JP7841454B2 - Electronic control unit - Google Patents

Description

This invention relates to an electronic control unit having a configuration in which each of multiple CPUs and each of multiple memory units are connected by a dedicated bus.

Electronic control units installed in vehicles such as automobiles may have their programs updated to include the addition of new functions or the correction of malfunctions. Traditionally, these updates required bringing the vehicle to a dealership, but this was inconvenient for vehicle users. Therefore, a technology has been proposed that allows for program updates at the user's location using wireless communication, known as OTA (On The Air).

When updating a program via OTA (Over-the-Air), it is desirable that the update can be performed even while the vehicle is in motion. To achieve this, two memory areas, secured by the electronic control unit's non-volatile memory, are used alternately. The program in the inactive area is updated during program execution, and the active area is switched at the time of restart, such as when the ignition switch is turned ON/OFF. This enables program updates even while the vehicle is in motion.

Japanese Patent Publication No. 2021-60747

In this case, depending on the connection relationships with devices such as the CPU and memory, the switching of the active side may reduce processing speed and potentially affect functionality.

For example, if the memory device that needs to be activated to run an updated program switches, and processing via the dedicated bus becomes impossible, the speed of real-time processing will decrease.

This invention has been made in view of the above circumstances, and its objective is to provide an electronic control device that can prevent a decrease in the execution speed of processing requiring real-time performance, even when the memory device on which the updated program is executed is switched.

According to the electronic control device described in claim 1, each scheduler assigns each process in the update program, obtained via a communication unit (3) that performs wireless communication with the outside, to be executed by multiple CPUs (6(0), 6(1)). Each of the multiple CPUs is connected to one of the multiple memories (8(0), 8(1)) via a dedicated bus (11), and to the other memories via a shared bus (5), and accesses one of the multiple memories as active memory. The selection unit (13) selects a scheduler according to the selection of the active memory.

When multiple memory locations are available, the memory accessed by multiple CPUs to execute programs becomes active memory, while the other memory locations become inactive memory. The updated program is written to one of the inactive memory locations. When execution of the updated program begins, the aforementioned inactive memory location is switched to active memory. The scheduler selected by the selection unit causes the CPU connected to the active memory via a dedicated bus to execute processes requiring real-time processing, while the other CPUs execute processes that do not require real-time processing.

With this configuration, even when the program is updated and inactive memory is switched to active memory, the CPU connected to the active memory via a dedicated bus will always execute processes requiring real-time processing. Therefore, a decrease in the execution speed of processes requiring real-time processing can be prevented.

This is one embodiment and a functional block diagram showing the configuration of the electronic control unit. A flowchart illustrating the execution process from OTA-based program updates to scheduler determination. Flowchart showing the OTA update process A diagram showing an example of a scheduler. Flowchart showing the program rewriting process Flowchart showing normal processing Flowchart showing the initialization process Flowchart showing the scheduler determination process

The following describes one embodiment. As shown in Figure 1, the electronic control unit 1 of this embodiment includes an OTA controller 2. The OTA controller 2 obtains update programs, etc., by wirelessly communicating with an external device 4, such as an OTA center, via a communication interface (I/F) 3, which is a communication unit. The OTA controller 2 and the communication I/F 3 are connected via a shared bus 5. The shared bus 5 is connected to the CPU 6(0) and 6(1), RAM 7, ROM 8(0) and 8(1), data flash 9, and timer 10, etc. Note that ROM 8 and data flash 9 are ROMs with rewritable data, and are so-called flash memories.

ROM8 is a dual-port memory, and CPU6(0) and ROM8(0), and CPU6(1) and ROM8(1) are directly connected via dedicated buses 11(0) and 11(1), respectively. In other words, the electronic control unit 1 is supplied with operating power from the power supply circuit 12. The OTA controller 2 contains a control unit 13, which is a selection unit, and a storage device 14. Note that update programs, etc., may be referred to as "rewrite data."

Next, the operation of this embodiment will be described. As shown in Figure 2, the electronic control unit 1 sequentially executes the OTA update process (S1), normal processing (S2), and scheduler determination process (S3). Each of these processes will be described below.

<OTA Update Processing>
As shown in Figure 3, the control device 13 of the OTA controller 2 receives rewrite data from the external device 4 via the communication interface 3 and stores it in the storage device 14 (S11). The rewrite data includes a scheduler, which is a program that assigns each process in the update program to be executed by CPUs 6(0) and 6(1). More specifically, the scheduler determines whether each function's time-periodic processing and interrupt processing will be executed by CPU 6(0) or 6(1). Specifically, it includes calling periodic execution processes in the designed order and configuring the real-time OS for interrupt processing (OK?).

In this embodiment, as shown in Figure 4, the update program has two different schedulers for the target CPU 6. It selects the scheduler according to the active ROM 8 and changes the CPU 6 that executes the scheduler function for each function. The "active surface" refers to either ROM 8(0) or 8(1) that CPU 6(0) and CPU 6(1) are accessing. The unaccessed surface is called the "inactive surface." The active surface corresponds to active memory, and the inactive surface corresponds to inactive memory.

Scheduler No. 1 is selected when the active plane is ROM8(0). In this state, CPU6(0) executes processes requiring real-time processing, while CPU6(1) executes processes that do not require real-time processing. "Processes requiring real-time processing" include, for example, engine fuel injection control (if applied to vehicle control), while "processes that do not require real-time processing" include, for example, car air conditioning control. In this case, CPU6(0) accesses ROM8(0) via the dedicated bus 11(0), and CPU6(1) accesses ROM8(0) via the shared bus 5.

On the other hand, scheduler No. 2 operates in the opposite way to the above; it is selected when the active plane is ROM8(1), causing CPU6(1) to execute processes requiring real-time processing and CPU6(0) to execute processes that do not require real-time processing. In this case, CPU6(1) accesses ROM8(1) via the dedicated bus 11(1), and CPU6(0) accesses ROM8(1) via the shared bus 5.

Next, it is determined whether the CPU 6 is executing a program, that is, whether it is operating (S12). For example, the control device 13 monitors the state of the CPU 6 and determines that the program is executing if the bus accessing the ROM 8 or an interface is being called. In the electronic control device 1, a situation in which the CPU 6 stops operating would be, for example, when the ignition switch is turned OFF due to the vehicle being parked, assuming its application to an ECU (Electronic Control Unit) installed in a vehicle.

If CPU 6 is not operating (No), the program rewriting process is performed (S14). Details of this rewriting process will be described later. On the other hand, if it is operating (Yes), the functions of CPU 6 and RAM 7 not used for program rewriting are stopped (S13) before proceeding to step S14. "Stopping the functions of CPU 6" means, for example, switching to HALT mode. "Stopping the functions of RAM 7" means, for example, stopping the supply of backup power for SRAM, or stopping the refresh operation for DRAM. Then, the same determination as in step S12 is made (S15). If it is operating (Yes), the system waits until the operation stops, and once it stops (No), the active side is switched (S16).

<Program rewriting process>
As shown in Figure 5, when the control device 13 determines the active side (S21), it saves a portion of the rewrite data acquired via the communication interface 3 to the storage device 14 (S22). Next, the control device 13 checks the congestion level of the shared bus 5 (S23). The congestion level of the bus 5 is determined, for example, by the number of bus requests output to the arbiter if an arbiter is used to mediate bus usage rights requests from multiple bus masters. If the congestion level of the shared bus 5 is below the expected value and not congested (Yes), it starts writing the data saved in the storage device 14 to the ROM 8 (S24). If it exceeds the expected value (No), it waits until the congestion is relieved.

In step S24, the control device 13 writes the rewrite data stored in the storage device 14 to the ROM 8 on the inactive side. At this time, the scheduler is included in the rewrite data and can be used on either the active side. Finally, the device checks whether the writing is complete (S25). If the writing fails, it returns to step S22 and performs the data writing process again.

<Normal processing>
As shown in Figure 6, normal processing starts after initialization processing (S31) (S32). Initialization processing is performed by one of the CPUs 6, while the other waits until initialization is complete. Each CPU 6 starts normal processing based on the scheduler determined during initialization processing. Normal processing is the execution of a program by the CPU 6 to realize the functions assigned to the electronic control unit 1.

<Initialization Process>
As shown in Figure 7, the initialization process determines the active side of ROM 8 (S41). However, since the active side is also determined in the program rewriting process shown in Figure 5, the determination result at that time may be stored in the storage device 14 and that determination result may be referred to. Next, the scheduler abnormality is determined (S42). The CPU 6 refers to the scheduler determination result stored in the data flash 9 and determines whether or not there is an abnormality in the scheduler. If there is no abnormality in the scheduler (No), a scheduler based on the active side is selected (S44).

On the other hand, if there is an abnormality in the scheduler (Yes), the scheduler is selected again (S43). That is, instead of setting the scheduler based on the active plane, a different scheduler is selected. For example, if scheduler No. 1 shown in Figure 3 is set and an abnormality occurs, scheduler No. 2 is selected.

<Scheduler Anomaly Detection Process>
As shown in Figure 8, if the processing speed of normal processing exceeds the expected value (S51; No), the scheduler is judged as normal and the judgment result is OK (S52). On the other hand, if the processing speed of normal processing is below the expected value and slow, or if it significantly exceeds the expected value and the speed is abnormally fast (S51; Yes), the scheduler is judged as abnormal and the judgment result is NG (S54). Here, the processing speed is measured using the timer 10 for each CPU 6 that performs normal processing. In the case where the speed significantly exceeds the expected value and is abnormally fast, if the expected value is set as the lower limit expected value, an upper limit expected value that is larger than the lower limit expected value is set, and the processing speed is compared and judged against this upper limit expected value.

Finally, the judgment result is written to the data flash 9 (S53), and the judgment process ends. This scheduler judgment process is intended to be performed after the normal processing is completed, before the power is cut off and the electronic control unit 1 is shut down. As shown in Figure 7, this judgment result is referenced when the electronic control unit 1 is started up again and normal processing begins.

As described above, according to this embodiment, in the electronic control unit 1, each scheduler assigns each process in the update program acquired via the communication unit to be executed by CPUs 6(0) and 6(1). CPUs 6(0) and 6(1) are connected to ROMs 8(0) and 8(1) respectively via dedicated buses 11(0) and 11(1), and are also connected to ROMs 8(1) and 8(0) via a shared bus 5. CPUs 6(0) and 6(1) access one of ROMs 8(0) and 8(1) as active memory.

The control unit 13 of the OTA controller 2 selects a scheduler according to the selection of the active memory and ROM 8 being accessed by CPUs 6(0) and 6(1). Based on the selected scheduler, the CPU 6 connected to the ROM 8 (which is the active memory) via the dedicated bus 11 executes processes requiring real-time processing, while the other CPUs 6 execute processes that do not require real-time processing.

With this configuration, even when the program is updated and inactive memory is switched to active memory, the CPU 6, which is connected to the active memory via the dedicated bus 11, will always execute processes that require real-time performance. Therefore, a decrease in the execution speed of processes requiring real-time performance can be prevented.

Furthermore, the control device 13 measures the speed at which the process executed by the selected scheduler is completed. If the measured speed is slower than the lower limit expected value, it determines the scheduler to be abnormal and stores the determination result in the data flash 9. It also determines the scheduler to be abnormal if the measured speed is faster than the upper limit expected value, which is set to a value faster than the lower limit expected value. This makes it possible to take measures such as avoiding the use of a scheduler determined to be abnormal.

(Other embodiments)
There may be three or more CPU and ROM pairs.
It can also be applied to control systems other than vehicle control.
This disclosure is described in accordance with the embodiments, but it is understood that this disclosure is not limited to such embodiments or structures. This disclosure also includes various modifications and variations within the equivalence. In addition, various combinations and forms, as well as other combinations and forms that include only one, more, or fewer of those elements, fall within the scope and concept of this disclosure.

In the drawing, 1 represents the electronic control unit, 3 the communication interface, 5 the shared bus, 6 the CPU, 8 the ROM, 11 the dedicated bus, and 13 the control unit.

Claims (3)

Multiple CPUs (6(0), 6(1)),
Multiple memory locations (8(0), 8(1)),
Multiple schedulers that assign each process in the update program obtained via a communication unit (3) that performs wireless communication with the outside to be executed by the multiple CPUs,
It includes a selection unit (13) for selecting one of these multiple schedulers,
Each of the aforementioned multiple CPUs is connected to one of the multiple memories via a dedicated bus (11) and to the other memories via a shared bus (5). One of the multiple memories is accessed as active memory, and the memory not accessed by the multiple CPUs is treated as inactive memory.
The selection unit selects the scheduler according to the selection of the active memory.
An electronic control device that, when the inactive memory is switched to active memory and the execution of the update program is started, causes the selected scheduler to have the CPU connected to the active memory via a dedicated bus execute processing that requires real time, and the other CPUs execute processing that does not require real time. The electronic control device according to claim 1, wherein the selection unit measures the speed at which the process executed by the selected scheduler is completed, and if the measured speed is slower than the lower limit expected value, it determines that the scheduler is abnormal and stores the determination result. The electronic control device according to claim 2, wherein the selection unit determines the scheduler to be abnormal even when the measured speed is faster than the upper limit expected value which is set to a value faster than the lower limit expected value.