Vehicle ECU Task Reallocation After Core Failure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing vehicle control systems face challenges in ensuring continuous control processes when a core fails, as they cannot guarantee real-time execution of software migration and are difficult to adapt to software updates.
Innovation Solution
A vehicle control device with a failure detecting unit and execution timing arbitration unit that reallocates tasks to non-failed cores, adjusting execution times to avoid contention and ensure real-time processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If core failure fallback control stops the entire ECU to ensure safety, then safety is improved, but availability deteriorates
Solution Approach 1:
The patent segments the control functions by dividing tasks into different priority levels (first priority for safety-critical functions, second priority for other functions). When a core fails, only the necessary safety-critical tasks are migrated to remaining functional cores, while non-critical tasks may be suspended. This segmentation allows the system to maintain safety without stopping the entire ECU, thus improving availability while preserving safety.
2Productivity
If core allocation information is set in advance associated with operation modes, then availability is improved through mode switching, but adaptability to software updates deteriorates
Solution Approach 1:
The patent makes the core allocation information dynamic rather than static. Instead of fixing core allocations for each operation mode in advance, the system dynamically determines core allocation at runtime based on which cores are functional. The core allocation information is updated whenever a core failure is detected, allowing the system to adapt to both failures and software updates without requiring pre-designed fallback configurations for every scenario.
3Productivity
If tasks are reallocated to non-failed cores without timing arbitration, then availability is improved, but real-time execution guarantee deteriorates
Solution Approach 1:
The patent implements a feedback mechanism through the arbitration unit that monitors task execution timing on the non-failed core. When a task is migrated, the arbitration unit checks whether the non-failed core can execute the task within its required time slot. If timing conflicts are detected, the system adjusts the task schedule or prioritization to ensure real-time constraints are met. This feedback loop guarantees real-time execution while maintaining availability through task migration.
Data Source
AI summary
Provided is a vehicle control device capable of improving safety and availability by determining, in response to a failure of a core, a core to which the software is to be moved, determining whether there is a contention in the timings of execution based on software operations after the software is moved to another core, and making an arbitration when there is a contention. The vehicle control device has a CPU 11 that executes a plurality of tasks in clock-synchronization, the vehicle control device including a failure detecting unit 121 that detects a failure of a core 10 on the CPU 11, and an execution timing arbitration unit 124 that allocates a task having been executed by a failed core 10 to a non-failed core 10. When the task having been executed by the failed core 10 is allocated to the non-failed core 10, the execution timing arbitration unit 124 shifts the execution time slot in a manner making the task being executed by the non-failed core 10 executable, thereby setting time slots in which the plurality of tasks are executable.