JP7214459B2 - communication controller - Google Patents

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a communication control device, and more particularly to a communication control device that executes predetermined control processing by combining a plurality of microcomputers and has a communication system that redundantly connects the microcomputers (arithmetic control units) to each other.

There is an increasing need for automated driving as a means of solving various social issues related to automobiles. J3016 by the Society of Automotive Engineers (SAE) is well known as an index indicating the level of driving automation. Functions that partially assist the driver's operation, such as adaptive cruise control and lane-keeping assist system equivalent to level 1, have already been put into practical use. On the other hand, level 4 and level 5 self-driving cars, which do not require driver intervention, are expected to enter the market by 2025 and 2030, respectively. In order to realize these goals, in addition to the conventional finished car manufacturers and suppliers, the current situation is that players and venture companies from other industries that have strengths in image recognition and machine learning, for example, are competing in development.

In level 2 or higher autonomous vehicles that simultaneously control the longitudinal (acceleration/deceleration) and lateral (steering) movements of the vehicle, a vehicle control unit called an autonomous driving ECU plays a central role in vehicle control. The autonomous driving ECU includes (1) sensing that acquires data on the vehicle and its surrounding environment, (2) situation recognition that integrates and analyzes the acquired sensor data and map information, and (3) safe driving based on the recognition results. It is required to execute various kinds of complex information processing on large-scale data in real time, including an action plan for generating a trajectory, (4) actuator control for reflecting the action plan on the motion of the own vehicle, and the like.

There is currently no common platform for autonomous driving ECU architectures and implementation methods. A distributed system that implements multiple functional modules that operate on an independent microcomputer for each stage of information processing, and interconnects these multiple functional modules by communication means to coordinate each process has technical merits. It is believed that there are many

On the other hand, by introducing the above modular design, connections between multiple functional modules may create new bottlenecks. That is, since the entire control process is executed as a software pipeline by a plurality of microcomputers, intermediate processing data must be transferred in real time (for example, on the order of 10 milliseconds) between the microcomputers that are the main constituent devices of the module. Intermediate data exchange can cause bottlenecks.

In addition, in automotive applications, the system as a whole is expected to maintain a predetermined controllability and a safe state even if some of the devices that make up the system fail. Therefore, it is required to adopt a redundant configuration of hardware including inter-microcomputer communication means in a particularly important device such as an automatic driving ECU.

In fields where real-time performance is not required as much as automotive applications, as disclosed in Non-Patent Document 1, communication paths are made redundant via Ethernet switches ("Ethernet" is a registered trademark), and a predetermined protocol is used. Implementations are known that perform path management, including switching, by .

FIG. 17 shows an example of an inter-microcomputer communication system with path redundancy according to the conventional method. A microcomputer 900 incorporates an Ethernet adapter 901 that processes an Ethernet protocol, and performs Ethernet communication with the outside of the microcomputer via a connection port 902 and an Ethernet cable 903 to the outside of the microcomputer. When only one connection port 902 is mounted on the microcomputer 900, an Ethernet switch 910 is added externally for each microcomputer 900, and an Ethernet cable 903 is connected to a plurality of switch connection ports 914 (914a) provided in the Ethernet switch 910. 914h).

Further, by connecting a plurality of Ethernet switches 910 in parallel with Ethernet cables 915-1, 915-2, .

The Ethernet switch 910 has a control table 911 that holds control information regarding frame transfer rules between switch connection ports 914 and controls the operation of a switch matrix 913 via a switch matrix control interface 912 . As a result, frame transfer is performed between designated switch connection ports 914 .

Furthermore, the Ethernet switch 910 supports the Spanning Tree Protocol (STP), and according to the procedure defined by the STP, two redundant communications are performed for the purpose of suppressing broadcast storms caused by looped communication paths. Enable frame forwarding on only one of the paths. In addition, when the Ethernet switch 910 detects a failure in the communication path due to non-delivery of the network management frame, the Ethernet switch 910 configures the control table 911 to enable the communication path on the side not including the failure according to the procedure defined by the STP. Update content appropriately. As a result, communication path redundancy and path switching control in the event of a failure are realized.

However, according to the STP specifications, communication is disabled for several tens of seconds from the occurrence of a failure to the completion of path switching, so real-time requirements cannot be met. When attempting to improve the fault tolerance of communication between microcontrollers by making the communication path redundant, in the conventional method, in addition to the switching time that depends on the protocol, the overhead associated with the recovery process starting from the detection of a communication error occurs asynchronously with the control cycle. As a result, there is a risk that real-time communication cannot be guaranteed. In addition, there is a possibility that the load factor of the arithmetic and control unit (CPU) will increase due to the redundant multiple data reception process.

Toshio Uno (2011) Self-Study TCP/IP IP Networking, Shoeisha

SUMMARY OF THE INVENTION It is an object of the present invention to provide a communication control device that can guarantee real-time communication and reduce the load factor of an arithmetic control device.

A communication control device according to the present invention includes: first communication means for connecting a first arithmetic and control device and a second arithmetic and control device to transmit and receive first data; a second communication means connected to a second arithmetic and control unit and transmitting/receiving second data different from the first data; connected to the first communication means and the second communication means; and a masked receiving section that, when one of the first data and the second data is normally received, masks the receiving operation of the other.

In the communication control device according to the present invention, the first and second arithmetic and control units are redundantly connected by the first and second communication means to transfer the first and second data, respectively. On the receiving side, when one of the first data and the second data is normally received, the receiving operation of the other is masked by the masked receiving unit, and only one of the data is received. An increase in the load factor can be suppressed. Therefore, according to the present invention, it is possible to provide a communication control device that can guarantee real-time communication and reduce the load factor of the arithmetic control device.

1 is a block diagram showing the configuration of a vehicle control device 1 according to a first embodiment of the invention; FIG. 3 is a block diagram showing a detailed configuration of a delay transmission section 100; FIG. 3 is a block diagram showing a detailed configuration of a masked receiving section 120; FIG. FIG. 4 is a table showing the relationship between the information held in the reception state holding register 137 and the operation of the reception mask control section 136 based on that information. 3 is a block diagram showing a detailed configuration of an operation mode control section 140; FIG. 4 is a flowchart showing an operation mode determination flow of an operation mode determination unit 150; 4 is a timing chart showing an operation mode determination mechanism of an operation mode control unit 140 based on whether or not an underflow occurs in a timer 152; 4 is a timing chart showing an operation mode determination mechanism of an operation mode control unit 140 based on whether or not an underflow occurs in a timer 152; 4 is a timing chart showing the relationship between the TP1/TP2 reception completion order within the control cycle and the execution software of the second microcomputer 20 at the operation level; 4 is a timing chart showing the relationship between the TP1/TP2 reception completion order within the control cycle and the execution software of the second microcomputer 20 at the operation level; 4 is a timing chart showing the relationship between the TP1/TP2 reception completion order within the control cycle and the execution software of the second microcomputer 20 at the operation level; 4 is a timing chart showing the relationship between the TP1/TP2 reception completion order within the control cycle and the execution software of the second microcomputer 20 at the operation level; 3 shows the operation of the second microcomputer 20 based on the operation mode control method that straddles control cycles according to the vehicle control device 1 according to the second embodiment of the present invention. 3 shows the operation of the second microcomputer 20 based on the operation mode control method that straddles control cycles according to the vehicle control device 1 according to the second embodiment of the present invention. 3 shows the operation of the second microcomputer 20 based on the operation mode control method that straddles control cycles according to the vehicle control device 1 according to the second embodiment of the present invention. 3 shows the operation of the second microcomputer 20 based on the operation mode control method that straddles control cycles according to the vehicle control device 1 according to the second embodiment of the present invention. Communication between microcomputers with path redundancy by the conventional method is shown.

Hereinafter, this embodiment will be described with reference to the accompanying drawings. In the accompanying drawings, functionally identical elements may be labeled with the same or corresponding numbers. It should be noted that although the attached drawings show embodiments and implementation examples in accordance with the principles of the present disclosure, they are for the purpose of understanding the present disclosure and are in no way used to interpret the present disclosure in a restrictive manner. is not. The description herein is merely exemplary and is not intended to limit the scope or application of this disclosure in any way.

Although the present embodiments are described in sufficient detail to enable those skilled in the art to practice the present disclosure, other implementations and configurations are possible without departing from the scope and spirit of the present disclosure. It is necessary to understand that it is possible to change the composition/structure and replace various elements. Therefore, the following description should not be construed as being limited to this.

[First embodiment]
FIG. 1 shows the configuration of a vehicle control device 1 (communication control device) according to the first embodiment of the present invention. A vehicle control device 1 (ECU) includes a first microcomputer 10 (first arithmetic control device) and a second microcomputer 20 (second Arithmetic control unit). For the sake of simplicity of explanation, FIG. It goes without saying that it is good. Even if more than two microcomputers are included in one vehicle control device, two microcomputers among them can be configured according to the following description.

The connection between the first microcomputer 10 and the second microcomputer 20 is configured in a redundant connection mode by a first communication means 101 (hereinafter also referred to as TP1) and a second communication means 102 (hereinafter also referred to as TP2). be. Although not particularly limited, for the sake of simplicity, the description will be limited to the data communication direction between the microcomputers from the first microcomputer 10 (transmitting side) to the second microcomputer 20 (receiving side). The standards/specifications conforming to the first communication means 101 and the second communication means 102 may be common, or part or all of them may be different. As an example, the first communication means 101 is a high-speed interface such as PCIe, and the second communication means 102 is a low-speed interface such as CAN or SPI, but they are not limited to these.

The first communication means 101 is an interface used to transfer all control data (hereinafter also referred to as "normal data" or "first data") necessary for executing predetermined control processing. The second communication means 102 also provides control data (hereinafter referred to as " This is an interface used for transferring "degenerate data" or "second data").

Which data is to be degenerated data can be appropriately determined according to the device configuration, network configuration, communication path conditions, and the like. The degenerate data may be part of the normal data. As an example, it is possible to extract only the data necessary for an emergency stop from all the data necessary for automatic operation as data at the time of degeneracy. Alternatively, the degenerate data may be digest data generated based on a predetermined algorithm from part or all of the normal data. Alternatively, the degenerate data may be any combination thereof. The number of interfaces between the two microcomputers 10 and 20 is not limited to two, and may be three or more. Some of the three or more interfaces may be used for normal data transfer, and other interfaces may be used for degraded data transfer.

The first microcomputer 10 is configured to be able to execute a first control application 210 corresponding to part of predetermined control processing. The first microcomputer 10 has a delay transmission section 100 . The first control application 210 uses the transmission interface 211 provided by the transmission unit 100 with delay to transmit the normal data and the degenerated data obtained as a result of execution to the second microcomputer 20 . As will be described later, the transmission unit 100 with delay causes the completion of reception of normal data to precede the completion of reception of degraded data. is configured to be able to execute delay processing for delaying the transfer processing of

The second microcomputer 20 is configured to be able to execute a second control application 220 , first degeneracy mode system software 230 , and second degeneracy mode system software 240 . The second control application 220, like the first control application 210, executes a process corresponding to part of the predetermined control process. The first degenerate mode system software 230 is selected and executed when the communication failure occurring in the redundant connection is the first stage. The second degenerate mode system software 240 is selected and executed when the communication failure occurring in the redundant connection is in the second stage.

The second microcomputer 20 also includes a masked reception section 120 , an operation mode control section 140 and a scheduling control section 160 .

The masked receiving unit 120 is connected to the first communication means 101 and the second communication means 102, and based on the reception state of each communication means and the presence or absence of failure (reception incomplete or error detected during reception processing) A reception state notification generated by a predetermined procedure is output from the reception state control interface 122 to the operation mode control section 140 .

The operation mode control unit 140 determines the state to which the second microcomputer 20 should transition next ( mode). The operation mode control unit 140 then instructs the scheduling control unit 160 via the operation mode control interface 141 about the state to which the second microcomputer 20 should transition.

Scheduling control unit 160 instructs execution of software according to instructions from operation mode control unit 140 . For example, when the software to be executed next (to be transitioned) is the second control application 220 , the execution control interface 161 instructs execution of the second control application 220 . If the software to be executed next (to be transitioned) is the first degraded mode system software, the execution control interface 162 instructs execution of the first degraded mode system software. If the software to be executed next (to be transitioned) is the second degeneracy mode system software, the execution control interface 163 instructs execution of the second degeneracy mode system software. The software instructed to execute receives data using the receiving interface 121 provided by the masked receiving section 120 . The software whose execution is instructed performs reception processing of normal data and/or degraded data. Software excluded from execution instructions does not perform any data reception processing.

FIG. 2 shows an example of a detailed configuration of the delay transmission section 100. As shown in FIG. The delayed transmitter 100 includes, for example, a transmission trigger controller 110 , a first transmission buffer 114 , a second transmission buffer 116 , a first transmission controller 118 and a second transmission controller 119 .

The first transmission buffer 114 is a data storage unit that temporarily stores normal data in order to transmit the normal data via the first communication means 101 . The normal data temporarily stored in first transmission buffer 114 is output to first transmission control section 118 via first transmission data interface 115 .

Also, the second transmission buffer 116 is a data storage unit that temporarily stores the degenerated data in order to transmit the degenerated data via the second communication means 102 . The degenerated data temporarily stored in the second transmission buffer 116 is output to the second transmission control section 119 via the second transmission data interface 117 .

The first transmission control unit 118 sends the transmission data (part or all of the normal data) acquired from the first transmission data interface 115 to the first communication means 101 according to a predetermined protocol. The second transmission control unit 119 also sends the transmission data (part or all of the degenerated data) acquired from the second transmission data interface 117 to the second communication means 102 according to a predetermined protocol.

The transmission trigger control section 110 has a timer 111 capable of measuring the difference between the transmission start timings to the first communication means 101 and the second communication means 102 and performing a countdown operation. The transmission trigger control unit 110, through the transmission trigger interfaces 112 and 113, controls the start of data transmission to the first communication means 101 and the start of data transmission to the second communication means 102, respectively. It transmits to the first transmission control section 118 and the second transmission control section 119 .

Note that the transmission interface 211 serving as an interface between the first control application 210 and the transmission unit with delay 100 stores transmission data in the first transmission buffer 114 and the second transmission buffer 116, and also stores the transmission data in the empty state of the transmission buffer. It may contain an interface that allows checks and explicit transmission requests.

Although not particularly limited, the transmission trigger control unit 110 receives a transmission start request from the first control application 210 and sets the count value of the timer 111 to a predetermined initial count value. After that, the timer 111 is caused to start the countdown operation, and at the same time, the start of normal data transmission to the first communication means 101 is instructed via the transmission trigger interface 112 .

The transmission trigger control unit 110 further stops the countdown operation when the count value of the timer 111 becomes zero or less (underflow), and at the same time, via the transmission trigger interface 113 to the second communication means 102, the second command to start transmission of degenerate data to the communication means 102 of . Under the condition that the first communication means 101 and the second communication means 102 complete communication normally in one transmission/reception operation (that is, retransmission does not occur), the normal data reception completion time is degenerated. The initial count value of the timer 111 can be set so as to precede the reception completion time of the hour data. By setting in this way, the completion of reception of normal data can be preceded by the completion of reception of degenerated data, and the overhead of data transmission/reception can be reduced. The masked reception section 120 has a role of reducing the load factor of the arithmetic and control unit by masking unnecessary data to be received. is received prior to the reception of degenerate data, the load factor of the arithmetic and control unit can be reduced.

FIG. 3 is a block diagram showing the detailed configuration of the masked receiving section 120. As shown in FIG.

The masked reception unit 120 includes a first reception control unit 130 that receives data (normal data) from the first communication means 101 according to a predetermined protocol, and a data (degenerate data) from the second communication means 102 according to a predetermined protocol. data), the first reception buffer 138 that stores the reception data (normal data) acquired from the first reception data interface 132, the second reception data interface 135 A second receive buffer 139 is provided for storing received data (degenerated data). The masked receiver 120 also includes a reception mask controller 136 .

When the reception process defined by the protocol conforming to the first communication means 101 is completed, the first reception control unit 130 notifies the first reception status notification interface 131 of the reception status (reception process completed and error detection). For the detection of communication errors, it is assumed that the means defined by the protocol conforming to the first communication means 101, such as checking a cyclic redundancy check (CRC) code added to the transmission data, is used.

When the reception process defined by the protocol conforming to the second communication means 102 is completed, the second reception control unit 133 notifies the second reception status notification interface 134 of the reception status (reception process completed and error detection). For detection of communication errors, it is assumed that the means specified by the protocol conforming to the second communication means 102, such as checking a cyclic redundancy check (CRC) code added to the transmission data, is used.

The reception mask control unit 136 controls the reception state of the first reception control unit 130 obtained via the first reception state notification interface 131 and the second reception state obtained via the second reception state notification interface 134 . In addition to the reception state of the control unit 133 , the reception mask setting information specifying the validity of the reception mask operation by itself is held in the reception state holding register 137 .

The reception mask control unit 136 further outputs a reception state notification generated by a procedure described later based on the data held in the reception state holding register 137 from the reception state control interface 122 to the operation mode control unit 140 . When receiving a request to update the reception state holding register 137 from the reception state control interface 122, the reception mask control unit 136 performs the requested update processing.

The reception interface 121 as an interface with the second control application 220, the first degeneracy mode system software 230, and the second degeneracy mode system software 240 includes a first reception buffer 138 and a second reception buffer 138. In addition to the received data stored in the buffer 139, an interface may be included that enables acquisition of part or all of the data held in the reception state holding register 137. FIG.

FIG. 4 is a table showing the relationship between the information held in the reception state holding register 137 and the operation (reception state notification, reception mask update) of the reception mask control section 136 based on the information.

The reception state holding register 137 is configured to be able to hold, for example, the following setting information or data indicating state information.
(1) Regarding the first communication means 101 (TP1), TP1 reception mask setting (C101) for setting whether or not to mask the completion notification to the operation mode control unit 140 when reception is completed.
(2) TP1 reception state (completed) indicating whether or not the first reception control unit 130 has completed reception processing (C102)
(3) TP1 reception status (error) indicating whether or not an error has been detected during the reception process of the first reception control unit 130 (C103)
(4) Regarding the second communication means 102 (TP2), TP2 reception mask setting (C201) for setting whether or not to mask the completion notification to the operation mode control unit 140 when reception is completed.
(5) TP2 reception state (completed) indicating whether or not the second reception control unit 133 has completed reception processing (C202)
(6) TP2 reception status (error) indicating whether or not an error is detected during the reception process of the second reception control unit 133 (C203)

The reception state holding register 137 independently sets information on the reception mask setting (C101, C201) in response to an update request from the reception interface 121 or the reception state control interface 122 (Y: mask is enabled, receive completion notification is disabled) or cleared (N: mask is disabled and reception completion notification is enabled).

In addition, the reception state holding register 137 sets (Y: reception completed) or clears (N: reception not completed) information about the reception state (completion) (C102, C202) according to an instruction from the reception mask control unit 136. can be configured to allow In addition, the reception status holding register 137 can only clear information on the reception status (completed) (C102, C202) (N: reception not completed) in response to a request from the reception interface 121 or the reception status control interface 122. can also be configured to

Furthermore, the reception status holding register 137 can set the information about reception completion (error) (C103, C203) to valid only when the reception status (completion) is Y (reception completed). In addition, the reception state holding register 137 can set (Y: error) or clear (N: no error) information regarding reception completion (error) (C103, C203) according to an instruction from the reception mask control unit 136. be. Alternatively, it may be configured such that only clearing (N: no error) is possible by a request from the reception interface 121 or the reception state control interface 122 .

In addition, in order to select the validity of the reception completion notification when an error is detected during reception, a setting (hereinafter referred to as "extended reception mask setting") independent of the reception mask setting (C101, C201) is It may be added as data to be held in the reception state holding register 137 . At this time, any one of the following operations (1) to (3) can be set independently for each communication means.
(1) Reception mask setting = Y (mask valid)
In this case, the reception completion notification is invalid regardless of the contents of the extended reception mask setting.
(2) Reception mask setting = N (mask disabled) and extended reception mask setting = N (mask disabled)
In this case, the reception completion notification is valid regardless of whether an error is detected during reception.
(3) Reception mask setting = N (mask disabled) and extended reception mask setting = Y (mask enabled)
In this case, the reception completion notification is valid only when no error is detected during reception.

The reception mask control unit 136, according to the table of FIG. outputs from the reception state control interface 122 a reception state notification (C301) regarding the communication means. Note that if extended reception mask settings have been added, those settings are also reflected.

At the same time, if no error is detected in the previously completed reception process, the reception mask is updated (C302) so as to suppress the reception status notification regarding the communication means for which the reception process has not been completed. With this control, it is possible to omit reception processing by software for received data that does not affect the operation of the second microcomputer 20, and to suppress an increase in the CPU load factor even with redundant communication means.

FIG. 5 is a block diagram showing the detailed configuration of the operation mode control section 140. As shown in FIG.

The operation mode control unit 140 includes an operation mode determination unit 150 and a deadline detection unit 151 having one or more timers 152 (152a and 152b) capable of countdown operation. Operation mode determination unit 150 and deadline detection unit 151 are interconnected by deadline notification interface 153 for transmitting data indicating that the count value of each timer 152 is less than zero (underflow). The operation mode control unit 140 of the first embodiment determines the status of data reception and switches the operation mode for each control cycle Tc. The deadline detection unit 151 has a function of detecting whether or not data reception is normally completed within a predetermined time within a predetermined control period.

The operation mode determination unit 150 determines the second microcomputer 20 based on the reception state notification acquired from the reception state control interface 122 and the deadline detection information acquired from the deadline detection unit 151 via the deadline notification interface 153. The operation mode is determined, and the result of the determination is output to the operation mode control interface 141 to notify the scheduling control unit 160 .

The operation mode control unit 140 is also configured to be able to receive a control cycle start trigger specifying the start timing of the control cycle. Upon receiving the control cycle start trigger, the operation mode control unit 140 sets the count values of one or more timers 152 to predetermined initial count values, and then causes the timers 152 to start counting down. At the same time, the operation mode control unit 140 requests the reception mask control unit 136 in the masked reception unit 120 via the reception state control interface 122 to initialize the data held in the reception state holding register 137 . Specifically, the held data C101, C102, C103, C201, C202, and C203 are cleared. However, the content of the extended reception mask setting is retained.

Further, when the operation mode determination unit 150 is notified by the deadline detection unit 151 that the count value of one of the one or more timers 152 has become zero or less (underflow), the operation mode determination unit 150 to stop the countdown operation of the timer 152. If the timer 152 is a specific timer (152b), the TP1 reception mask setting (C101) held in the reception state holding register 137 is enabled (Y) via the reception state control interface 122. A request is made to the reception mask control unit 136 .

Also, although not particularly limited, the initial count value of the timer 152b is the time ( A count value for measuring the TP1 reception window (first elapsed time) Tr1 (=Tc-Te1) can be set. As a result, it is possible to avoid the problem that the processing of the second control application 220 is not completed within the control period due to the delay in the reception completion timing of the first communication means 101 .

Also, although not particularly limited, the initial count value of the timer 152a is the control cycle Tc minus the time Te2 required for executing the second degenerate mode system software 240, which is the first communication means 101 or the second communication It is possible to set a count value for measuring the time (deadline time (second elapsed time)) Tr2 (=Tc-Te2) for which the receiving process of means 102 is permitted. As a result, the processing of the second degeneracy mode system software 240 is not completed within the control cycle because neither the first communication means 101 nor the second communication means 102 has completed normal reception. problem can be avoided. The deadline time Tr2 can be set longer than the TP1 reception window Tr1 described above.

Next, the procedure for determining the operation mode in the operation mode determining section 150 will be described with reference to the flowchart of FIG. Based on the deadline information from the deadline notification interface 153 and the reception status notification (C301) from the reception status control interface 122, the operation mode determination unit 150 determines the operation mode of the second microcomputer 20 according to the following processing flow. Then, the determination information is output to the operation mode control interface 141 and transferred to the scheduling control section 160 .

In this procedure, first, it is checked whether or not the deadline time Tr2 has passed (deadline detection) from the start of the control cycle by an underflow of the timer 152a (step S101). If the deadline is detected (step S101: Yes), it is determined that a failure has occurred in both the first communication means 101 and the second communication means 102, and the operation mode control interface 141 2 is requested (step S107). Upon receiving this request, the scheduling control unit 160 triggers (instructs) execution of the second degeneracy mode system software 240 through the execution control interface 163 for the second degeneracy mode system software.

If the deadline detection is not recognized (step S101: No), then it is checked whether the reception status notification (C301) is "waiting for reception" (step S102), and if it is "waiting for reception" (step If S102: Yes), the process returns to step S101, and the above loop is repeated until a deadline is detected or reception status notification indicating completion of reception by either the first communication means 101 or the second communication means 102 is obtained. be

If the reception status notification is not "waiting for reception" (step S102: No), it is further confirmed whether the reception status notification (C301) is "TP1 reception completed (normal)" (step S103).

If it is "TP1 reception complete (normal)" (step S103: Yes), it is determined that the normal data has been successfully received from the first communication means 101, and the operation mode control interface 141 causes the transition to the normal mode. is requested (step S105). The scheduling control unit 160 that receives this request triggers the execution of the second control application 220 through the execution control interface 161 for the second control application.

On the other hand, if the reception status notification is not "TP1 reception completed (normal)" (step S103: No), it is further confirmed whether the reception status notification (C301) is "TP2 reception completed (normal)". (Step S104).

If the result is "TP2 reception completed (normal)" (step S104: Yes), it is determined that the degenerate data was successfully received from TP2 although a failure occurred in the first communication means 101, and operation mode control is performed. The interface 141 requests a transition to the first degeneration mode (step S106). Upon receiving this request, the scheduling control unit 160 triggers the execution of the first degraded mode system software 230 through the execution control interface 162 to the first degraded mode system software.

On the other hand, if the reception status notification is not "TP2 reception completed (normal)" (step S104: No), it is determined that a failure has occurred in both the first communication means 101 and the second communication means 102. Then, the operation mode control interface 141 requests a transition to the second degeneration mode (step S107). The scheduling control unit 160 that has received this request triggers the execution of the second degeneracy mode system software 240 through the execution control interface 163 for the second degeneracy mode system software.

According to the above configuration, input/output of control information in the operation mode control unit 140 is determined when various combinations of the reception state and reception completion order of the first communication means 101/second communication means 102 are different. The operation mode and the software executed by the second microcomputer 20 are different. The operation of each unit for each different combination will be described below with reference to FIGS. 7 to 16. FIG.

7 and 8 are timing charts showing in detail the operation mode determination mechanism of the operation mode control unit 140 based on the occurrence of underflow in the timers 152b and 152a that measure the TP1 reception window Tr1 and the deadline time Tr2, respectively. is. 7 and 8 show Cases 1-1 to 1-3. FIGS. 7 and 8 show timing charts for Case 1-1 on the left side, and Cases 1-2 and 1-3 on the right side, respectively. Cases 1-1 to 1-3 show actions that can occur due to changes in various situations, and are independent of each other.

<Case 1-1>
As shown in FIGS. 7 and 8, in Case 1-1, the first communication means 101 precedes the second communication means 102 and completes normal data reception within the TP1 reception window Tr1. This control cycle indicates a case where the second control application 220, which is processing for normal mode, is executed.

The operation mode determination unit 150 in the operation mode control unit 140 receives the control cycle start trigger (T) from the scheduling control unit 160 via the operation mode control interface 141 . Upon receiving the trigger (T), the operation mode determination unit 150 instructs the timers 152a and 152b to reload the initial count values (L) through the deadline notification interface 153, and at the same time changes the reception state to the reception state control interface 122. An initialization (reset) request (R) for the holding register 137 is output.

Receiving the reload (L) instruction, the deadline detection unit 151 causes the timers 152a and 152b to count predetermined times for measuring the progress of the deadline time Tr2 and the TP1 reception window Tr1, respectively, based on the beginning of the control cycle. Sets the value and instructs the start of decrement operation. In addition, the reception mask control unit 136 that has received the initialization request (R) clears all the held data other than the extended reception mask setting in the reception state holding register 137, so that the first communication means 101 and the second communication means 101 The setting is made so that the reception completion notification in the communication means 102 of is valid.

When the first reception control unit 130 normally completes the reception of normal data within the TP1 reception window Tr1, the information is transmitted to the reception mask control unit 136 by the first reception status notification interface 131. FIG. The reception mask control unit 136 updates the contents of the reception state holding register 137 so as to reflect the information (corresponding to #5 in FIG. 4), and at the same time sends the reception state notification “TP1 reception completed” to the reception state control interface 122. (Normal)" is output. In addition, by setting the TP2 reception mask (C201) for the second communication means 102 for which reception has not been completed (transition to #7 in FIG. 4), the reception state within the control cycle is determined (FIG. 7). reference).

The operation mode determination unit 150, which has been monitoring the reception state notification of the reception state control interface 122, determines the transition to the normal mode based on the operation mode determination flow of FIG. Indicate (C) the transition to 160 . At the same time, the operation mode determination unit 150 instructs the deadline notification interface 153 to stop the decrement operation of the timers 152a and 152b in order to suppress the occurrence of a false underflow event (see FIG. 7).

The scheduling control unit 160 that has received the transition instruction (C) instructs execution of the second control application 220 through the execution control interface 161 for the second control application.

<Case 1-2>
As shown on the right side of FIG. 7, in Case 1-2, the first communication means 101 cannot normally receive data within the TP1 reception window Tr1 (reception has not been completed, or reception has been completed but is still being received). error detection), the second communication means 102 normally completes reception of the degenerated data by the deadline time Tr2, and therefore the control cycle is the first degenerated mode processing. A case of executing the degenerate mode system software 230 is shown.

The operation mode determination unit 150 receives a control cycle start trigger (T) from the scheduling control unit 160 via the operation mode control interface 141 . Upon receiving the trigger (T), the operation mode determination unit 150 instructs the timers 152a and 152b to reload the initial count values (L) through the deadline notification interface 153, and at the same time changes the reception state to the reception state control interface 122. An initialization request (R) for the holding register 137 is output.

Receiving the reload (L) instruction, the deadline detection unit 151 causes the timers 152a and 152b to set predetermined values for measuring the progress of the deadline time Tr2 and the TP1 reception window Tr1, respectively, based on the beginning of the control cycle. , and instructs the start of the decrement operation. Upon receiving the initialization request (R), the reception mask control unit 136 clears all held data other than the extended reception mask setting in the reception state holding register 137 . As a result, the reception completion notifications of the first communication means 101 and the second communication means 102 become valid.

If the TP1 reception window Tr1 elapses without normal data reception being completed normally, an underflow occurs in the timer 152b, and the event information is notified to the operation mode determination unit 150 via the deadline notification interface 153. FIG. The operation mode determination unit 150 that has received the notification instructs the deadline notification interface 153 to stop the decrement operation of the timer 152 b and outputs a TP1 reception mask setting request (M) to the reception state control interface 122 . Receiving the TP1 reception mask setting request (M), the reception mask control unit 136 sets the contents of the TP1 reception mask (C101) in the reception state holding register 137 (corresponding to #13 in FIG. 4), thereby enabling TP1 reception. After the window time elapses, the setting is updated so that only the reception completion notification by the second communication means 102 is valid.

When the second reception control unit 133 normally completes receiving the degenerated data by the deadline time Tr2, the information is transmitted to the reception mask control unit 136 by the second reception state notification interface 134. FIG. The reception mask control unit 136 updates the contents of the reception state holding register 137 so as to reflect the information (corresponding to #15 in FIG. 4). Specifically, the TP reception state (completed) is switched from N to Y. At the same time, the reception mask control unit 136 outputs a reception status notification “TP2 reception completed (normal)” to the reception status control interface 122 . Since the TP1 reception mask has already been set, the reception state within the control cycle is determined.

The operation mode determination unit 150, which has been monitoring the reception state notification of the reception state control interface 122, determines transition to the first degeneration mode based on the operation mode determination flow of FIG. The scheduling control unit 160 is instructed (C) to make the transition. At the same time, the operation mode determination unit 150 instructs the deadline notification interface 153 to stop the decrement operation of the timer 152a in order to suppress the occurrence of a false underflow event.

The scheduling control unit 160 that has received the transition instruction (C) instructs the execution of the first degraded mode system software 230 through the execution control interface 162 for the first degraded mode system software.

<Case 1-3>
As shown on the right side of FIG. 8, in Case 1-3, the first communication means 101 cannot normally receive data within the TP1 reception window Tr1 (reception has not been completed, or reception has been completed but is still being received). error detection), and the second communication means 102 cannot normally complete reception of the degenerate data by the deadline time Tr2 (either reception is not completed, or reception is completed but an error is detected during reception) Therefore, this control cycle indicates the case where the second degeneracy mode system software 240, which is the processing for the second degeneracy mode, is executed.

The operation mode determination unit 150 receives a control cycle start trigger (T) from the scheduling control unit 160 via the operation mode control interface 141 . Upon receiving the trigger (T), the operation mode determination unit 150 instructs the timers 152a and 152b to reload the initial count values (L) through the deadline notification interface 153, and at the same time changes the reception state to the reception state control interface 122. An initialization request (R) for the holding register 137 is output.

Receiving the reload (L) instruction, the deadline detection unit 151 causes the timers 152a and 152b to count predetermined times for measuring the progress of the deadline time Tr2 and the TP1 reception window Tr1, respectively, based on the beginning of the control cycle. Sets the value and instructs the start of decrement operation. In addition, receiving the initialization request (R), the reception mask control unit 136 clears all contents of the reception state holding register 137 other than the extended reception mask setting, so that the first communication unit 101 and the second communication are enabled. The setting is made so that the reception completion notification in means 102 is valid.

If the TP1 reception window Tr1 elapses without normal data reception being completed normally, an underflow occurs in the timer 152b, and the event information is notified to the operation mode determination unit 150 via the deadline notification interface 153. FIG. The operation mode determination unit 150 that has received the notification instructs the deadline notification interface 153 to stop the decrement operation of the timer 152 b and outputs a TP1 reception mask setting request (M) to the reception state control interface 122 . Receiving the TP1 reception mask setting request (M), the reception mask control unit 136 sets the contents of the TP1 reception mask (C101) in the reception state holding register 137 (corresponding to #13 in FIG. 4), thereby enabling TP1 reception. After the elapse of the window Tr1, the setting is updated so that only the reception completion notification by the second communication means 102 is valid.

Furthermore, if the deadline time Tr2 elapses without the degenerate data being received normally, an underflow occurs in the timer 152a, and the event information is notified to the operation mode determination unit 150 via the deadline notification interface 153. . The operation mode determination unit 150 that has received the notification instructs the deadline notification interface 153 to stop the decrement operation of the timer 152a. In addition to this, as an additional process (not shown), a TP2 reception mask setting request may be output to the reception state control interface 122 . Upon receiving the TP2 reception mask setting request, the reception mask control unit 136 sets the contents of the TP2 reception mask (C201) in the reception state holding register 137 (corresponding to #19 in FIG. 4). After the deadline time Tr2 has passed, the setting may be updated so that the reception completion notification of both the first communication means 101 and the second communication means 102 is invalid.

The operation mode determination unit 150 determines transition to the second degeneration mode based on the operation mode determination flow of FIG. The scheduling control unit 160 that has received the transition instruction (C) instructs execution of the second degeneracy mode system software 240 through the execution control interface 163 for the second degeneracy mode system software.

Next, referring to the timing charts of FIGS. 9 to 12, the order of completion of reception by the first communication means 101 and the second communication means 102 within the control period and the execution software in the second microcomputer 20 Describe the relationship at the operational level.

<Case 2-1>
Case 2-1 shown on the left side of FIGS. 9 and 10 shows a case where the first communication means 101 normally completes reception of normal data within the TP1 reception window Tr1 prior to the second communication means 102. there is In this case, the second microcomputer 20 in the control cycle executes normal time data reception processing as part of the processing of the second control application 220 .

In Case 2-1, not only the first communication means 101 but also the second communication means 102 have normally received the degenerate data by the deadline time Tr2. However, the TP2 reception mask is set by the reception mask control section 136 when the normal reception of the first communication means 101 is completed. Therefore, the second microcomputer 20 does not execute the process of receiving degenerate data, which is unnecessary for the execution of the second control application 220 . Thereby, the load factor in the second microcomputer 20 is reduced.

<Case 2-2>
Case 2-2 shown in the center of FIG. 9 shows the case where the first communication means 101 completes reception within the TP1 reception window but detects an error during reception. In this case, the reception completion notification of the first communication means 101 is masked based on the extended reception mask setting.

On the other hand, when the second communication means 102 normally completes reception of the degenerate data by the deadline time Tr2, the reception completion notification of the second communication means 102 is not masked, and the reception state control interface 122 selects the operation mode. It is output to the control unit 140 . Therefore, the second microcomputer 20 in this control cycle executes the degeneracy data reception processing as part of the processing of the first degeneracy mode system software 230 .

In this Case 2-2, the TP1 reception mask is set when the normal reception of the second communication means 102 is completed. Therefore, even if reception is normally completed by the first communication means 101 due to retransmission processing after this time point, normal data reception processing unnecessary for execution of the first degenerate mode system software 230 is not executed. . Thereby, the load factor in the second microcomputer 20 is reduced.

<Case 2-3>
In Case 2-3 shown on the right side of FIG. 9, the first communication means 101 does not complete reception within the TP1 reception window Tr1 due to a failure in the transmission path, while the second communication means 102 degenerates by the deadline time Tr2. This shows the case where the hour data has been received normally. In this case, the second microcomputer 20 in the control cycle executes the degeneracy data reception processing as part of the processing of the first degeneracy mode system software 230 .

In this Case 2-3, the TP1 reception mask is set when the normal reception of the second communication means 102 is completed. Therefore, even if the reception of normal data is normally completed in the first communication means 101 after this time, the normal data reception processing that is unnecessary for the execution of the first degenerate mode system software 230 is executed. will not be

<Case 2-4>
Case 2-4 shown in the center of FIG. The communication means 102 also completes reception by the deadline time Tr2, but an error is detected during reception. In this case, the second microcomputer 20 in the control cycle executes normal time data reception processing as part of the processing of the second control application 220 . The second communication means 102 also completed reception by the deadline time Tr2, but an error was detected during reception. Since the TP2 reception mask is set when normal reception is completed by the first communication means 101, even if reception is normally completed on the second communication means 102 side due to retransmission processing after this time, the second control application 220 does not require reception processing of degenerate data, which is unnecessary. Thereby, the load factor in the second microcomputer 20 is reduced.

<Case 2-5>
Case 2-5 shown on the right side of FIG. Means 102 indicates a case where reception is not completed by deadline time Tr2 due to a failure in the transmission line. In this case, the second microcomputer 20 in the control cycle executes normal time data reception processing as part of the processing of the second control application 220 .

In Case 2-5, the second communication means 102 does not complete reception by the deadline time Tr2 due to a failure in the transmission line. Upon completion of normal reception by the first communication means 101, the reception mask control section 136 sets the TP2 reception mask. Even if reception is normally completed on the second communication means 102 side after this time point, reception processing of the degenerate data, which is unnecessary for execution of the second control application 220, is not executed. Thereby, the load factor in the second microcomputer 20 is reduced.

<Case 3-1>
In Case 3-1 shown on the left side of FIG. 11, the first communication means 101 completed receiving normal data within the TP1 reception window Tr1, but an error was detected during reception, and the second communication means 102 also received the deadline time. It shows a case where reception of degenerate data is completed by Tr2, but an error is detected during reception. In this case, the reception completion notification of the first communication means 101 is masked based on the extended reception mask setting.

Although the second communication means 102 also completed reception by the deadline time Tr2, since an error was detected during reception, the reception completion notification of the second communication means 102 is masked based on the extended reception mask setting. When the deadline time Tr2 elapses without any reception completion notification from either the first communication means 101 or the second communication means 102, the second microcomputer 20 in the control period undergoes the second degeneracy due to the deadline detection. Run the mode system software 240 .

<Case 3-2>
In Case 3-2 shown on the right side of FIG. 11, the first communication means 101 does not complete reception within the TP1 reception window Tr1 due to a transmission path failure, and the second communication means 102 also has a deadline time due to a transmission path failure. This shows the case where reception is not completed by Tr2. In this case, the deadline time Tr2 elapses without receiving a reception completion notification from either of the first communication means 101 and the second communication means 102 . The second microcomputer 20 in the control cycle executes the second degeneracy mode system software 240 by detecting the deadline.

<Case 4-1>
In Case 4-1 shown on the left side of FIG. 12, the first communication means 101 side precedes the second communication means 102 side even though retransmission occurs due to a transmission path failure and the reception completion timing is delayed. It shows the case where normal data reception is completed within the TP1 reception window Tr1. In addition, it is assumed that the second communication means 102 has successfully received the degenerate data by the deadline time Tr2.

In this case, the second microcomputer 20 in the control cycle executes normal time data reception processing as part of the processing of the second control application 220 . The TP2 reception mask is set when the first communication means 101 completes normal reception. Therefore, even if the second communication means 102 normally completes reception of the degenerate data by the deadline time Tr2, the reception completion notification is masked. For this reason, reception processing of data during degeneracy, which is unnecessary for execution of the second control application 220, is not executed.

<Case 4-2>
In Case 4-2 shown in the center of FIG. 12, the first communication means 101 normally receives data after the TP1 reception window Tr1 elapses due to a delay in reception completion timing caused by retransmission due to a transmission line failure. This indicates that reception has been completed. In this case, since the TP1 reception mask is set when the TP1 reception window Tr1 has passed, the normal data reception processing is not executed. On the other hand, as for the second communication means 102, it is assumed that reception of the degenerate data has been completed normally by the deadline time Tr2. In this case, the second microcomputer 20 in the control cycle executes the degeneracy data reception processing as part of the processing of the first degeneracy mode system software 230 .

<Case 4-3>
In Case 4-3 shown on the right side of FIG. 12, retransmission occurs due to a failure in the transmission line and the reception completion timing is delayed. This indicates that reception has been completed. On the other hand, as for the second communication means 102, it is assumed that reception was completed by the deadline time Tr2, but an error was detected during reception.

Since the TP1 reception mask is set when the TP1 reception window Tr1 elapses, normal data reception processing is not executed. In addition, although the second communication means 102 also completed reception by the deadline time Tr2, since an error was detected during reception, the reception completion notification of the second communication means 102 was masked based on the extended reception mask setting. be. Therefore, the deadline time Tr2 elapses without any reception completion notification from either the first communication means 101 or the second communication means 102 . Therefore, the second microcomputer 20 in the control cycle executes the second degeneracy mode system software 240 by detecting the deadline.

As described above, according to the vehicle control apparatus of the first embodiment, even when a plurality of microcomputers are redundantly connected through a plurality of interfaces, reception of unnecessary data is masked by the masked receiving section 120. Interrupted by motion. As a result, it is possible to provide a vehicle control device that can guarantee real-time communication and reduce the load factor of the arithmetic and control device.

[Second embodiment]
Next, a vehicle control device 1 according to a second embodiment of the invention will be described with reference to FIGS. 13 to 16. FIG. Since the configuration of the apparatus of the second embodiment is substantially the same as that of the first embodiment, redundant description will be omitted. However, as will be described later, since the timing control by the delay transmitting section 100 is unnecessary, the delay control of the delay transmitting section 100 is invalidated, or the delay transmitting section 100 is replaced with a normal transmitting section. obtain.

In the second embodiment, an operation mode control method that straddles a plurality of control cycles is adopted. 13 to 16 show the operation of the second microcomputer 20 when this method is adopted. Unlike the control method described in the first embodiment, FIGS. Completion notification is enabled (receive mask disabled). The operation mode determination unit 150 determines the state of reception by the first communication means 101 or the second communication means 102 in one control period, and determines the operation mode according to the result of the determination. The operation mode determined by the operation mode determination unit 150 is executed in the next control cycle (second control cycle), not in the current control cycle (first control cycle).

Therefore, in the methods of FIGS. 13 to 16, reception of normal data and degraded data may be completed within one control cycle, and the operation mode determined thereafter need not be completed within that cycle. Executed in the next control cycle. Also, the order of reception completion timings between the first communication means 101 and the second communication means 102 is irrelevant. Therefore, transmission timing control of the normal data and the degenerated data in the transmission unit 100 with delay becomes unnecessary. This method has the advantage of reducing the difficulty of timing design for allocating the processing time to each process within the control cycle in chronological order.

In the control method of the second embodiment, there are three setting patterns for the TP1/TP2 reception mask set at the beginning of the control cycle. At the start of control, a normal mode reception completion notification mask that permits reception completion notification only for normal data is set. According to this, the reception completion notification on the side of the first communication means 101 that transfers normal data is valid (disable masking), and the reception completion notification on the side of the second communication means 102 that transfers degraded data is invalid ( standby state=mask enabled). Also, the extended receive mask setting is always disabled (completion notification is enabled even when an error is detected).

Although not particularly limited, the number of timers 152 in the second embodiment may be one (only 152a). A deadline time Tr2 is defined as a time for permitting the reception process of the first communication means 101 or the second communication means 102, which is obtained by subtracting the time required for switching the TP1/TP2 reception mask described below from the control period. A count value to be measured can be set in the timer 152a.

<Case 5-1>
Case 5-1 shown on the left side of FIG. 13 is a state in which the normal mode reception completion notification mask is set, and the first communication means 101 normally completes reception of the normal data by the deadline time Tr2. The communication means 102 side of (1) also completes receiving the degenerate data normally by the deadline time Tr2. In this case, the second microcomputer 20 in the control cycle executes normal time data reception processing as part of the processing of the second control application 220 . Although the second communication means 102 has also successfully received the degenerate data by the deadline time Tr2, since the TP2 reception mask is set, the degenerate data reception process is not executed. The reception mask setting pattern for the next control cycle is not changed, and the normal mode reception completion notification mask setting is maintained.

<Case 5-2>
Case 5-2 shown in the center of FIG. 13 is a state in which the normal mode reception completion notification mask is set, and the first communication means 101 side has completed reception by the deadline time Tr2, but an error was detected during reception. indicates the case. In this case, the second microcomputer 20 in the control cycle sends the reception mask setting pattern of the next control cycle as the first error processing, which is a part of the second control application 220, to the first degenerate mode reception completion notification. set to mask. According to this, the reception completion notification of the first communication means 101 is changed to be invalid (blockage=mask valid and re-release prohibited), and the reception completion notification of the second communication means 102 is valid (standby state canceled=mask invalid). ). Although the second communication means 102 normally completes reception of the degenerated data by the deadline time Tr2 of the control cycle, since the TP2 reception mask is set, the reception processing of the degenerated data is not executed. Absent.

<Case 5-3>
In Case 5-3 shown on the right side of FIG. 13, Case 5-2 occurs and the first degenerate mode reception completion notification mask is set, and the second communication means 102 does not receive the message by deadline time Tr2 in the next control cycle. It shows the processing when reception of degenerate data is completed normally. In this case, the second microcomputer 20 in the next control cycle executes the degeneracy data reception processing as part of the processing of the first degeneracy mode system software 230 . Furthermore, the reception mask setting pattern for the next control period is not changed, and the first reception completion notification mask setting for degenerate mode is maintained.

<Case 5-4>
In Case 5-4 shown in FIG. 14, Case 5-2 occurs and the first degenerate mode reception completion notification mask is set, and the second communication means 102 side receives by the deadline time Tr2 in the control cycle. This indicates the case where the data is completed but an error is detected during reception in the next control cycle. In this case, the second microcomputer 20 in the control cycle changes the reception mask setting pattern for the next control cycle to the Set to receive completion notification mask. With this mask, the reception completion notification on the first communication means 101 side is kept invalid (blockage = mask valid and re-release prohibited), and the reception completion notification on the second communication means 102 side is also invalid (blockage = mask valid and re-release prohibited). As is clear from the description of Cases 5-3 and 5-4, in the second embodiment, the degeneracy level is changed according to the severity of the failure.

<Case 5-5>
Case 5-5 shown in FIG. 14 shows the processing in the next control cycle when the second degenerate mode reception completion notification mask is set in Case 5-4. In this case, the second degeneracy-mode system software 240 is executed without waiting for the reception of the normal data or the degeneracy data to be completed. Although not particularly limited, by canceling the blocking of the first communication means 101/second communication means 102 as a part of the predetermined initialization processing targeting the entire vehicle control device 1 or the second microcomputer 20 , it may be possible to return to the setting state of the reception completion notification mask for normal mode.

<Case 5-6>
In Case 5-6 shown in FIG. 15, the reception completion notification mask for normal mode is set after Case 5-1 occurs, but the reception completion notification of the first communication means 101 is not performed in the next control cycle. It shows a case where the deadline time Tr2 has passed. In this case, the second microcomputer 20 in the control period receives the deadline notification from the deadline notification interface 153 as a first error process, which is a part of the second control application 220. After confirming that the reception on the 101 side is incomplete, the reception mask setting pattern for the next control period is changed to the first reception completion notification mask for degenerate mode. Although the second communication means 102 has successfully received the degenerate data by the deadline time Tr2, the degenerate data reception process is not executed because the TP2 reception mask is set.

<Case 5-7>
In Case 5-7 shown in FIG. 15, after the occurrence of Case 5-1 and Case 5-6, the second communication means 102 side is set to the deadline time Tr2 while the first degenerate mode reception completion notification mask is set. shows the case where reception of degenerate data is completed normally. The second microcomputer 20 in this control cycle executes a degeneracy data reception process as part of the processing of the first degeneracy mode system software 230 . Furthermore, the reception mask setting pattern for the next control period is not changed, and the first reception completion notification mask setting for degenerate mode is maintained.

<Case 5-8>
In Case 5-8 shown in FIG. 16, after Case 5-6 occurs following Case 5-1, the first degenerate mode reception completion notification mask is set, and in the next control period, the second communication means 102 side This shows the case where the deadline time Tr2 has passed without receiving the reception completion notification. In this case, the second microcomputer 20 in the control period receives the deadline notification from the deadline notification interface 153 as a second error process, which is part of the first degeneracy mode system software 230 . After confirming that the reception on the side of the communication means 102 is incomplete, the reception mask setting pattern for the next control period is changed to the second degenerate mode reception completion notification mask. Thus, in the second embodiment, it is possible to appropriately change the degeneracy level according to the severity of the failure.

<Case 5-9>
After Case 5-8, Case 5-9 shown on the right side of FIG. 16 is executed. In Case 5-9, since the second degeneracy mode reception completion notification mask is set, the second degeneracy mode system software 240 is executed without waiting for the completion of reception of normal data or degeneracy data. . Although not particularly limited, by canceling the blocking of the first communication means 101/second communication means 102 as a part of the predetermined initialization processing targeting the entire vehicle control device 1 or the second microcomputer 20 , it may be possible to return to the setting state of the reception completion notification mask for normal mode.

Although embodiments of the present invention have been described above, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, replacements, and modifications can be made without departing from the scope of the invention. These embodiments and modifications thereof are included in the scope and gist of the invention, and are included in the scope of the invention described in the claims and equivalents thereof. Components described in the embodiments may be implemented by hardware or by software.

DESCRIPTION OF SYMBOLS 1... Vehicle control apparatus 10... 1st microcomputer 20... 2nd microcomputer 100... Delay transmission part 101... 1st communication means (TP1)
102...Second communication means (TP2)
REFERENCE SIGNS LIST 110: transmission trigger control unit 111: timers 112, 113: transmission trigger interface 114: first transmission buffer 115: first transmission data interface 116: second transmission buffer 117: second transmission data interface 118: first Transmission control unit 119 Second transmission control unit 120 Masked reception unit 121 Reception interface 122 Reception state control interface 130 First reception control unit 131 First reception state notification interface 132 First Reception data interface 133 Second reception controller 134 Second reception status notification interface 135 Second reception data interface 136 Reception mask controller 137 Reception status holding register 138 First reception buffer 139 Second 2 reception buffer 140 operation mode control unit 141 operation mode control interface 150 operation mode determination unit 151 deadline detection units 152, 152a, 152b timer 153 deadline notification interface 160 scheduling control units 161 to 163 Execution control interface 210 First control application 211 Transmission interface 220 Second control application 230 First degeneracy mode system software 240 Second degeneracy mode system software 900 Microcomputer 901 Ethernet adapter 902 Connection port 903 Ethernet cable 910 Ethernet switch 911 Control table 912 Switch matrix control interface 913 Switch matrix 914, 914a, 914b, 914c, 914d, 914e, 914f, 914g, 914h Switch connection ports 915-1, 915 -2...Ethernet cable

Claims (8)

a first communication means for connecting the first arithmetic and control unit and the second arithmetic and control unit and transmitting and receiving the first data;
a second communication means for connecting the first arithmetic and control unit and the second arithmetic and control unit and transmitting and receiving second data different from the first data;
connected to the first communication means and the second communication means, and receiving with a mask for masking the receiving operation of the other when one of the first data and the second data is normally received; and a communication control device. 2. The communication control device according to claim 1, further comprising a transmitter with delay for controlling transmission timing so that said first data is received by said second arithmetic and control device prior to said second data. 3. The communication control device according to claim 1, further comprising an operation mode control unit for switching an operation mode to which said second arithmetic control unit should transition based on at least the state of said masked reception unit. 4. The communication control device according to claim 3, wherein said operation mode control unit is configured to determine a state of reception by said first communication means or said second communication means for each control cycle and switch the operation mode. . The operation mode control unit is configured to measure a first elapsed time and a second elapsed time longer than the first elapsed time for each control cycle,
The operation mode control unit is configured to change the mask in the reception unit with mask when reception of the first data or the second data is not completed during the first elapsed time or the second elapsed time. 4. The communication controller of claim 3, configured to switch states. The operation mode control unit switches the operation mode to a first degenerate mode when either one of the first data and the second data cannot be received within the first elapsed time. ,
If neither the first data nor the second data can be received during the second elapsed time, switching the operation mode to a second degeneration mode different from the first degeneration mode; The communication control device according to claim 5. The operation mode control unit determines an operation mode according to a state of reception by the first communication means or the second communication means in a first control period, and determines an operation mode in a second control period following the first control period. 4. The communication control device according to claim 3, which executes the operation mode determined in . Claims 1 to 7, wherein the second data is part of the first data, or digest data generated from part or all of the first data according to a predetermined algorithm. The communication control device according to any one of the items.

Images