JP5076342B2 - Distributed control device - Google Patents

Description

  The present invention relates to a distributed control apparatus, and more particularly, to a distributed control apparatus that executes appropriate recovery processing so as not to stop the entire system when a local abnormality occurs in a part of the system.

  In a control software structure for distributed cooperative control of a plurality of electronic control units via a network, the data management function and the time synchronization function are separated from each control application program for realizing each system provided in each electronic control unit, A control software structure characterized by arranging a data management function and a time synchronization function common to a plurality of electronic control devices in a distributed control platform below each control application program, and a control device using this structure are known. (For example, refer to Patent Document 1).

  Conventionally, the control application program itself for realizing each control system has a data management function and a time synchronization function for synchronizing data transmission / reception, calculation timing, etc. In the control structure in which processing is executed while associating with each other, if some control application programs are changed (referred to as changes in data update timing, etc.), consistency with other control application programs is lost. In some cases, it was necessary to redesign other control application programs.

The control software structure described in Patent Document 1 solves the above-described problem, and even when a part of the control application program is changed, only a distributed control platform shared by a plurality of electronic control devices is redesigned. As a result, the reusability of other control application programs can be improved.
JP 2004-220326 A

  However, the control software structure described in Patent Document 1 describes the guarantee of time synchronization and processing timing between tasks of control application programs distributed and arranged in a plurality of electronic control devices. However, when a deadline over occurs There is no mention of this processing. Therefore, if a deadline over occurs in one task and update of predetermined data or data transmission to another ECU is not performed at an appropriate timing, inappropriate data that is not updated or transmitted Based on the above, processing by a later task proceeds, and the influence may affect the entire system.

  In view of such a situation, an object of the present invention is to provide a distributed control device that executes an appropriate recovery process so that the influence does not reach the entire system when a local abnormality occurs in a part of the system. To do.

  In order to achieve the above object, a first invention is a distributed control device mounted on each of a plurality of electronic control devices connected to a network, and realizes a predetermined function in one electronic control device. And a task execution order control means for executing tasks distributedly arranged in a plurality of electronic control devices in a predetermined order, and a task placed in an electronic control device other than the one electronic control device, wherein the task execution The processing time of the task instructed to be executed by the order control means is monitored, and a deadline over determination means for determining whether or not the task has become a deadline over, and the deadline over determination means determines that the task is deadlined. A recovery process executing means for executing a predetermined recovery process when it is determined that the over limit has occurred.

  According to a second aspect of the present invention, in the distributed processing device according to the first aspect of the invention, the deadline over determination unit is configured such that the task execution order control unit determines whether the task execution order control unit When the elapsed time after instructing execution exceeds a predetermined time, it is determined that the deadline is over.

  Further, according to a third invention, in the distributed processing device according to the first invention, the predetermined restoration processing is performed by initializing data temporarily updated by a task having exceeded the deadline time or exceeding the deadline time. Re-executed tasks, sound an alarm, substitute the value of the data that the task that exceeded the deadline time was supposed to output or update, or follow the task that exceeded the deadline time It is a process for changing the order of tasks to be performed.

  With the above-described means, the present invention can provide a distributed control apparatus that executes appropriate recovery processing so that the influence does not reach the entire system when a local abnormality occurs in a part of the system.

  Hereinafter, the best mode for carrying out the present invention will be described in several embodiments with reference to the drawings.

  FIG. 1 is a block diagram illustrating a configuration example of a distributed control system using a distributed control device according to the present invention. The distributed control system S is composed of a plurality of ECUs (Electronic Control Units) 1 and ECUs 2 connected by a bus 3 using an in-vehicle network communication protocol such as a CAN (Controller Area Network) bus or a LIN (Local Interconnect Network) bus. The

  The ECU 1 and the ECU 2 are electronic control devices for controlling various in-vehicle devices. For example, when starting or accelerating on a slippery road surface, the engine output is reduced or the drive wheels are braked. Deployment of airbags by maintaining the optimal slip ratio between the tire and the road surface, detecting the impact with an acceleration sensor, and detecting the impact with an acceleration sensor that controls the driving force so that the drive wheels do not spin. In order to suppress the side slip that occurs when a steering wheel such as an air bag control device that controls an inflator that supplies gas for the purpose, a sudden steering operation such as obstacle avoidance, or when entering a slippery road surface curve, There are vehicle stability control devices that automatically control engine output and braking force of each wheel to ensure vehicle stability.

  Each of the ECUs 1 and 2 includes a microcomputer having an arithmetic device and a storage device, and distributed control devices 11 and 21, and stores an OS (Operating System) and control application programs 10 and 20 in the storage device.

  The control application programs 10 and 20 are programs for realizing the functions of the ECUs. For example, the traction control program in the traction control device, the airbag control program in the airbag control device, and the vehicle stability in the vehicle stability control device. This corresponds to the control program.

  Each control application program 10 and 20 is composed of various tasks. Here, “task” refers to an execution unit of processing as viewed from the OS (Operating System), and includes the control application programs 10 and 20 themselves in addition to the subroutines of the control application programs 10 and 20. For example, the traction control program has a task of detecting acceleration, a task of reducing engine output, a task of operating a brake, etc., and the airbag control program is a task of detecting impact caused by a collision, and the necessity of airbag operation. The vehicle stability control program includes a task for detecting a slip, a task for reducing engine output, a task for operating a brake, and the like. Also included in the task are a traction control program, an airbag control program, a vehicle stability control program, and the like.

  Moreover, each control application program 10 and 20 may implement | achieve the function of each ECU using the task which the other control application program in ECUs other than ECU to which itself belongs has. In this case, the control application programs 10 and 20 define the order of tasks to be executed in the task execution order definition table for each function to be realized by each ECU. The task execution order definition table may be prepared in each program by the control application programs 10 and 20, or may be prepared in an external storage unit.

  For example, when the ECU 1 intends to realize a predetermined function (for example, an anti-spin function), the task A 100 (for example, a task for detecting acceleration) in the control application program of the ECU 1 is first executed, and then the ECU 2 The task execution order is such that task B200 (for example, a task for detecting skidding) in the control application program is executed, and finally task C101 (for example, a task for operating the brake) in the control application program of ECU 1 is executed. Define in the definition table. In this way, by defining the execution order, for example, it is possible to prevent an unnecessary brake from being actuated before detecting a skid.

  The control application programs 10 and 20 set the maximum time (hereinafter referred to as “deadline time”) that can be spent on each task in accordance with the order of tasks to be executed. This is because if one task is executed indefinitely, another task requiring urgentness may not be executed properly. When the time spent for one task exceeds this maximum time, the distributed control devices 11 and 21 described later determine that a deadline over has occurred and execute a predetermined task.

  The distributed control devices 11 and 21 are arranged in each ECU, have a configuration common to each ECU so that they can be shared by a plurality of different control application programs, and cooperate with each control application program distributed to each ECU. Device.

  Further, the distributed control devices 11 and 21 have task execution order control means 110 and 120, deadline over determination means 111 and 211, and recovery processing execution means 112 and 212, for example, concentrating data shared by each ECU or It may be middleware (program) that executes each control application program and each task distributed and arranged in the distributed control system S by the task execution order control unit 110 in a predetermined order while referring to a database to be distributedly managed. Note that the distributed control devices 11 and 21 may be integrated as part of an OS (Operating System) as a program.

  The task execution order control means 110 and 120 communicate with the control application programs 10 and 20 of the ECUs 1 and 2 on which the distributed control devices 11 and 12 are mounted, and tasks defined for each function to be realized by the ECUs 1 and 2. Is obtained from the task execution order definition table of the control application programs 10 and 20. The task execution order control means 110 and 120 store the task execution order defined for each function to be realized by the ECUs 1 and 2 in which the distributed control devices 11 and 12 are installed in a predetermined storage means in advance. In addition, when the execution of the function is instructed from the ECUs 1 and 2, the execution order corresponding to the instructed function may be acquired by accessing the storage unit of the ECUs 1 and 2.

  The deadline over determination means 111 and 211 refer to the deadline time defined together with the execution order of each task, and monitor whether the processing time of the task being executed has exceeded the deadline time. When it is detected that the deadline time has been exceeded, the deadline over determination units 111 and 211 notify the recovery process execution units 112 and 212 to that effect, and cause the recovery process execution units 112 and 212 to execute the recovery process. In this case, the task execution order control means 110 and 120 suspend the processing until the recovery processing by the recovery processing execution means 112 and 212 is completed, and resume the processing after the recovery processing by the recovery processing execution means 112 and 212 is completed. Let

  Here, the “recovery process” is a task executed by the distributed control devices 11 and 21 so that the influence of the task exceeding the deadline time does not affect other tasks, other ECUs, or the entire distributed control system S. For example, a task that exceeded the deadline time initialized various data that was temporarily updated, a task that exceeded the deadline time was re-executed, an alarm was sounded, or the deadline time was exceeded Data that the task was supposed to be output or updated is substituted with predetermined data (such as an initial value), or the order of tasks following the task that has exceeded the deadline time is changed.

  If the task whose deadline time has been exceeded is the task of the control application program in the ECU to which it belongs, the recovery processing execution means 112 and 212 forcibly terminate the task, and the task whose deadline time has been exceeded If it is a task of a control application program in an ECU other than the ECU to which it belongs, the distributed control device of the other ECU is notified to forcibly terminate the task.

  As described above, the deadline over determination means 111 and 211 monitor whether the processing time of the task in the control application program of the ECU other than the ECU to which the ECU belongs does not exceed the deadline time. When a deadline over occurs in a task in an ECU other than the ECU to which the ECU belongs, a predetermined recovery process is executed, so that the influence of the deadline over generated in the task in the ECU other than the ECU to which the ECU belongs is It is possible to prevent the ECU and thus the entire system from being covered.

  That is, the distributed control system S does not execute the subsequent task of another ECU without confirming that the data to be updated by the task of one ECU has been updated, so that The influence of the deadline over generated in the task is prevented from reaching other ECUs and thus the entire system.

  Next, a process in which the distributed control system S executes a plurality of tasks distributed in a plurality of ECUs in a predetermined order in order to realize a predetermined function of the ECU 1 will be described with reference to FIGS. .

  FIG. 2 is a diagram showing the transition of tasks in the ECUs 1 and 2 with the ECU 1 and 2 on the vertical axis and the time axis on the horizontal axis. FIG. 2A shows the tasks A100, B200 and C101. FIG. 2B shows a case where task B200 is not properly executed and a deadline is over. The order of tasks to be executed is defined in the order of task A100, task B200, and task C101 in both FIG. 2 (A) and FIG. 2 (B).

  2A, in the distributed control system S, the task execution order control unit 110 of the distributed control device 11 in the ECU 1 first refers to the task execution order definition table so that the order of tasks to be executed is the task A100, the task It is confirmed that the order is B200 and task C101.

  The task execution order control means 110 calls the task A100 in the control application program 10 of the ECU 1 according to the order, and executes the process. The task A100 executes processing according to a predetermined procedure, and when the processing is completed, notifies the distributed control device 11 in the ECU 1 that the processing is completed.

  When the notification that the task A100 is normally completed is received, the task execution order control means 110 instructs the task execution order control means 210 of the distributed control device 21 in the ECU 2 to call the task B200 in the ECU2.

  Receiving the instruction, the task execution order control means 210 in the ECU 2 calls the task B 200 in the control application program 20 of the ECU 2 and executes the process. Task B200, similar to task A100 of ECU1, executes the process according to a predetermined procedure, and notifies the distributed control device 21 in ECU2 that the process has been completed when the process is completed.

  Upon receiving notification that the task B200 has been completed normally, the task execution order control unit 210 notifies the task execution order control unit 110 of the distributed control device 11 in the ECU 1 to that effect.

  Receiving the notification, the task execution order control means 110 in the ECU 1 calls the task C101 in the control application program 10 of the ECU 1 to execute the process. Task C101, like task A100 of ECU1 and task B200 of ECU2, executes the process according to a predetermined procedure, and notifies the distributed control device 11 in ECU1 that the process has been completed when the process is completed.

  In this way, the distributed control system S realizes the function of the ECU 1 that includes the task A100, the task B200, and the task C101.

  Next, a case where task B200 is not properly executed and a deadline is over will be described.

  In FIG. 2 (B), the distributed control system S first refers to the task execution order definition table by the task execution order control means 110 of the distributed control device 11 in the ECU 1 as in FIG. 2 (A). It acquires that the order of tasks to be executed is the order of task A100, task B200, and task C101.

  The task execution order control means 110 calls the task A100 in the control application program 10 of the ECU 1 according to the order, and executes the process. When the processing is completed, the task A100 notifies the distributed control device 11 in the ECU 1 that the processing is completed.

  When the notification that the task A100 is normally completed is received, the task execution order control means 110 instructs the task execution order control means 210 of the distributed control device 21 in the ECU 2 to call the task B200 in the ECU2.

  However, if a communication interruption occurs between the ECU 1 and the ECU 2 at this time, an instruction from the ECU 1 is not transmitted to the ECU 2, and the task B200 in the ECU 2 is not executed.

  Even in such a case, the distributed control device 11 in the ECU 1 monitors the processing status of the task B200 in the ECU 2 by the deadline over determination unit 111, and the task execution order control unit 110 in the ECU 1 performs the task B200 in the ECU 2. When the elapsed time from when the ECU 2 is instructed to call exceeds the deadline time of task B200 defined in the task execution order definition table, it is determined that a deadline over has occurred.

  When the deadline over determining unit 111 determines that a deadline over has occurred, the distributed control device 11 in the ECU 1 causes the recovery process executing unit 112 to execute a recovery process.

  If the deadline over determination means 111 does not exist and the task B200 is a task with a content that updates the value of predetermined data, the ECU 1 is a predetermined time after a predetermined time has elapsed since the task B200 in the ECU 2 was called. At the timing, the subsequent task C101 is executed assuming that the predetermined data has already been updated by the task B200. Therefore, if the predetermined data is an abnormal value, a system that does not have the deadline over determination unit 111 may not prevent the entire system from being adversely affected.

  On the other hand, the distributed control system S including the distributed control devices 11 and 21 according to the present invention quickly and reliably recognizes that the task B200 in the ECU 2 is deadline over, and causes the ECU 1 to execute a recovery process. It is possible to minimize the influence of the occurrence of deadline over and to prevent the entire distributed control system S from being affected.

  FIG. 3 is a flowchart showing a flow of processing executed by the arithmetic unit of the ECU 1. Blocks indicated by hatching indicate processing by the control application program 10, and other blocks without hatching indicate processing by the distributed control device 11. Indicates. Note that the order of tasks executed to realize a predetermined function of the ECU 1 is defined in the order of task A100, task B200, and task C101 as in the case of FIGS. 2 (A) and 2 (B). It shall be.

  First, the ECU 1 calls the task A100 of the control application program 10 in the ECU 1 (step S101) and causes the task A100 to be executed (step S102). Thereafter, when a process completion notification is received from the task A100 (step S103), the distribution control device 21 of the ECU 2 is instructed to execute the task B200 in the ECU 2 according to the order defined in the task execution order definition table (step S104). ).

  After transmitting the instruction, the ECU 1 measures the elapsed time from that time by the deadline over determination unit 111 (step S109), and waits until the processing completion notification of the task B200 is transmitted from the ECU 2 (step S105). NO, NO in step S109).

  When the processing completion notification of task B200 is received from ECU 2 (YES in step S105), task C101 in ECU 1 is called according to the order defined in the task execution order definition table (step S106), and task C101 is executed (step S107). Thereafter, a process completion notification is received from the task C101 (step S108), and the process executed by the arithmetic device is terminated.

  On the other hand, if the deadline time of the task B200 defined in the task execution order definition table has elapsed without receiving the processing completion notification of the task B200 from the ECU 2 (NO in step S105), the deadline over determination unit 111 of the ECU 1 Then, it is determined that the task B200 has become a deadline over (YES in step S109), and a signal indicating that is transmitted to the recovery processing execution means 112 (step S110).

  Thereafter, the recovery processing execution means 112 receives the signal from the deadline over determination means 111 and executes the recovery processing (step S111), and the influence of the task B200 deadline over is transferred to other parts of the distributed control system S. The processing executed by the arithmetic device is terminated in such a way that it does not reach.

  FIG. 4 is a flowchart showing a flow of processing executed by the arithmetic unit of the ECU 2 cooperating with the ECU 1. Blocks shown by hatching indicate processing by the control application program 10, and other blocks without hatching are distributed. The process by the control apparatus 11 is shown.

  First, the ECU 2 monitors the transmission of an instruction from the ECU 1 (step S201), and continuously monitors the transmission of the instruction when the instruction is not transmitted (NO in step S201). To do.

  When the ECU 2 receives an instruction from the ECU 1 (YES in step S201), the ECU 2 acquires the instruction content (calling of the task B200 in the control application program 20 of the ECU 2), and calls the task B200 according to the instruction content (step S202). ), Task B200 is executed (step S203).

  Thereafter, the ECU 2 receives a process completion notification from the task B200 (step S204), transmits the process completion notification to the ECU 1 (step S205), and ends the process executed by the arithmetic unit of the ECU2.

  With the above-described configuration, the distributed control system S causes communication interruptions and communication delays due to abnormalities in hardware such as the ECU 1, ECU 2, and bus 3, or software defects such as the control application programs 10 and 20 and the distributed control devices 11 and 21. When one of a plurality of tasks distributed and arranged in a plurality of ECUs becomes deadline over due to a delay in processing by the ECU, an ECU other than the ECU in which the tasks are arranged can be dead quickly and reliably. Recognizing the occurrence of a line over and executing the recovery process to localize the effect of the dead line over, the influence of the dead line over is prevented from reaching the entire distributed control system S, thereby improving the reliability of the system. Can be improved.

  The preferred embodiments of the present invention have been described in detail above. However, the present invention is not limited to the above-described embodiments, and various modifications and substitutions can be made to the above-described embodiments without departing from the scope of the present invention. Can be added.

  For example, all of the ECUs connected to the distributed control system may have a distributed control device, or only some of the ECUs may have a distributed control device. When all the ECUs have the distributed control device, there is an effect that the influence can be localized even if a deadline over occurs in any ECU. This is because there is an effect that it is possible to reduce the cost for constructing the distributed control system when the system has the distributed control device.

It is a block diagram which shows the structural example of the distributed control system which concerns on this invention. It is a figure which shows the progress of the task in ECU1,2. It is a flowchart which shows the flow of the process performed with the arithmetic unit of ECU1. It is a flowchart which shows the flow of the process performed with the arithmetic unit of ECU2.

Explanation of symbols

1, 2 ECU
3 Bus 10, 20 Control application program 11, 21 Distributed control device 100 Task A
101 Task C
200 Task B
S Distributed control system

Claims (4)

A distributed control device mounted on at least one of a plurality of electronic control devices connected to a network,
Task execution order control means for executing a plurality of tasks distributed and arranged in a plurality of electronic control devices in accordance with a predetermined order in order to realize a predetermined function in one electronic control device;
A first task disposed in the electronic control device other than the electronic control unit of the 1, dead determines whether the first task execution is instructed by the task execution order control unit becomes a deadline over Line over determination means;
A recovery process executing means for executing a predetermined recovery process when the deadline over determination means determines that the one task has become a deadline over;
A distributed control device comprising: The one task is executed by at least two of the plurality of electronic control devices.
The distributed control apparatus according to claim 1. The deadline over determination means, the relative electronic control device other than the electronic control unit 1, the task execution order control means time after instructing execution of the first task time spent on the task the one of the predetermined When it exceeds, it is determined that it is deadline over.
The distributed control device according to claim 1, wherein the device is a distributed control device. Wherein the predetermined recovery process, or to initialize the data 1 of tasks exceeds the deadline time is temporarily updated, or to re-execute the first task that exceeds the deadline, or by sounding an alarm, dead or the value of the data 1 of the task that exceeded the line time was supposed outputs or updates to substitute a predetermined value, the processing or change the order of the subsequent task 1 of the task that exceeds the deadline time is there,
The distributed control apparatus according to any one of claims 1 to 3.

Images