Vehicle Control Device Interrupt Segmentation for Timeout Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods fail to detect execution time abnormalities in vehicle control systems, especially when interrupts are disabled, and cannot distinguish between critical sections and abnormal interrupt disables, which hampers system continuity and safety.
Innovation Solution
A vehicle control device that employs a hardware timer and interrupt controller to execute maskable and non-maskable interrupts, allowing real-time detection of abnormalities and appropriate fail-safe processes even during interrupt disablement, by differentiating between necessary and abnormal interrupt disables based on critical section execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a timer interrupt is used to detect execution time abnormality, then timeout detection can be achieved, but abnormality cannot be detected when interrupt is disabled
Solution Approach 1:
The patent segments the interrupt system into two distinct types: maskable interrupts (which can be disabled) and non-maskable interrupts (which cannot be disabled). This segmentation allows the system to use non-maskable interrupts for critical timeout detection, ensuring detection capability even when maskable interrupts are disabled during critical sections. The timer interrupt is configured to trigger a non-maskable interrupt for abnormality detection, while separate maskable interrupts handle other tasks.
Solution Approach 2:
The patent introduces a non-maskable interrupt as an intermediary mechanism that bridges the gap between the need for interrupt-based timeout detection and the requirement to maintain detection capability during interrupt disable periods. The non-maskable interrupt acts as a mediator that cannot be blocked by interrupt disable operations, ensuring continuous monitoring of task execution time even when the system is in a critical section.
2Reliability
If non-maskable interrupts are used to detect abnormalities during interrupt disable, then real-time detection is achieved, but it becomes impossible to distinguish between critical sections and abnormal interrupt disable
Solution Approach 1:
The patent implements a feedback mechanism where the non-maskable interrupt service routine checks the current execution context to determine whether the interrupt disable was intentional (during a critical section) or abnormal (task timeout). The system provides feedback about the nature of the interrupt disable by examining task execution status and timing information, allowing differentiation between legitimate critical section operations and abnormal conditions requiring intervention.
Solution Approach 2:
The patent changes the parameters of the interrupt system by introducing different interrupt types with different characteristics. Non-maskable interrupts are used specifically for timeout detection, while maskable interrupts handle other events. By changing the interrupt parameters (maskability, priority, trigger conditions), the system can distinguish between critical section operations and abnormal conditions based on which type of interrupt is active and the current system state.
3Ease of operation
If maskable interrupt is commanded to execute during interrupt disable time, then the interrupt is blocked, but system responsiveness to critical events is reduced
Solution Approach 1:
The patent applies dynamics by making the interrupt system adaptive and flexible. Maskable interrupts can be dynamically enabled or disabled based on system state and priority. When a non-maskable interrupt occurs during an interrupt disable period, the system dynamically adjusts by allowing the non-maskable interrupt to execute, ensuring critical events are never blocked even when maskable interrupts are disabled for critical section protection.
Data Source
AI summary
In the present invention, when an abnormality occurs in a task, regardless of whether a critical section is being executed, timeout detection is realized by determining whether the critical section (CS) is necessary for the design in a preset task execution time and a certain period of time to distinguish between necessary interrupt disable and abnormal interrupt disable. A vehicle control device includes task execution means for causing a system to execute a task, and interrupt processing means for performing an interrupt process at the time of execution of the task. A maskable interrupt and a non-maskable interrupt that is commanded to execute after the maskable interrupt are included, the maskable interrupt is commanded to execute during an interrupt disable time, and then the non-maskable interrupt is executed.