JP7547896B2 - Vehicle control device, vehicle control system, and access right management program - Google Patents

Description

The present invention relates to a vehicle control device, a vehicle control system, and an access right management program.

In an in-vehicle environment, the need to store various data within the vehicle is increasing due to legal requirements and the increasing need for image analysis. However, a configuration in which dedicated storage is provided separately for the electronic control device installed in the vehicle is not efficient in terms of cost, installation space, centralized data management, etc. For these reasons, a configuration in which shared storage is provided to be shared by multiple applications is envisioned. A configuration in which shared storage is provided is advantageous in terms of cost, installation space, centralized data management, etc., but when an application executes a task of writing or reading data to the shared storage, it is necessary to manage access rights from the application. For example, Patent Document 1 discloses a configuration in which a priority is set for the task executed by the application, interrupt processing is performed according to the set priority, real-time performance is ensured, and further, the interrupt processing prevents overwriting of the same memory area.

JP 2002-278779 A

However, in a configuration in which interrupt processing is performed according to priority as in Patent Document 1, if there is a task that requires the periodic writing of data, such as a trace log for autonomous driving, and a task with a higher priority than that task interrupts, the task that requires the periodic writing of data will be interrupted. If the priority of a task that requires the periodic writing of data is set to the highest, other tasks will not be able to be executed.

The present invention has been made in consideration of the above circumstances, and its purpose is to provide a vehicle control device, a vehicle control system, and an access rights management program that can appropriately balance the execution of tasks that require periodic access to shared storage with the execution of other tasks.

According to the invention described in claim 1, the system includes a shared storage (9) shared by a plurality of applications, and an access right management unit (14) that divides one time slot into a static area corresponding to an access request from the application by a time trigger method and a dynamic area corresponding to an access request from the application by an event trigger method, and assigns an access right from the application to either the static area or the dynamic area. When an application that should access the shared storage at the timing of the dynamic area accesses the shared storage at the timing of the static area, the access right management unit notifies the application of the timing of the next dynamic area. By providing a static area and a dynamic area within one time slot, a task that requires periodic access to the shared storage can be executed within the time of the static area, and other tasks, such as a task that does not require periodic access but has a higher priority than others, or a task that requires irregular access regardless of priority, can be executed within the time of the dynamic area. This makes it possible to appropriately balance the execution of a task that requires periodic access to the shared storage with the execution of other tasks.

Functional block diagram showing one embodiment. Diagram showing time slots Diagram showing multiple consecutive time slots Diagram showing time slots Process flow diagram Process flow diagram Process flow diagram Process flow diagram Process flow diagram Diagram showing time slots Diagram showing time slots Diagram showing time slots Diagram showing time slots Diagram showing time slots Diagram showing time slots Diagram showing time slots Diagram showing time slots Diagram showing time slots Diagram showing multiple consecutive time slots Diagram showing multiple consecutive time slots Diagram showing multiple consecutive time slots

An embodiment will be described below with reference to the drawings. In the following description, the term "app" refers to software in general for causing an electronic control device or a vehicle control device to execute a predetermined operation, and in a broad sense also includes the concepts of threads and modules. As shown in FIG. 1, a vehicle control system 1 mounted on a vehicle has two electronic control devices (hereinafter referred to as ECUs: Electronic Control Units) 2 and 3, and one integrated ECU 4 for integrally managing the ECUs 2 and 3, and is configured so that the ECUs 2 and 3 and the integrated ECU 4 can communicate data with each other via a bus 5. The integrated ECU 4 corresponds to a vehicle control device. The bus 5 is, for example, CAN (Controller Area Network) (registered trademark), LIN (Local Interconnect Network) (registered trademark), CXPI (Clock Extension Peripheral Interface) (registered trademark), FlexRay (registered trademark), MOST (Media Oriented Systems Transport) (registered trademark), etc. In this embodiment, two ECUs are illustrated as being connected to the integrated ECU 4 via the bus 5 so that data communication can be performed, but one or three or more ECUs may be connected.

The integrated ECU 4 has a bus communication unit 6, a first control unit 7, a second control unit 8, and a shared storage 9. The bus communication unit 6 performs data communication with the bus 5. The first control unit 7 is composed of a microcomputer having a CPU (Central Processing Unit), ROM (Read Only Memory), RAM (Random Access Memory), and I/O (Input/Output).

The first control unit 7 executes a control program stored in a non-transitive substantial storage medium to execute processing corresponding to the control program, and cooperates with the second control unit 8 as necessary to control the overall operation of the integrated ECU 4. The first control unit 7 manages the operation of the apps 4a to 4c implemented in the integrated ECU 4, and executes the apps 4a to 4c when a request to start the apps 4a to 4c occurs. The apps 4a to 4c whose operation is managed by the first control unit 7 correspond to apps belonging to a first group, and although three apps 4a to 4c are exemplified in this embodiment, the number may be two or less, or four or more. The control programs executed by the first control unit 7 include an access rights management program.

The second control unit 8, like the first control unit 7, is configured with a microcomputer having a CPU, ROM, RAM, and I/O. The second control unit 8 executes a process corresponding to a control program stored in a non-transitive substantial storage medium by executing the control program, and cooperates with the first control unit 7 as necessary to control the overall operation of the integrated ECU 4. The second control unit 8 manages the operation of the apps 4d to 4f implemented in the integrated ECU 4, and executes the apps 4d to 4f when a request to start the apps 4d to 4f occurs. The apps 4d to 4f whose operation is managed by the second control unit 8 correspond to apps belonging to the second group, and although three apps 4d to 4f are exemplified in this embodiment, the number may be two or less, or four or more.

The ECU 2 has a bus communication unit 10 and a control unit 11. The bus communication unit 10 communicates data with the bus 5. The control unit 11 is composed of a microcomputer having a CPU, ROM, RAM, and I/O. The control unit 11 executes a control program stored in a non-transitive physical storage medium to execute processing corresponding to the control program and control the overall operation of the ECU 2. The control unit 11 manages the operation of an app 2a implemented in the ECU 2, and executes the app 2a when a request to start the app 2a occurs. In this embodiment, the control unit 11 manages the operation of one app, app 2a, but may manage two or more apps.

The ECU 3 has a bus communication unit 12 and a control unit 13. The bus communication unit 12 communicates data with the bus 5. The control unit 13 is composed of a microcomputer having a CPU, ROM, RAM, and I/O. The control unit 13 executes a control program stored in a non-transient physical storage medium to execute processing corresponding to the control program and control the overall operation of the ECU 3. The control unit 13 manages the operation of an app 3a implemented in the ECU 3, and executes the app 3a when a request to start the app 3a occurs. In this embodiment, the control unit 13 manages the operation of one app 3a, but may manage two or more apps.

The apps 2a, 3a, 4a to 4f are, for example, apps that control the body system, apps that control the powertrain system, apps that control the gateway system, and the like, and are apps that perform various controls related to the vehicle. The shared storage 9 is a storage medium with a predetermined data capacity for storing various data. The shared storage 9 is not, for example, a volatile storage medium such as a RAM, but a non-volatile storage medium such as an HDD (Hard Disk Drive), and is different from the storage medium in which the above-mentioned control programs are stored.

The apps 4a to 4c implemented in the integrated ECU 4 access the shared storage 9 via the first control unit 7 inside the integrated ECU 4, and execute tasks such as writing and reading data to the shared storage 9. The apps 4d to 4f implemented in the integrated ECU 4 access the shared storage 9 via the second control unit 8 and the first control unit 7 by data communication between the first control unit 7 and the second control unit 8 inside the integrated ECU 4, and execute tasks such as writing and reading data to the shared storage 9. The apps 2a and 3a implemented in the ECUs 2 and 3 each access the shared storage 9 via the bus 5, and execute tasks such as writing and reading data to the shared storage 9.

The above configuration is advantageous in terms of cost, installation space, and centralized data management, because the apps 2a, 3a, 4a-4f share the shared storage 9 and each of the apps 2a, 3a, 4a-4f accesses the shared storage 9 of the integrated ECU 4, rather than providing dedicated storage for the ECUs 2 and 3. In other words, a configuration in which dedicated storage is provided for each of the ECUs 2 and 3 would result in the ECUs 2 and 3 becoming expensive and larger in size, and would complicate data management when data is shared between the ECUs 2 and 3 and the integrated ECU 4, and the impact of these problems increases the more ECUs there are. In this embodiment, providing the shared storage 9 makes it possible to avoid the occurrence of such problems.

The types of tasks executed by apps 2a, 3a, 4a to 4f include tasks that require regular access to the shared storage 9, i.e., tasks that require regular writing and reading of data, tasks that do not require regular access to the shared storage 9 but have a higher priority, i.e., tasks that do not require regular writing or reading of data but should be given priority over other tasks when an event occurs, and tasks that require irregular access to the shared storage 9 regardless of priority, i.e., tasks that require irregular writing and reading of data regardless of priority.

Tasks that require periodic writing and reading of data include, for example, a task that writes data such as an autonomous driving trace log, and a task that writes data such as a security detection monitoring log. Tasks that do not require periodic writing or reading of data but should prioritize data writing and reading over other tasks when an event occurs, and tasks that require irregular access to the shared storage 9 regardless of priority include, for example, a task that writes video data and vehicle speed data when detecting an obstacle and controlling collision avoidance, and a task that writes abnormality data when an external electronic attack is detected. In this case, the data capacity of the data that is written or read by each task through access to the shared storage 9 can be any size.

The first control unit 7 has an access right management unit 14 that assigns access rights to the shared storage 9 from multiple applications. As shown in FIG. 2, the access right management unit 14 divides one time slot into a static area (Static Segment), a dynamic area (Dynamic Segment), and a buffer area (Buffer), and assigns access rights to the shared storage 9 from multiple applications to either the static area or the dynamic area (corresponding to an assignment procedure). The static area is an area that corresponds to an access request from an application by a time trigger method, and is an area that secures access rights to the shared storage 9 from a specific application at a fixed cycle timing. The dynamic area is an area that corresponds to an access request from an application by an event trigger method, and is an area that secures access rights to the shared storage 9 from a specific application at the timing of each request from the application. The buffer area is an area for adjustment, idling, etc. Note that, in FIG. 2, the time width of one time slot is exemplified as 1 to 5 milliseconds, but it may be set in advance to a value other than 1 to 5 milliseconds.

By dividing one time slot into a static area, a dynamic area, and a buffer area in this manner, the access right management unit 14 periodically reserves a static area, a dynamic area, and a buffer area in a number of consecutive time slots, as shown in FIG. 3. In other words, the access right management unit 14 is able to periodically grant both time-triggered access requests and event-triggered access requests from an app.

The access right management unit 14 can variably set the time width of the time slot, and can variably set the time widths of the static area, dynamic area, and buffer area within the time slot. The time width of the time slot and the time widths of the static area, dynamic area, and buffer area within the time slot may be changed, for example, by a diagnostic tool or the like being wired connected to the integrated ECU 4 via the bus 5 and a change instruction signal transmitted from the diagnostic tool being received by the integrated ECU 4, or by a server being wirelessly connected to the integrated ECU 4 via a communication network and a change instruction signal transmitted from the server being received by the integrated ECU 4.

Next, the operation of the above-mentioned configuration will be described with reference to Figs. 4 to 21. Here, it is assumed that apps A and B are apps that execute tasks that require constant writing and reading of data, and app C is an app that executes a task that does not require constant writing and reading of data but has a higher priority than the others when an event occurs. Apps A to C may be any of app 2a implemented in ECU 2, app 3a implemented in ECU 3, and apps 4a to 4f implemented in integrated ECU 4. In this case, the access right management unit 14 assigns the access rights to the shared storage 9 from apps A to C so as to include the static areas of apps A and B, as shown in Fig. 4.

As shown in FIG. 5 etc., the access right management unit 14 transmits timing notifications indicating the timing of the static area to apps A and B (S1, S2). When app A receives the timing notification of the static area from the access right management unit 14, it sets the access timing to the shared storage 9 according to the received timing notification of the static area, and when the access timing setting is completed, it sends a setting completion notification to the access right management unit 14 (S3). When app B receives the timing notification of the static area from the access right management unit 14, like app A, it sets the access timing to the shared storage 9 according to the received timing notification of the static area, and when the access timing setting is completed, it sends a setting completion notification to the access right management unit 14 (S4).

When the access timing set by app A arrives, i.e., when access rights to shared storage 9 are granted, app A sends an access request to shared storage 9 to access right management unit 14 (S5). Access right management unit 14 monitors the reception of an access request to shared storage 9 from any app, and when it detects the reception of an access request to shared storage 9 from app A, it permits the access request from app A and sends an access permission notification to app A since the timing of the detection of the access request is within the time allocated to app A as a static area (S6).

When app A receives an access permission notification from the access right management unit 14, it executes a task of writing or reading data to the shared storage 9 (S7). The access right management unit 14 monitors the progress of the data writing or reading task, and when the task is completed, it sends a task completion notification to app A (S8). Note that if the task is not completed and the time of the static area allocated to app A has elapsed, the access right management unit 14 forcibly terminates the writing or reading of data from the shared storage 9 by app A. After this, app A monitors the next access timing, and when the next access timing arrives, it repeats the above process and periodically executes the task of writing or reading data to the shared storage 9.

In the above, it has been explained that an access request from app A to the shared storage 9 occurs within the time allocated to app A as a static area. However, due to factors such as a synchronization error within the system, an access request from app A to the shared storage 9 may occur within the time allocated to app B as a static area. In such a case, the access right management unit 14 prohibits the access request from app A and sends an access prohibition notification to app A.

When the access timing set by app B arrives, i.e., when the access right to the shared storage 9 is granted, app B sends an access request to the shared storage 9 to the access right management unit 14 (S9). The access right management unit 14 monitors the reception of an access request to the shared storage 9 from any app, and when it detects the reception of an access request to the shared storage 9 from app B, the access right management unit 14 permits the access request from app B and transmits an access permission notification to app B, since the timing of the detection of the reception of the access request is within the time allocated to app B as a static area (S10).

When app B receives an access permission notification from the access right management unit 14, it executes a task of writing or reading data to the shared storage 9 (S11). The access right management unit 14 monitors the progress of the data writing or reading task, and when the task is completed, it sends a task completion notification to app B (S12). In this case as well, if the task is not completed and the time of the static area allocated to app B has elapsed, the access right management unit 14 forcibly terminates the writing or reading of data from app B to the shared storage 9. After this, app B, like app A, also monitors the next access timing, and when the next access timing arrives, repeats the above process and periodically executes the task of writing or reading data to the shared storage 9.

In this case, too, it is possible that an access request from app B to the shared storage 9 occurs within the time allocated to app A as a static area due to factors such as a synchronization error within the system. In that case, the access right management unit 14 prohibits the access request from app B and sends an access prohibition notification to app B.

When an event occurs, app C sends an access request for the shared storage 9 to the access right management unit 14 (S13). The access right management unit 14 monitors the reception of an access request for the shared storage 9 from any app, and when it detects the reception of an access request for the shared storage 9 from app C, as shown in FIG. 5, if the timing at which it detects the reception of the access request is in a dynamic area, it permits the access request from app C and sends an access permission notification to app C (S14).

When application C receives the access permission notification from the access right management unit 14, it executes the task of writing and reading data to the shared storage 9 (S15). The access right management unit 14 monitors the progress of the data writing and reading task, and when the task is completed, it sends a task completion notification to application C (S16). In this case, too, if the task is not completed and the time in the dynamic area has elapsed, the access right management unit 14 forcibly terminates the writing and reading of data from application C to the shared storage 9. After this, application C monitors the occurrence of the next event, and when the next event occurs, it repeats the above process and sends an access request to the shared storage 9 to the access right management unit 14. In addition, the access right management unit 14 performs the same process for access requests to the shared storage 9 from applications A to C in the next time slot period (S17, S18, S19, S20, ...)

In response to this, as shown in FIG. 6, if the timing at which the access rights management unit 14 detects receipt of an access request from app C to the shared storage 9 is not in a dynamic area, the access rights management unit 14 prohibits the access request from app C and sends an access prohibition notification to app C (S21).

When app C receives an access denial notification from the access right management unit 14, it does not execute tasks such as writing or reading data to the shared storage 9. In this case, when app C receives an access denial notification from the access right management unit 14, it may invalidate the occurrence of the event and wait for the next event to occur. Alternatively, app C may continue to validate the occurrence of the event and immediately thereafter resend an access request to the access right management unit 14, i.e., it may retry sending the access request.

Also, as shown in FIG. 7, the access right management unit 14 may prohibit an access request from app C and notify app C of the timing of the next dynamic area when sending an access prohibition notification to app C (S31). When app C is notified of the timing of the next dynamic area by the access right management unit 14, it sends an access request to the access right management unit 14 at the notified timing of the next dynamic area (S32). When the access right management unit 14 detects receipt of an access request to the shared storage 9 from app C, the access right management unit 14 permits the access request from app C since the timing at which it detected receipt of the access request is a dynamic area and sends an access permission notification to app C (S33). After this, when app C receives an access permission notification from the access right management unit 14, it executes a task of writing or reading data to the shared storage 9 (S34).

For example, as shown in FIG. 8, app A transmits an allocation change request to the access right management unit 14 (S41). When the access right management unit 14 detects receipt of an allocation change request for the shared storage 9 from app A, it determines whether the time width of the static area allocated to app A can be changed.

When the access right management unit 14 determines that the time width of the static area allocated to app A can be changed, it permits the allocation change request from app A, sends a change permission notification to app A (S42) as shown in FIG. 8, and changes the time width of the static area of app A in the next time slot. On the other hand, when the access right management unit 14 determines that the time width of the static area allocated to app A cannot be changed, it prohibits the allocation change request from app A, sends a change prohibition notification to app A (S43) as shown in FIG. 9, and leaves the time width of the static area of app A in the next time slot the same as the current time width without changing it.

When changing the time width of the static area allocated to app A, the time width may be decreased or increased. To be more specific, for example, if app A requests a decrease in the time width of the static area, the access right management unit 14 determines that the time width of the static area allocated to app A can be changed because the current static area, dynamic area, and buffer area of app B can be maintained even if the time width of the static area of app A is decreased. In this case, the access right management unit 14 may decrease the time width of one time slot according to the decrease in the time width of the static area of app A, or may maintain the time width of one time slot and allocate the decrease in the time width of the static area of app A to the static area, dynamic area, or buffer area of app B.

That is, as shown in FIG. 10, the access right management unit 14 may reduce the time width of one time slot according to the reduction in the time width of the static area of the application A, and maintain the time widths of the static area, dynamic area, and buffer area of the application B. As shown in FIG. 11, the access right management unit 14 may allocate the reduction in the time width of the static area of the application A to the static area of the application B while maintaining the time width of one time slot. As shown in FIG. 12 and FIG. 13, the access right management unit 14 may allocate the reduction in the time width of the static area of the application A to the dynamic area while maintaining the time width of one time slot. In this case, one dynamic area may be divided and allocated within one time slot, or may be allocated collectively. As shown in FIG. 14, the access right management unit 14 may allocate the reduction in the time width of the static area of the application A to the buffer area while maintaining the time width of one time slot. Note that when the access right management unit 14 changes the position of the static area of the application B within one time slot, it is necessary to transmit a timing notification indicating the timing of the static area again to the application B.

On the other hand, if app A requests an increase in the time width of the static area, for example, the access rights management unit 14 determines that increasing the time width of app A's static area may affect other areas, and therefore determines that the time width of the static area assigned to app A can be changed if there is no possibility of affecting other areas, and determines that the time width of the static area assigned to app A cannot be changed if there is a possibility of affecting other areas.

That is, as shown in FIG. 15, the access right management unit 14 may increase the time width of one time slot in accordance with the increase in the time width of the static area of app A, and may determine that the time width of the static area assigned to app A can be changed if the time widths of the static area, dynamic area, and buffer area of app B can be maintained. As shown in FIG. 16, the access right management unit 14 may determine that the time width of the static area assigned to app A can be changed if the increase in the time width of the static area of app A can be supplemented with the buffer area while maintaining the time width of one time slot. On the other hand, the access right management unit 14 may determine that the time width of the static area assigned to app A cannot be changed if the increase in the time width of the static area of app A cannot be supplemented with the buffer area while maintaining the time width of one time slot.

As shown in FIG. 17, the access right management unit 14 may determine that the time width of the static area assigned to app A can be changed if the increase in the time width of the static area of app A can be supplemented by the static area of app B while maintaining the time width of one time slot. On the other hand, the access right management unit 14 may determine that the time width of the static area assigned to app A cannot be changed if the increase in the time width of the static area of app A cannot be supplemented by the static area of app B while maintaining the time width of one time slot.

As shown in FIG. 18, the access right management unit 14 may determine that the time width of the static area assigned to the app A can be changed if the increase in the time width of the static area of the app A can be supplemented with a dynamic area while maintaining the time width of one time slot. On the other hand, the access right management unit 14 may determine that the time width of the static area assigned to the app A cannot be changed if the increase in the time width of the static area of the app A cannot be supplemented with a dynamic area while maintaining the time width of one time slot.

In addition, although Figures 8 and 9 show an example in which an allocation change request from app A to the shared storage 9 is received in the buffer area, the allocation change request may be received in the static area of app A. In addition, if the period during which the time width of the static area is changed or the number of accesses is limited, at least one of the access right management unit 14 and app A may manage the period during which the time width of the static area is changed or the number of accesses, and manage the period during which the allocation change request is valid or the number of accesses.

Any of apps A to C may send an allocation change request to the access right management unit 14. That is, app C, which executes a task with a higher priority than the others, may send an allocation change request to the access right management unit 14. In this case, by reducing the time width of the dynamic region, the reduced amount may be allocated to either the static region or the buffer region of app A or app B, or by increasing the time width of the dynamic region, the increased amount may be compensated for by either the static region or the buffer region of app A or app B.

In the above configuration, when the apps 2a and 3a implemented in the ECUs 2 and 3 execute tasks to write and read data to the shared storage 9 via the bus 5, even when access rights to the shared storage 9 are granted, if the communication bandwidth of the bus 5 is used for other data communication, it is expected that problems such as the inability to execute or delays in executing the data writing and reading tasks may occur. In order to prevent such problems from occurring, if the app that executes the task of writing and reading data to the shared storage 9 via the bus 5 is an app that requires regular access to the shared storage 9, it is desirable to reserve the communication bandwidth of the bus 5 in the vehicle control system 1 according to the data capacity. In addition, for example, if the bus 5 is a bus that employs a time-triggered protocol such as FlexRay, it is desirable to synchronize the timing of data communication between the app and the bus 5 with the timing of data communication between the shared storage 9 and the bus 5.

Although the above describes a case where the same area is allocated in multiple consecutive time slots, the allocated areas may be different. As shown in FIG. 19, the access right management unit 14 may allocate the access right from app A to the static area of the first time slot and the access right from app B to the static area of the second time slot in multiple consecutive time slots, and may periodically repeat the first time slot and the second time slot.

In a situation where it is expected that the data volume per access to app C is relatively large and irregular, the access right management unit 14 may assign the access rights from app A and app B to the static area of the first time slot, the access rights from app A and app B to the static area of the second time slot, and the static area is not assigned to the third time slot to secure a large dynamic area, and cyclically repeat the first time slot to the third time slot, as shown in FIG. 20. In a situation where it is expected that the data volume per access to app C is relatively large and irregular, the access right management unit 14 may assign the access rights from app A to the static area of the first time slot, the access rights from app B to the static area of the second time slot, and the static area is not assigned to the third time slot to secure a large dynamic area, and cyclically repeat the first time slot to the third time slot, as shown in FIG. 21.

As described above, according to this embodiment, the following advantageous effects can be obtained. In the integrated ECU 4, one time slot is divided to include a static area and a dynamic area, and access rights from an application to the shared storage 9 shared by multiple applications are assigned to either the static area or the dynamic area. By executing a task that requires periodic access to the shared storage 9 within the time of the static area, and executing other tasks within the time of the dynamic area, it is possible to appropriately balance the execution of a task that requires periodic access to the shared storage 9 with the execution of other tasks. In other words, in the vehicle control system 1, it is possible to appropriately coexist the execution of a task that requires periodic access to the shared storage 9 with the execution of other tasks.

In addition, in the integrated ECU 4, the time width of the time slot and the time width of the static and dynamic regions within the time slot can be variably set. This allows appropriate response to the frequency of access requests from apps, data transfer speed, and increases/decreases in data capacity. For example, if the cycle of access requests from apps that require regular access to the shared storage 9 is relatively short, the time width of the time slot can be set relatively short, while if the cycle of the access requests is relatively long, the time width of the time slot can be set relatively long to appropriately respond. For example, if the number of access requests from apps that require regular access to the shared storage 9 has increased or is expected to increase, the time width of the static region can be increased, while if the access requests have decreased or are expected to decrease, the time width of the static region can be decreased to appropriately respond. For example, if the number of access requests from apps with higher priority than others has increased or is expected to increase, the time width of the dynamic region can be increased, while if the access requests have decreased or are expected to decrease, the time width of the dynamic region can be decreased to appropriately respond.

In addition, in the integrated ECU 4, one time slot is divided into a static area and a dynamic area to include a buffer area. By changing the time width of the buffer area without changing the time width of the time slot, the time widths of the static area and the dynamic area can be flexibly changed. By providing part or all of the buffer area to the static area, the time width of the static area can be increased without changing the time width of the dynamic area. By providing part or all of the buffer area to the dynamic area, the time width of the dynamic area can be increased without changing the time width of the static area.

In addition, the integrated ECU 4 allows the time width of the buffer area to be variably set. This increases the degree of freedom when changing the time width of the static area and the dynamic area while ensuring the time width provided to the static area and the dynamic area. By setting the time width of the buffer area relatively short, the time width of the static area and the dynamic area can be ensured relatively long during normal times, while by setting the time width of the buffer area relatively long, the time width of the static area and the dynamic area can be appropriately ensured during an emergency when it becomes necessary to increase the time width of the static area and the dynamic area.

In addition, in the integrated ECU 4, when an app accesses the shared storage 8 via the bus 5, the timing of data communication between the app and the bus 5 is synchronized with the timing of data communication between the shared storage 9 and the bus 5. When an app executes a task of writing or reading data to the shared storage 9 via the bus 5, it is possible to prevent problems such as the data writing or reading task becoming impossible or being delayed, and the task can be executed appropriately.

Although the present disclosure has been described with reference to the embodiment, it is understood that the disclosure is not limited to the embodiment or structure. The present disclosure also encompasses various modifications and modifications within the scope of equivalents. In addition, various combinations and forms, as well as other combinations and forms including only one element, more than one element, or less than one element, are also within the scope and concept of the present disclosure.

The control unit and the method described in the present disclosure may be realized by a dedicated computer provided by configuring a processor and memory programmed to execute one or more functions embodied in a control program. Alternatively, the control unit and the method described in the present disclosure may be realized by a dedicated computer provided by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the control unit and the method described in the present disclosure may be realized by one or more dedicated computers configured by combining a processor and memory programmed to execute one or more functions with a processor configured with one or more hardware logic circuits. In addition, the control program may be stored in a computer-readable non-transient tangible recording medium as instructions executed by the computer.

In the drawing, 1 is a vehicle control system, 2 and 3 are electronic control units, 4 is an integrated ECU (vehicle control unit), 7 is a first control unit, 8 is a second control unit, 9 is a shared storage, and 14 is an access right management unit.

Claims (14)

Shared storage for multiple apps (9)
an access right management unit (14) that divides one time slot to include a static area corresponding to an access request from the application by a time trigger method and a dynamic area corresponding to an access request from the application by an event trigger method, and assigns an access right from the application to the shared storage to either the static area or the dynamic area ;
The access right management unit notifies an application of the timing of the next dynamic area when the application should access the dynamic area at the timing of the static area . The vehicle control device according to claim 1, wherein the access right management unit targets at least one of a plurality of consecutive time slots, divides the targeted time slot to include the static area and the dynamic area, and assigns the access right from the application to the shared storage to either the static area or the dynamic area. The vehicle control device according to claim 1 or 2, wherein the access right management unit assigns an access right from a first application that executes a first task that requires periodic access to the shared storage to the static area. 4. The vehicle control device according to claim 3, wherein the access right management unit assigns to the dynamic area access rights from a second application that executes a second task that does not require periodic access to the shared storage but has a higher priority than the first task, or that requires irregular access regardless of priority. A first control unit (7) that manages the operation of an application belonging to a first group, and a second control unit (8) that manages the operation of an application belonging to a second group,
A vehicle control device as described in any one of claims 1 to 4, wherein the access right management unit is provided in the first control unit, and assigns access rights to the shared storage from apps belonging to the first group to either the static area or the dynamic area, and assigns access rights to the shared storage from apps belonging to the second group to either the static area or the dynamic area by data communication between the first control unit and the second control unit. A vehicle control device as claimed in any one of claims 1 to 5, wherein the access right management unit is capable of variably setting the time width of the time slot. A vehicle control device as described in any one of claims 1 to 6, wherein the access right management unit is capable of variably setting the time width of at least one of the static region and the dynamic region. A vehicle control device as described in any one of claims 1 to 7, wherein the access right management unit divides a time slot to include a buffer area in addition to the static area and the dynamic area. The vehicle control device according to claim 8, wherein the access right management unit is capable of variably setting the time width of the buffer area. 10. A vehicle control device as claimed in any one of claims 1 to 9, wherein the access right management unit synchronizes a data communication timing between the application and the bus with a data communication timing between the shared storage and the bus when the application accesses the shared storage via a bus. A vehicle control system (1) including a vehicle control device (4) in which an application is implemented and electronic control devices (2, 3) in which an application is implemented, the vehicle control device and the electronic control device being capable of data communication,
The vehicle control device includes:
Shared storage for multiple apps (9)
and an access right management unit (14) that divides a time slot to include a static area corresponding to a time-triggered access request from the app and a dynamic area corresponding to an event-triggered access request from the app, and assigns access rights from the app to either the static area or the dynamic area, wherein when an app that should access the shared storage at the timing of the dynamic area accesses the shared storage at the timing of the static area, the access right management unit notifies the app of the timing of the next dynamic area . The electronic control device manages an operation of a first application that executes a first task that requires periodic access to the shared storage;
The vehicle control system according to claim 11 , wherein the access right management unit assigns an access right from the first application to the shared storage to the static area. the electronic control device manages an operation of a second application that executes a second task that does not require periodic access to the shared storage but has a higher priority than the first task;
The vehicle control system according to claim 12 , wherein the access right management unit allocates an access right from the second application to the shared storage to the dynamic area . A control unit (7) of a vehicle control device (4) having a shared storage (9) shared by a plurality of applications,
An access rights management program that divides a time slot to include a static area corresponding to a time-triggered access request from the application, and a dynamic area corresponding to an event-triggered access request from the application, executes an allocation procedure that allocates access rights from the application to the shared storage to either the static area or the dynamic area, and, if an application that should access the shared storage at the timing of the dynamic area accesses the shared storage at the timing of the static area during the allocation procedure, notifies the application of the timing of the next dynamic area .

Images