The present invention relates to a vehicle control device including a plurality of CPUs.
An automobile control system includes a plurality of electronic control units (ECU). Such ECUs are demanded to execute sensor input processes, processes for calculating target values for control processes, and processes for controlling actuators while meeting a strict time constraint (deadline). Integration of ECUs has been promoted to achieve cost reductions and space saving, and a multi-core configuration has come to be adapted to cope with a requirement for higher computational complexity.
However, when a core executing the control process fails, the core becomes incapable of continuing the process any longer. Therefore, fallback control for stopping the entire ECU is executed to ensure the safety.
Hence, there is a demand for a technique for improving the availability so that the control process can be continued.
With the technology described in PTL 1, setting information (core allocation information) defining which core is to execute software is stored in advance, in a manner associated with an operation mode. When a failure of the core is then detected, the operation mode is changed, by being triggered by a reset, to another mode in which the software can be executed only by using the cores capable of normally operating. In this manner, it is possible to switch the core on which the software is executed, and to improve the availability.
However, with the technology described in PTL 1, it is not possible to ensure that the core to which the execution is moved is capable of executing the software in real time. In addition, because such a configuration requires designing in advance, it is difficult to cope with software updates.
The present invention has been made to solve the problem described above, and an object of the present invention is to provide a vehicle control device capable of improving the safety and the availability by determining a core to which software is to be moved depending on the core having failed, determining whether there is any contention in the timings at which software is executed, based on software operations on the core resultant of moving the software, and performing an arbitration when there is a contention.
In order to solve the problem described above, the present invention is configured as follows.
A vehicle control device including a CPU that executes a plurality of tasks in clock-synchronization, the vehicle control device includes: a failure detecting unit that detects a failure of a core in the CPU; and an execution timing arbitration unit that allocates a task having been executed by the core having failed, to a non-failed core; wherein, when the task having been executed by the failed core is allocated to the non-failed core, the execution timing arbitration unit shifts an execution time slot so as to make the task being executed by the non-failed core executable, thereby setting time slots in which the plurality of tasks are executable.
With the vehicle control device according to the present invention, it is possible to provide a vehicle control device capable of improving the safety and the availability by determining the core to which the software is to be moved, depending on which core has failed, determining whether there is any contention in the timings of executions of software, based on the operations of the software on the core resultant of moving the software, and performing an arbitration when a contention occurs.
A vehicle control device according to the present invention detects a failure of a core executing control software, selects a process to be continued, among the processes affected by the failed core, and determines a core on which the process to be continued is to be executed.
The vehicle control device also determines whether there will be any contention in the timings of execution, as a result of adding the process to be continued, and makes an arbitration. The vehicle control device is then operated at the timings resultant of the arbitration.
Some embodiments of the present invention will now be explained with reference to some drawings.
The process of the control software is executed in a task, so that a plurality of processes of the control software may be executed in one task. The core allocation update unit 123 selects an allocatee core, and notifies the execution timing arbitration unit 124 of the allocatee core, as well as the task group.
The execution timing arbitration unit 124 detects whether there is any contention in the timings at which the newly assigned group of tasks is executed and at which a group of tasks having been originally assigned is executed. In other words, the execution timing arbitration unit 124 verifies whether the non-failed core 10 can execute the task having been executed by the failed core 10 in the same time slot. The execution timing arbitration unit 124 then makes an arbitration by changing (shifting) the timing at which the core 10 executes the task (execution time slot). The execution time slot is changed within a range in which the input/output time constraints of the core 10 permits. The execution timing arbitration unit 124 sets time slots in which a plurality of tasks of the failed core 10 can be executed independently, and sets the time slots as arbitrated task set information. The arbitrated task set information is notified to a scheduler 127. The scheduler 127 executes the tasks by time-sharing, based on the task set information. The scheduler 127 controls the tasks to be executed in clock-synchronization, so that a specific task is executed in a specific time slot. When the arbitration fails, a fallback control unit 125 is executed, and the error notification unit 126 notifies an error to another ECU over the network.
A core ID is an ID for identifying a CPU 11. A task group specifies a set of pieces of control software, and the value specifies a task group ID. A task ID specifies an ID for identifying a task. Property specifies the role of the task. R specifies an input processing task of executing an input process to a task group (Copy-In). E represents a control processing task of executing control process, and W represents an output processing task of outputting a result of the control process calculated by E (Copy-Out).
A cycle specifies an interval at which the task is executed. Start time specifies the time in which execution of the task is started, and specified in units of ms. The end time is the time in which the task is ended, and specified in units of ms. A margin is an extra time (an extra time for a duration of the task) reserved considering the possibility of fluctuations in the duration of the task, and the end time is put behind by this margin time. The margin is specified in units of ms.
A task group is a set of one or more tasks for implementing a function group, and the value indicates a task group ID. One function group includes a task group that includes one or more tasks. Furthermore, one task group includes R, E, and W, and at least the output processing task is executed by time-sharing. E is performed after R and before W. A task ID specifies an ID for identifying a task. Process continuity specifies whether the process of the task group is to be continued when the core fails. “Required” specifies that the process needs to be continued, and “not required” indicates that the process does not need to be continued. ASIL is an abbreviation of Automotive Safety Integrity Levels defined in the functional safety standard ISO 262626, and specifies a required level of automobile safety. The levels include QM, and A to D, with D being the highest requirement. The required CPU utilization rate means the CPU utilization rate consumed in executing the task group.
The CPU utilization rate is the CPU load consumed in executing the execution function group. A margin represents a time allowance required to ensure the real-timeness even when the duration of the task group deviates from the predicted time. A CPU availability rate specifies the degree by which the CPU is available for executing another task group, with the CPU utilization rate and the margin excluded.
The sequence of an operation according to the first embodiment will now be explained in detail.
(
Based on the location of failure (core ID), the process-to-be-continued selection unit 122 identifies task groups that are affected thereby, from the task set information. Specifically, task groups being executed by the core ID is identified from the task set information 131.
(
The process-to-be-continued selection unit 122 identifies a function group affected as a result of the interruption of the task groups, based on the process continuity determination table 134, using the identified task groups. In step 1222, based on the process continuity determination table 134, the process-to-be-continued selection unit 122 identifies the function group affected by the failed core 10, based on the automobile safety standard.
(
The process-to-be-continued selection unit 122 identifies a task group the processes of which need to be continued, from the identified function groups, based on the process continuity determination table 134.
(
In order to search for a core to which the task group is to be moved, the core allocation update unit 123 refers to the core allocation information 135, and finds a core ID the CPU availability rate of which is higher than the required CPU utilization rate for the task group.
(
The core allocation update unit 123 determines whether the core ID found in step 1231 is on the same ECU as the ECU from which the failure has been detected. If true, the sequence of this process is ended. If false, the process goes to step 1233.
(
The core allocation update unit 123 sends the core ID found in step 1231 and the information of the task group the processes of which need to be continued by the ECU, to the ECU that includes that allocatee core ID.
(
The execution timing arbitration unit 124 updates the task set information by adding the task group the processes of which need to be continued, to the allocatee core ID, to create the task set information 132 (
(
If the allocatee core ID has a plurality of function groups, the execution timing arbitration unit 124 divides the margin by the number of the function groups (
(
The execution timing arbitration unit 124 then creates the scheduling table (
(
If there are some tasks to be executed in the same time slot, the execution timing arbitration unit 124 determines whether the contention occurs for R of the task group the processes of which need to be continued. If true, the process is shifted to step 12405. If false, the process is shifted to step 12406.
(
The execution timing arbitration unit 124 shifts R of the task group the processes of which need to be continued, to an available time having the earliest start time.
(
If there are some tasks to be executed in the same time slot, the execution timing arbitration unit 124 determines whether the contention occurs for E of the task group the processes of which need to be continued. If true, the process is shifted to step 12407. If false, the process is shifted to step 12408.
(
The execution timing arbitration unit 124 shifts E of the task group the processes of which need to be continued, to an available time having the earliest start time. In order to maintain the order of executions within the task group, E is executed later in time than R.
(
If there are some tasks to be executed in the same time slot, the execution timing arbitration unit 124 determines whether the contention occurs for W of the task group the processes of which need to be continued. If true, the process is shifted to step 12409. If false, the process is shifted to step 12410.
(
The execution timing arbitration unit 124 shifts W of the task group the processes of which need to be continued, to an available time having the latest start time. In order to maintain the order of executions within the task group, W is executed later in time than E. E may be separated in time from W. E may end up being later than the time predicted, but this difference is absorbed by the margin. By keeping E and W separate, as currently is, the timing at which W is executed is fixed. Therefore, any change is not required in the other task groups, and the real-timeness can be ensured. The execution timing arbitration unit 124 arbitrates the timings of the execution by changing (shifting) the timing at which the tasks in the group are executed while maintaining the order at which the input processing task, the control processing task, and the output processing task are executed.
(
The execution timing arbitration unit 124 determines whether the tasks W, E, and R have been successfully shifted to available start time. If the determination result is true, the sequence of this operation is ended. If the determination result is false, the process is shifted to step 12411.
(
The execution timing arbitration unit 124 sends an error information to the network 2 via the error notification unit 126, notifies the fallback control unit 125 to execute the fallback control, and the sequence of the operation is ended.
As described above, the execution timing arbitration unit 124 determines whether the input processing task R and the control processing task E can be shifted to the time before the output task is to be executed, within the same cycle. If the input processing task R and the control processing task E cannot be shifted, the execution timing arbitration unit 124 sends an error so that the fallback control is executed. Note that, in step 12411, the execution timing arbitration unit 124 may notify either the error or the fallback control. According to the first embodiment, even if a core fails, another core can execute the task the processing of which needs to be continued. Therefore, availability is improved.
In addition, according to the first embodiment, even if there is a contention in the timings at which the processes are to be executed, assuming that another core is to execute the task the process of which needs to be continued, the execution timings are shifted to available time while maintaining the order in which the tasks are executed. Therefore, it is possible to keep the deadline without affecting the result of the control computation.
In addition, according to the first embodiment, if there is a contention in the timings at which the processes are to be executed, the duration of the task the processing of which needs to be continued is changed, so that the task that has been originally being executed is not affected thereby. Therefore, the scope in which the real-timeness is affected can be localized.
In addition, according to the first embodiment, because the task E and the task W are separated, and temporally distant from each other, even if the execution of the task E takes longer than anticipated, the difference is absorbed by the margin, and does not affect the duration of the task W. Therefore, the scope to be verified can be localized.
According to the first embodiment, it is possible to provide a vehicle control device capable of improving the safety and the availability by determining the core to which the software is to be moved, depending on which core has failed, determining whether there is any contention in the timings at which the software is executed, based on the operations of the software on the core after the software is moved, and performing an arbitration when a contention occurs. Note that, according to the first embodiment, the task is implemented based on time-sharing scheduling in which the timings at which the tasks are executable are managed based on the time slot, but the present invention is not limited thereto.
A second embodiment is an example in which the present invention is implemented with priority scheduling. Only the differences from the first embodiment will be explained.
(
The execution timing arbitration unit 124 updates the task set information by adding the task group the processes of which need to be continued, to the allocatee core ID, to create the task set information 232 (
(
If a single core ID has a plurality of function groups, the execution timing arbitration unit 124 divides the margin by the number of the function groups (
(
The execution timing arbitration unit 124 then creates the scheduling table (
(
If there are some tasks to be executed in the same time slot, the execution timing arbitration unit 124 determines whether the contention occurs for W of the task group the processes of which need to be continued. If true, the process is shifted to step 2245. If false, the process is shifted to step 2246.
(
The execution timing arbitration unit 124 shifts W of the task group the processes of which need to be continued, to an available time having the latest start time. In order to maintain the order of executions within the task group, W is executed later in time than E. E may be separated in time from W. E may end up being later than the time predicted, but this difference is absorbed by the margin. By making the execution timings of E and W discontinuous, and by keeping E and W separate, as currently is, the timing at which W is executed is fixed. Therefore, any change is not required in other task groups, and the real-timeness can be ensured. In other words, a specific process of a task assigned with a high priority is always executed in a specific time slot.
(
The execution timing arbitration unit 124 determines whether the sum of the durations does not exceed the cycle. If the determination result is true, the sequence of this operation is ended. If the determination result is false, the process is shifted to step 2247.
(
The execution timing arbitration unit 124 sends error information to the network via the error notification unit 126, to cause the fallback control unit 125 to execute the fallback control, and this sequence of the operation is ended.
According to the second embodiment, the following effects can be achieved, in addition to the effects achieved by the first embodiment.
According to the second embodiment, in the vehicle control device implemented by the priority scheduling, even if a contention newly occurs in the execution timings because of the task group the processes of which need to be continued, only W of the task group is shifted, so that the real-timeness can be ensured as long as the schedulability is ensured.
According to the second embodiment, schedulability for ensuring that the CPU does not exceed 100% is verified by determining whether the sum of the durations does not exceed the cycle, but the present invention is not limited thereto. For example, when the task group spans across a plurality of cycles, schedulability is verified based on a hyperperiod.
According to the second embodiment, the same priorities are assigned to R and E of the same task group, and durations of R and E are plotted in this order. Therefore, even if a contention occurs, the arbitration is performed based on the priority scheduling, so that the process of the execution timing arbitration unit can be simplified.
The third embodiment is an example in which the task group the processes of which need to be continued belong to the same function group as that of the allocatee. Because any scheduling scheme may be used, the third embodiment will be explained using an example of priority scheduling. Therefore, only the differences from the second embodiment will be explained.
(
The execution timing arbitration unit 124 updates the task set information by adding the task group the processes of which need to be continued, to the allocatee core ID, to create the task set information 332 (
(
If the core ID has the same function groups with some margins, the execution timing arbitration unit 124 merges the margin to E (specific task) the priority of which is lower (
(
The execution timing arbitration unit 124 then creates the scheduling table (
(
If there are some tasks to be executed in the same time slot, the execution timing arbitration unit 124 determines whether the contention occurs for W of the task group the processes of which need to be continued. If true, the process is shifted to step 3245. If false, the process is shifted to step 3246.
(
The execution timing arbitration unit 124 shifts W of the task group the processes of which need to be continued, to an available time having the latest start time. In order to maintain the order of executions within the task group, W is executed later in time than E. E may be separated in time from W. E may end up being later than the time predicted, but this difference is absorbed by the margin. By keeping E and W separate, as currently is, the timing at which W is executed is fixed. Therefore, any change is not required in the other task groups, and the real-timeness can be ensured.
(
The execution timing arbitration unit 124 determines whether the sum of the durations does not exceed the cycle. If the determination result is true, the sequence of this operation is ended. If the determination result is false, the process is shifted to step 3247.
(
The execution timing arbitration unit 124 sends an error information to the network via the error notification unit 126, to cause the fallback control unit 125 to execute the fallback control, and the sequence of the operation is ended.
According to the third embodiment, the effects described below can be achieved, in addition to the effects achieved by the second embodiment.
According to the third embodiment, when the task groups belonging to the same function group are executed on the same core, the margins can be integrated. Therefore, when the duration becomes longer than anticipated, the difference can be absorbed in the same manner, even when the overall margins are small. Therefore, the task groups can be implemented efficiently.
A fourth embodiment is an example in which task set information is created in advance to prepare for failures of the respective cores, before any of the cores actually fails. Only the differences from the first embodiment will be explained.
According to the fourth embodiment, the effects described below can be achieved, in addition to the effects achieved by the first embodiment.
According to the fourth embodiment, the task set information that is to be used at the time of a failure can be prepared in advance, for each of the cores 10, before the failure actually occurs. Therefore, it is possible to shorten the time required for a specific core 10 to execute the task the process of which needs to be continued, from when the failure occurs.
A fifth embodiment is an example in which, when the core 10 fails, a core 10 of another ECU executes a task the process of which needs to be continued. Only the differences from the first embodiment will be explained.
According to the fifth embodiment, the following effects can be achieved, in addition to the effects achieved by the first embodiment.
According to the fifth embodiment, when it is not possible to execute a task group the process of which needs to be continued in the same ECU after a core fails, another ECU can execute the task group, so that availability can be improved.
Number | Date | Country | Kind |
---|---|---|---|
2020-211436 | Dec 2020 | JP | national |
Filing Document | Filing Date | Country | Kind |
---|---|---|---|
PCT/JP2021/031889 | 8/31/2021 | WO |