operation time is extended by consuming 20 μs, which is the entire per-VM margin time. VM11 sends a permission request when it completes the task. Upon receiving the permission request, HV2 ends the prohibition process and executes the permission process. As a result, the first processing unit 21 executes the switching process.

[0117] In the next HV cycle, the VM10 resumes task execution from the point at which it is switched to the operating machine. In this case, the task executed by the VM10 is completed when a predetermined time has elapsed since the VM10 was switched to the operating machine. The VM10 transmits a permission request upon completing the task. The HV2 terminates the prohibition process and executes the permission process upon receiving the permission request. At this time, the HV2 also performs a notification process, which issues a sticking error. Thereafter, when the operating time allocated to the VM10 has elapsed, the first processing unit 21 performs the switching process.

[0118] According to this 14th operation example, since a per-VM margin time is set for each of the multiple VMs 10 and 11, even if one of VM 10 and VM 11 consumes the per-VM margin time, if the other of VM 10 and VM 11 sends a prohibition request, the operation time can be extended up to the upper limit of the per-VM margin time allocated to that VM, and the prohibition processing can be performed.

[0119] According to the present embodiment described above, a per-VM margin time is set for each of the multiple VMs 10 and 11, and the first processing unit 21 extends the operating time by consuming the required margin time from the per-VM margin time corresponding to the operating machine. In this way, all of the VMs 10 and 11 can use the per-VM margin time of 20 μs as their margin time, regardless of their priority. In other words, according to the present embodiment, a margin time is assigned to each VM, so that a VM with a relatively high priority does not monopolize the margin time, and a VM with a relatively low priority can also secure margin time.

[0120] Third Embodiment A second embodiment will be described below with reference to FIG. 26 . This embodiment is different from the first embodiment in that the processing content of the first processing unit 21 is modified. In this embodiment, the first processing unit 21 does not extend the operation time during the prohibited period. In other words, in this embodiment, no margin time, such as an overall margin time or a per-VM margin time, is set.

[0121] Next, the operation of the above configuration will be described. [2-15] Fifteenth Operation Example The fifteenth operation example shown in FIG. 26 assumes a case where the VM10 starts executing a task in the middle of its operation time and the task is not completed. In this case, the VM10 transmits a prohibition request to the HV2 when a predetermined time has elapsed since the VM10 was switched to the operating machine. Upon receiving the prohibition request transmitted from the VM10, the HV2 executes a determination process.

[0122] In this case, it is assumed that the remaining time is longer than the set time. Therefore, the HV2 executes the prohibition process at the time when the prohibition request is received. In response to the start of the prohibition process, the VM10, which is the operating machine, starts executing a task. In this case, it is assumed that the task has not been completed even when the operating time allocated to the VM10 has elapsed due to some reason such as an abnormality or a malfunction. In this case, the first processing unit 21 determines that an abnormality has occurred and executes a notification process. In the notification process, a fixation error is issued, indicating that it has been detected that the prohibition period in which VM switching is prohibited has become fixed. Furthermore, at this time, the first processing unit 21 executes the switching process while VM switching remains in this prohibited state.

[0123] In this case, VM11 sends a prohibition request to HV2 when a predetermined time has elapsed since VM11 was switched to the operating machine. When HV2 receives the prohibition request sent from VM11, it executes a determination process. In this case, it is assumed that the remaining time is longer than the set time. In this case, HV2 executes the prohibition process at the time it receives the prohibition request. In conjunction with the start of the prohibition process, VM11, which is the operating machine, starts executing a task. In this case, the task is completed before the operating time allocated to VM11 has elapsed. VM11 sends a permission request when it completes the task. When HV2 receives the permission request, it ends the prohibition process and executes the permission process. As a result, the first processing unit 21 executes the switching process.

[0124] In the next HV cycle, the VM10 resumes task execution from the point at which it is switched to the operating machine. In this case, the task executed by the VM10 is completed when a predetermined time has elapsed since the VM10 was switched to the operating machine. The VM10 transmits a permission request upon completing the task. The HV2 terminates the prohibition process and executes the permission process upon receiving the permission request. At this time, the HV2 also performs a notification process, which issues a sticking error. Thereafter, when the operating time allocated to the VM10 has elapsed, the first processing unit 21 performs the switching process.

[0125] According to the present embodiment described above, no margin time, such as a total margin time or a per-VM margin time, is set. According to this embodiment, more operating time can be allocated to all of the VMs 10 and 11 than in the above-described embodiments in which a margin time is set. In the above-described embodiments, unused time from the set total margin time or per-VM margin time may be wasted. However, this embodiment does not result in such wasted time. Furthermore, according to this embodiment, as in the above-described embodiments, it is possible to detect a stuck prohibition period and to operate a specific process that is unlikely to be completed in the next HV cycle.

[0126] (Other Embodiments) The present disclosure is not limited to the embodiments described above and illustrated in the drawings, and can be modified, combined, or expanded as desired without departing from the spirit of the present disclosure. The numerical values ​​shown in the above embodiments are merely examples, and the present disclosure is not limited to these.

[0127] The present disclosure is not limited to an HV2 that controls each of multiple VMs running on a microcomputer 3 that constitutes an integrated ECU 1 mounted on a vehicle using time-sharing scheduling, but can be applied to general operation control devices that control each of multiple VMs running on a computer to operate in a time-sharing manner for a pre-assigned operating time for each operating cycle.

[0128] Although the present disclosure has been described with reference to the embodiments, it is understood that the present disclosure is not limited to the embodiments or structures. The present disclosure also encompasses various modifications and equivalent modifications. In addition, various combinations and forms, including only one element, more than one element, or less than one element, are also within the scope and spirit of the present disclosure.

[0129] The control unit and the method described herein may be implemented by a special-purpose computer configured by configuring a processor and memory programmed to perform one or more functions embodied in a computer program. Alternatively, the control unit and the method described herein may be implemented by a special-purpose computer configured by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the control unit and the method described herein may be implemented by one or more special-purpose computers configured by combining a processor and memory programmed to perform one or more functions with a processor configured with one or more hardware logic circuits. Furthermore, the computer program may be stored as instructions executed by a computer on a computer-readable non-transitory tangible storage medium.

[0130] In addition to the inventions set forth in the claims, the present disclosure includes the following inventions. [1] An operation control device that controls each of a plurality of virtual machines (10, 11) to operate in a time-sharing manner for an operating time previously allocated to each of the plurality of virtual machines for each operating cycle, the operation control device comprising: a first processing unit (21) that can execute a switching process to switch the operating machine, where an operating one of the plurality of virtual machines is an operating machine; and a second processing unit (22) that can execute a prohibition process to prohibit the execution of the switching process and a permission process to permit the execution of the switching process, wherein the operating machine transmits a prohibition request when starting a specific process that must be executed continuously, and transmits a permission request when completing the specific process, wherein the second processing unit, upon receiving the prohibition request, executes a determination process to determine whether or not a remaining time, which is a time from that point until the time when the operating time has elapsed, is equal to or longer than a predetermined set time, and executes the prohibition process if the result of the determination process is that the remaining time is equal to or longer than the set time, and does not execute the prohibition process if the remaining time is shorter than the set time, and executes the permission process upon receiving the permission request, wherein the operating machine executes the specific process during a prohibition period, which is a period during which the prohibition process is being executed. [2] The operation control device according to [1], wherein the first processing unit is capable of extending the operation time by a predetermined margin time during the prohibition period, and the second processing unit executes the determination process using the time from the time the prohibition request is received until the extended operation time has elapsed as the remaining time. [3] The operation control device according to [2], wherein an available time is set for each operation cycle, and the first processing unit extends the operation time by consuming the required margin time from the available time.[4] The operation control device according to [2], wherein an available time is set for each of the plurality of virtual machines, and the first processing unit is configured to extend the operation time by consuming the required margin time from the available time corresponding to the operation machine. [5] The operation control device according to [3], wherein, if there is a surplus in the available time when the operation of the operation machine that operates last in the operation cycle starts, the first processing unit allocates at least a portion of the surplus to the operation time of the operation machine that operates last. [6] The operation control device according to any one of [1] to [5], wherein, if the specific process has not been completed when the operation time has elapsed during the prohibited period, the first processing unit determines that an abnormality has occurred and executes one or both of the switching process and a notification process that notifies an external device of the abnormality. [7] The operation control device according to any one of [1] to [6], wherein, if the specific process has not been completed when the operation time has elapsed during the prohibited period, the first processing unit determines that an abnormality has occurred and executes a notification process that notifies an external device of the abnormality when the permission request is received in the next or subsequent operation cycle. [8] The operation control device according to any one of [1] to [7], wherein the set time is preset for each of the plurality of virtual machines. [9] The operation control device according to any one of [1] to [7], wherein, when the prohibition request is received, the second processing unit sets the set time based on the time required for the specific process started by the operating machine that sent the prohibition request.

[10] The operation control device according to any one of [1] to [9], wherein, when the prohibition process is not executed after the operating machine has sent the prohibition request, the first processing unit causes the operating machine to repeatedly send the prohibition request until the prohibition process is executed.

[11] The operation control device according to any one of [1] to [9], wherein the first processing unit is configured to, if the prohibition process is not executed after the operation machine has transmitted the prohibition request, place the operation machine in a standby state for a period until the switching process is executed, or place the operation machine in a state capable of executing another process different from the specific process.

[12] The operation control device according to any one of [1] to [9], wherein, if the prohibition process is not executed after the operation machine has transmitted the prohibition request, the first processing unit executes the switching process before the operation time allocated to the operation machine has elapsed.

[13] An operation control program to be executed by an operation control device (2) that controls each of a plurality of virtual machines (VM10, VM11) to operate in a time-sharing manner for an operation time previously assigned to each of the plurality of virtual machines for each operation cycle, the operation control program including: a first process that can execute a switching process to switch the operation machine, where an operating one of the plurality of virtual machines is an operation machine; and a second process that can execute a prohibition process that prohibits the execution of the switching process and a permission process that permits the execution of the switching process, wherein the operation machine transmits a prohibition request when starting a specific operation that must be executed continuously, and transmits a permission request when completing the specific operation, and in the second process, when the prohibition request is received, executes a determination process that determines whether a remaining time, which is a time from the time point at which the prohibition request is received to a time point at which the operation time has elapsed, is equal to or greater than a predetermined set time, and when the result of the determination process is that the remaining time is equal to or greater than the set time, executes the prohibition process, and when the remaining time is less than the set time, does not execute the prohibition process, and when the result of the determination process is that the remaining time is equal to or greater than the set time, executes the permission process, and the operation machine executes the specific operation during a prohibition period, which is a period during which the prohibition process is being executed.

[14] An electronic control device comprising: a computer (3); a plurality of virtual machines (VM10, VM11) operating on the computer; and an operation control device (2) that controls each of the plurality of virtual machines to operate in a time-sharing manner for an operation time previously allocated for each operation cycle, wherein, assuming that an operating one of the plurality of virtual machines is an operating machine, the operation control device comprises: a first processing unit (21) that can execute a switching process to switch the operating machine; and a second processing unit (22) that can execute a prohibition process to prohibit the execution of the switching process and an permission process to permit the execution of the switching process, wherein the operating machine transmits a prohibition request when starting a specific process that is a process that must be executed consecutively, and transmits a permission request when completing the specific process, and when receiving the prohibition request, the second processing unit executes a judgment process to judge whether or not the remaining time, which is the time from the time point when the prohibition request is received until the time point when the operating time has elapsed, is equal to or longer than a predetermined set time, and executes the prohibition process if the remaining time is equal to or longer than the set time as a result of the judgment process, and does not execute the prohibition process if the remaining time is shorter than the set time, an electronic control device configured to execute the permission process when the permission request is received, and the operating machine executes the specific process during a prohibition period during which the prohibition process is being executed.

Claims

1. An operation control device that controls each of a plurality of virtual machines (10, 11) to operate in a time-sharing manner for an operating time previously allocated to each of the plurality of virtual machines for each operating cycle, the operation control device comprising: a first processing unit (21) capable of executing a switching process to switch between the operating machines, where an operating one of the plurality of virtual machines is defined as an operating machine; and a second processing unit (22) capable of executing a prohibition process to prohibit the execution of the switching process and a permission process to permit the execution of the switching process, wherein the operating machine transmits a prohibition request when starting a specific process which is a process that must be executed continuously, and transmits a permission request when the specific process is completed, wherein the second processing unit, when receiving the prohibition request, executes a judgment process to judge whether or not a remaining time, which is the time from that point to the point at which the operating time has elapsed, is equal to or longer than a predetermined set time, and if the result of the judgment process shows that the remaining time is equal to or longer than the set time, executes the prohibition process, and does not execute the prohibition process if the remaining time is less than the set time, and executes the permission process when the permission request is received, wherein the operating machine executes the specific process during a prohibition period during which the prohibition process is being executed.

2. An operation control device as described in claim 1, wherein the first processing unit is capable of extending the operation time by a predetermined margin time during the prohibited period, and the second processing unit executes the judgment process using the time from the time the prohibition request is received to the time when the extended operation time has elapsed as the remaining time.

3. An operation control device as described in claim 2, wherein an available time is set for each operation cycle, and the first processing unit extends the operation time by consuming the required margin time from the available time.

4. An operation control device as described in claim 2, wherein an available time is set for each of the multiple virtual machines, and the first processing unit is configured to extend the operation time by consuming the required margin time from the available time corresponding to the operating machine.

5. An operation control device as described in claim 3, wherein the first processing unit is configured to allocate at least a portion of the remaining available time to the operating time of the operating machine that operates last in the operating cycle when the operating machine that operates last begins operating.

6. An operation control device as described in any one of claims 1 to 5, wherein the first processing unit determines that an abnormality has occurred and executes one or both of the switching process and a notification process for notifying the outside of the abnormality if the specific process has not been completed when the operation time has elapsed during the prohibited period.

7. An operation control device as described in any one of claims 1 to 5, wherein the first processing unit, if the specific processing has not been completed when the operation time has elapsed during the prohibited period, determines that an abnormality has occurred and executes a notification process to notify the outside of the abnormality when it receives the permission request in the next or subsequent operation cycle.

8. An operation control device according to any one of claims 1 to 5, wherein the set time is preset for each of the plurality of virtual machines.

9. An operation control device as described in any one of claims 1 to 5, wherein the second processing unit, when receiving the prohibition request, sets the set time based on the time required for the specific processing started by the operation machine that sent the prohibition request.

10. An operation control device as described in any one of claims 1 to 5, wherein the first processing unit is configured to, if the prohibition process is not executed after the operation machine sends the prohibition request, cause the operation machine to repeatedly send the prohibition request until the prohibition process is executed.

11. An operation control device as described in any one of claims 1 to 5, wherein the first processing unit is configured to, if the prohibition process is not executed after the operation machine sends the prohibition request, place the operation machine in a standby state for a period until the switching process is executed, or place the operation machine in a state capable of executing a process other than the specific process.

12. An operation control device as described in any one of claims 1 to 5, wherein the first processing unit executes the switching process before the operation time assigned to the operation machine has elapsed if the prohibition process is not executed after the operation machine sends the prohibition request.

13. An operation control program to be executed by an operation control device (2) that controls the operation of each of a plurality of virtual machines (VM10, VM11) in a time-sharing manner for an operation time previously assigned to each operation cycle, the operation control program including: a first process for executing a switching process for switching the operation machine, where an operating one of the plurality of virtual machines is an operation machine; and a second process for executing a prohibition process for prohibiting the execution of the switching process and a permission process for permitting the execution of the switching process, the operation machine being configured to transmit a prohibition request when starting a specific process that is a process that must be executed continuously, and to transmit a permission request when completing the specific process, in which, when the prohibition request is received, a judgment process for judging whether or not a remaining time, which is a time from that point to a point at which the operation time has elapsed, is equal to or longer than a predetermined set time, and if the result of the judgment process shows that the remaining time is equal to or longer than the set time, the prohibition process is executed, and if the remaining time is less than the set time, the prohibition process is not executed, and when the permission request is received, the permission process is executed, the operation machine being configured to execute the permission process, 14. An electronic control device comprising: a computer (3); a plurality of virtual machines (VM10, VM11) operating on said computer; and an operation control device (2) for controlling each of said plurality of virtual machines to operate in a time-sharing manner with an operation time previously assigned for each operation cycle, wherein, assuming that one of said plurality of virtual machines currently operating is an operating machine, said operation control device comprises: a first processing unit (21) capable of executing a switching process for switching said operating machine; and a second processing unit (22) capable of executing a prohibition process for prohibiting the execution of said switching process and an authorization process for permitting the execution of said switching process, wherein said operating machine transmits an inhibition request when starting a specific process which is a process that must be executed continuously, and transmits an authorization request when completing said specific process, wherein, when said prohibition request is received, said second processing unit executes a judgment process for judging whether or not the remaining time, which is the time from that point to the point at which said operating time has elapsed, is equal to or greater than a predetermined set time, and, when the result of said judgment process indicates that the remaining time is equal to or greater than the set time, said prohibition process is executed, and when the remaining time is less than the set time, said prohibition process is not executed, an electronic control device configured to execute the permission process when the permission request is received, and the operating machine executes the specific process during a prohibited period during which the prohibited process is being executed.

Images