JP2012108786A - Microcomputer and processing synchronization method - Google Patents

Abstract

An object of the present invention is to provide a microcomputer capable of detecting an erroneous notification of an event when an event is notified from one core to the other core by an interrupt.
Communication means 43 for communicating between a first core 52 and a second core 53, a shared memory 51 shared by the first core and the second core, an external signal is acquired and the first A first processing unit 55 that executes processing and writes predetermined information to the shared memory for each first processing; a processing request unit 33 that outputs a processing request to the second core via the communication unit; In the microcomputer 100 having the second processing unit 56 that executes the second processing as a trigger, the second core reads the latest predetermined information and the previous predetermined information from the shared memory when receiving a processing request. Only when there is a relationship defined by the latest predetermined information and the previous predetermined information, the second processing means has a comparison means 57 that permits execution of the second processing.
[Selection] Figure 2

Description

  The present invention relates to a microcomputer that executes processing while synchronizing a plurality of cores, and more particularly to a microcomputer that can detect erroneous detection of synchronization.

  Various controls are performed on the vehicle engine by an electronic control unit. For example, the determination of the fuel injection timing to the combustion chamber, the ignition timing of the igniter, the determination of the fuel injection amount, and the like are performed by the electronic control device by calculation or map drawing. Such engine control is preferably performed at an appropriate timing according to the crank angle, and the electronic control device starts processing associated with engine control based on the input of a signal from the NE sensor.

  Here, since it has become possible to make the CPU multi-core also in the electronic control device, a technique has been devised in which various controls related to engine control are shared by a plurality of cores (see, for example, Patent Document 1). In Patent Document 1, when a master core issues an interrupt request for processing for engine control to a slave core, and the slave core cannot perform processing for engine control in response to the interrupt request, A multi-core processor that sets a high priority for processing is disclosed.

  As described above, when processing for engine control is shared by a plurality of cores, one core may notify the processing timing to the other core by an interrupt so that the cores can synchronize processing.

However, if an interrupt request between cores is set as the processing start timing, an erroneous notification of an interrupt may occur.
FIG. 1 is an example of a diagram illustrating erroneous notification of an interrupt. At time t1, the master core notifies the slave core of an event using an interrupt, and the master core and the slave core perform crank synchronization processing in parallel. However, at time t2, although the master core does not notify the slave core of an event using an interrupt, the slave core accepts an erroneous notification. Such false notifications may occur very rarely due to an aggressive approach from the outside (such as electrical noise, interrupt signal line contact failure or short circuit). When an erroneous notification occurs, the slave core performs crank synchronization processing at an incorrect timing.

  Here, a technique for notifying data transmission timing between cores has been devised (see, for example, Patent Document 2). In Patent Document 2, after reading the event data, the main CPU writes data different from the previously written value to the memory, and the sub CPU constantly monitors the memory and compares the value with the previously read value when reading. If there is a change, a multiprocessor is disclosed that reads data from memory. If it is the technique of patent document 2, the start of a process can be notified by monitoring data instead of interruption.

JP 2010-113419 A JP 05-346908 A

  However, the data transmission timing notification method disclosed in Patent Document 2 has a problem that the processing load on the sub CPU is heavy because the sub CPU needs to access the memory periodically. Further, if the sub CPU monitors the memory at a regular cycle in which data is written by the main CPU instead of being constantly monitored by the sub CPU, the processing load on the sub CPU can be reduced. However, in this case, there is a risk that the sub CPU may miss the timing of accessing the memory due to a malfunction such as a timer.

  Therefore, in order to synchronize the processing between the cores, it is preferable to accurately detect the processing timing while using the interrupt.

  In view of the above problems, an object of the present invention is to provide a microcomputer capable of detecting an erroneous notification of an event when an event is notified from one core to the other core by an interrupt.

  In view of the above problems, the present invention provides a first core and a second core, communication means for enabling communication between the first core and the second core, the first core, and the first core. A shared memory shared by two cores, and a first process that is included in the first core and repeatedly executes a first process each time an external signal is acquired, and writes predetermined information to the shared memory for each first process. 1 processing means, a processing request means for outputting a processing request to the second core via the communication means for each first processing, and a processing request provided in the second core, triggered by the processing request. When the second core receives the processing request, the second core reads the latest predetermined information and the previous predetermined information from the shared memory when receiving the processing request. The latest predetermined information and the previous predetermined information Only if relationship defined in, and having a comparison means, for permitting the execution of the second process on the second processing means.

  When an event is notified from one core to the other core by an interrupt, a microcomputer capable of detecting an erroneous notification of the event can be provided.

It is an example of the figure explaining the erroneous notification of interruption. It is an example of the figure which illustrates the characterizing part of an electronic controller typically. It is an example of the schematic block diagram of the engine controlled by an electronic controller. It is an example of the hardware block diagram of an electronic controller. It is an example of the functional block diagram of an electronic controller. It is an example of the flowchart figure which shows the operation | movement procedure of an electronic controller. It is an example of the sequence diagram when a slave core acquires a normal event notification. It is an example of the sequence diagram when a slave core acquires the erroneous notification of an event. It is an example of the functional block diagram of an electronic control apparatus (Example 2). It is an example of the figure explaining the stop process of the calculation based on the frequency | count of false notification. (Example 3) which is an example of the functional block diagram of an electronic controller. It is an example of the figure explaining the stop process of the calculation process based on a calculation result and the frequency | count of an erroneous notification. It is an example of the figure which shows the electronic control apparatus connected via hybrid ECU and vehicle-mounted LAN.

  Hereinafter, embodiments for carrying out the present invention will be described with reference to the drawings.

FIG. 2 is an example of a diagram schematically illustrating the characteristic part of the electronic control device of the present embodiment. FIG. 2A shows a processing procedure of the master core and the slave core when no erroneous notification of an event has occurred.
(A1) When the master core acquires a signal input from the NE sensor, the master core performs processing (for example, crank counter operation processing) and writes the processing result in the current value of the shared RAM.
(A2) When the processing is completed, the master core notifies the slave core of an event by interruption.
(A3) The slave core compares the previous value with the current value of the shared RAM using the event notification as a trigger. The current value is always different from the previous value if the writing of the master core in (1) has been completed normally.
(A4) Using the premise that the current value and the previous value should be different, the slave core copies the current value to the previous value if the current value and the previous value are different. As a result, the previous value and the current value are equal (both are 30 in the figure).

  When the event notification is normally output from the master core to the slave core, (A1) to (A4) are repeated. If the current value and the previous value are different, the slave core executes processing (for example, crank synchronization processing).

FIG. 2B shows a processing procedure of the master core and the slave core when an erroneous notification of an event occurs.
(B1) Before the master core notifies the event, an erroneous notification of the event is output to the slave core. In this case, since the master core does not perform processing based on signal input from the NE sensor nor update the current value, the previous value and the current value remain the same.
(B2) The slave core compares the previous value with the current value of the shared RAM, triggered by an erroneous notification of the event.
(B3) However, since the previous value and the current value are the same, the slave core can detect that the event notification is a false notification. Since the slave core that has detected the erroneous notification of the event does not execute processing (for example, crank synchronization processing), it is possible to prevent processing at an abnormal timing.

〔Constitution〕
FIG. 3 shows an example of a schematic configuration diagram of the engine 200 controlled by the electronic control unit 100. The engine 200 is a reciprocating engine that converts the reciprocating motion of the piston 17 into a rotational motion. Although a single cylinder is shown in the drawing, a normal engine 200 has a plurality of cylinders in series or in the V-hour direction, and a connecting rod 18 of each cylinder is connected to one crankshaft 20.

  A piston 17 connected to the connecting rod 18 is accommodated in the cylinder, and a combustion chamber is formed by the inner peripheral surface of the cylinder and the piston 17. The combustion chamber is provided with an injector 16 for injecting fuel, and an igniter 13 for igniting a mixture of air and fuel in the combustion chamber. An intake passage 14 for supplying intake air partitioned by an intake valve 15 and an exhaust passage 11 partitioned by an exhaust valve 12 for discharging exhaust gas after combustion are connected to the combustion chamber.

  A crankshaft timing rotor 19 is coaxially fixed to one end of the crankshaft 20, and a crank position sensor (hereinafter referred to as “NE sensor”) 21 is disposed facing the outer edge of the crankshaft timing rotor 19. Although the principle of the NE sensor 21 may be any, for example, protrusions are provided at equal intervals on the circumference of the crankshaft timing rotor 19, and protrusions generated by the protrusions moving by rotation of the crankshaft 20. The change in the air gap between the sensor and the NE sensor 21 is used. Since the NE sensor 21 has a coil and can detect an electromotive force by a change in the air gap, the rotation angle of the crankshaft 20 can be detected from a periodic change in the electromotive force.

  Further, only one portion of the projection of the crankshaft timing rotor 19 is missing, so that the NE sensor 21 can detect the reference angle of the crankshaft 20 (that the crankshaft has rotated once). The crankshaft timing rotor 19 is attached so that the missing portion coincides with the top dead center of the piston 17.

  When the piston 17 moves to near the bottom dead center, the intake valve 15 is opened by the action of the timing belt and the cam, and air is taken into the combustion chamber. At this time, the electronic control unit (ECU) 100 detects the position of the piston 17 based on the crank angle, and causes the injector 16 to inject fuel. Thereafter, when the piston 17 moves to near the top dead center, the electronic control unit 100 detects the position of the piston 17 based on the crank angle, energizes the igniter 13 and ignites the air-fuel mixture in the combustion chamber. When the piston 17 moves from the top dead center to the bottom dead center by this combustion process and starts moving again in the direction of the top dead center, the exhaust valve 12 is opened by the action of the timing belt and the cam, and the combustion gas in the combustion chamber is exhausted. The As the piston 17 reciprocates, the crankshaft 20 rotates and is transmitted to the drive wheels of the vehicle.

  FIG. 4 shows an example of a hardware configuration diagram of the electronic control device 100. The electronic control device 100 may be a microcomputer provided with a processor. The electronic control device 100 includes a core (core 1 and core 2 when distinguished) 31, a DMAC 35, an SDRAM 37, an I / O bridge 38, and a ROM 39 connected via a multilayer bus 36. The two cores 31 have a CPU 32, an INT 33, and a RAM 34, respectively.

  The CPU 32 has arithmetic circuits such as IFU (Instruction Fetch Unit), DEC (DECoder), RF (Register Fetch), REG (REGister), LSU (Load Store Unit), SH (Shifter), ALU, MUL, and FPU. , One instruction is executed in one clock by pipeline control.

The RAM 1 is a memory dedicated to the core 1 (primary cache), and the RAM 2 is a memory dedicated to the core 2 (primary cache). In the core 31 of the present embodiment, the core 1 is assigned to the master core, and the core 2 is assigned to the slave core. However, after shipment, the relationship between the cores 1 and 2, the master core, and the slave core may be appropriately switched.
INT1 and INT2 control interrupts between CPUs via the communication line 43, and control transmission / reception of parameters and the like from the core 1 to the core 2 or from the core 2 to the core 1. The INT1 and INT2 can also transmit and receive parameters and the like by using the RAM1, RAM2, or SDRAM 37 as a shared communication memory (shared memory).

  The DMAC 35 receives a request from the core 1 and the core 2, reads the program 40 into the SDRAM 37, RAM 1, RAM 2, arbitrates a memory access request from a peripheral device, and also from the I / O bridge 38 to the SDRAM 37 or from the SDRAM 37. Data is transferred to the I / O bridge 38 without going through the core 1 and the core 2. The SDRAM 37 is a memory (secondary cache) for providing the program 40 or data to the core 1 and the core 2. At least a part of the SDRAM 37 is shared by the core 1 and the core 2.

  The ROM 39 also stores a program 40 (to be described later), an OS, and a device driver (platform).

  The I / O bridge 38 converts a frequency, a voltage value, and the like between the multilayer bus 36 and the I / O bus 42. Various I / Os 41 are connected to the I / O bus 42. The I / O 41 is an interface that connects the electronic control device 100 and external devices. For example, the NE sensor 21, the CAN controller, various actuators, sensors, and switches are connected to the I / O 41.

  FIG. 5 shows an example of a functional block diagram of the electronic control device 100. In FIG. 5, only important parts are illustrated for the sake of explanation. The shared RAM 51 may be any one of the RAM 1, the RAM 2, and the SDRAM 37, and the master core 52 and the slave core 53 are any one of the two cores 1 and 2. Although the core 1 and the core 2 have the same hardware structure, the master core 52 and the slave core 53 may have different hardware structures.

  The master core 52 includes a crank synchronization processing unit 54 and a crank counter operation processing unit 55 that are realized by the CPU 32 executing the program 40, and the slave core 53 is a crank synchronization processing unit 56 and a crank synchronization processing execution availability determination processing unit 57. Have

  First, the crank counter operation processing unit 55 counts the engine rotation angle or calculates the engine rotation speed based on the NE sensor signal input from the NE sensor 21. Hereinafter, these processes are referred to as a crank counter operation process. The NE sensor 21 shapes a voltage waveform formed by the air gap with the protrusion into a pulse, and outputs a signal indicating each detection time point of the pulse rising edge and falling edge (referred to as NE sensor signal without distinguishing both). Supply to the master core 52.

  The crank counter operation processing unit 55 increases the crank counter by one when the falling edge is detected after the rising edge of the pulse is detected. The crank counter divided by 1 to 36 and the engine rotation angle are indicated by the crank counter. Also, the crank counter operation processing unit 55 measures and stores the time from the rising edge of the pulse until the falling edge is detected, and then until the falling edge is detected from the rising edge of the pulse. Compare with time. The two times are about the same, but once per round, the ratio of the two times becomes about twice or more (or less than 1/2) due to the loss of the protrusion. At this time, since the crankshaft 20 has made one revolution, the engine rotational speed is obtained from the time from when the ratio of the two times last doubles to the next double. Further, the crank counter operation processing unit 55 initializes the value of the crank counter when the ratio of the two times becomes twice or more. In this embodiment, it is assumed that the crank counter operation processing unit 55 writes the value of the crank counter as the current value in the shared RAM 51.

  Conventional crank synchronization processing includes determination of energization timing of the igniter 13 according to the crank counter, determination of ignition start timing of the igniter 13, determination of fuel injection timing by the injector 16, and the like. Further, the fuel injection amount is also determined before the fuel injection timing is determined.

  Since the electronic control device 100 has multi-cores as in the present embodiment, crank synchronization processing can be load-balanced between the master core 52 and the slave core 53, and more precise engine control can be achieved. For example, even when the crank counter is conventionally divided into 24 stages, the crank synchronization process with a shorter stage interval (36 stages) can be performed by distributing the load.

  In this embodiment, it is possible to design what kind of crank synchronization processing the master core 52 and the slave core 53 are responsible for. For example, the crank synchronization processing unit 54 of the master core 52 determines the energization timing of the igniter 13 and the ignition of the igniter 13. It is assumed that the start timing is determined and the crank synchronization processing unit 56 of the slave core 53 determines the fuel injection amount and the fuel injection timing by the injector 16.

The crank counter operation processing unit 55 interrupts the slave core 53 after the crank counter operation processing. The interrupt handler of the slave core 53 activates the crank synchronization process execution determination processing unit 57 using this interrupt as a trigger. The crank synchronization process execution availability determination processing unit 57 will be described in detail later.
(A) The current value of the shared RAM 51 is compared with the previous value.
(B) If the current value and the previous value are the same, it is determined that the event has been erroneously notified, and the crank synchronization processing unit 56 is not called.
(C) If the current value is different from the previous value, it is determined that the event notification is correct,
(c-1) Copy the current value of the shared RAM 51 to the previous value.

    (c-2) Call (execute) the crank synchronization processing unit 56.

  With this processing, the crank synchronization processing unit 56 of the slave core 53 can execute the crank synchronization processing only when the event is normally notified.

[Operation procedure]
FIG. 6 is an example of a flowchart illustrating an operation procedure of the electronic control device 100 according to the present embodiment.
First, the NE sensor 21 transmits an NE sensor signal to the master core 52 (S10). The DMAC 35 may transmit from the I / O bridge 38 to the RAM 1 of the master core 52, or an INTC (interrupt controller) (not shown) notifies the CPU of an interrupt request from the NE sensor 21, so that the master core 52 transmits to the DMAC 35. The NE sensor signal may be stored in the RAM 1.

  Next, the master core 52 receives the NE sensor signal (S20). When the NE sensor signal is received, the crank counter operation processing unit 55 executes crank counter operation processing (S30). When the crank counter operation processing is completed, the crank counter operation processing unit 55 calculates the crank counter, so that the current value of the crank counter is overwritten in the shared RAM 51 (S40). Conventionally, the master core 52 performs a process of calculating a crank counter and writing it to the shared RAM 51 for the crank counter synchronization process, so that there is no significant change in the crank counter operation process and an increase in cost can be suppressed.

  Note that immediately after the electronic control device 100 is activated, the crank counter operation processing unit 55 initializes the previous value (for example, sets the maximum value (0xff)). Even if the crank counter operation processing unit 55 writes the current value (for example, zero) immediately after the activation of the electronic control device 100, the previous value can be made different from the current value.

Next, the crank counter operation processing unit 55 interrupts the slave core 53 via the INT1 and the communication line 43 (S50). Thereafter, in the master core 52, the crank synchronization processing unit 54 performs crank synchronization processing (S60).
The slave core 53 performs an interrupt acceptance process (S100). The interrupt acceptance process is mainly handled by the INT 33. This process is performed by, for example, determining the priority of the process being executed and the priority of the interrupt request, and the context of the process being executed when it is determined that the interrupt is accepted (register value, Storage of the calculation result, stack pointer value, etc.). When receiving the interrupt, the slave core 53 activates the crank synchronization process execution determination unit 57.

  The crank synchronization process execution determination unit 57 compares the previous value and the current value in the shared RAM 51 (S110). That is, the current value and the previous value are read and compared from the address where the current value and the previous value of the shared RAM 51 are stored. The address of the shared RAM 51 where the current value and the previous value are stored is determined in advance.

  When the current value matches the previous value (Yes in S120), the crank synchronization process execution availability determination processing unit 57 determines that the event is erroneously notified (S130). In this case, the slave core 53 ends the process without executing the crank synchronization process.

  If the current value does not match the previous value (No in S120), the crank synchronization process execution availability determination processing unit 57 determines that the event notification is normal (S140). Since the crank counter gradually increases, if the event notification is normal, the current value does not match the previous value. In other words, if the current value does not match the previous value, the master core 52 crank counter operation process The unit 55 may record any information (numerical value, flag, symbol, character, etc.) in the current value of the shared memory 51. When recording information other than the crank counter, the crank counter operation processing unit 55 records information that does not have the same value at least continuously.

  Next, the crank synchronization process execution determination unit 57 copies the current value that has already been read to the previous value in the shared RAM 51 (S150).

  In addition, by providing a ring buffer that can store a predetermined number (about 10) of crank counters in the shared memory 51, it is possible to omit copying the current value to the previous value by the crank synchronization process execution determination unit 57. In this case, the crank synchronization process execution determination unit 57 includes a pointer (indicating the address of the current value) that increases in conjunction with the event notification, and sets two adjacent crank counters in the ring buffer according to the pointer value. Read it out.

  Next, since the crank synchronization processing execution availability determination processing unit 57 calls the crank synchronization processing unit 54, the crank synchronization processing unit 54 executes the crank synchronization processing (S160).

  Through the processing as described above, the slave core 53 misdetermines an erroneous notification of an event caused by an external electric noise, a contact failure of an interrupt signal line or a short circuit as a normal notification, and performs a crank synchronization process. It is possible to prevent execution.

〔sequence〕
FIG. 7 is an example of a sequence diagram when the slave core 53 has acquired a normal event notification.
Time t1: The master core 52 receives the NE sensor signal and executes crank counter operation processing.
Time t2: The master core 52 writes the current value to the shared RAM 51.
Time t3: The master core 52 notifies the slave core 53 of the event. Thereafter, the master core 52 executes crank synchronization processing.
Time t4: The slave core 53 reads the current value and the previous value, and determines whether or not there is an erroneous notification of the event. If it is not an erroneous notification of the event, the slave core 53 copies the current value to the previous value. The slave core 53 executes crank synchronization processing.

  Thereafter, each time the NE sensor 21 outputs an NE sensor signal, a series of processing is repeated.

FIG. 8 is an example of a sequence diagram in the case where the slave core 53 acquires an erroneous notification of an event. The processing from time t1 to t4 is the same as in FIG.
Time t5: The slave core 53 acquires erroneous detection of the event due to noise or the like. The slave core 53 reads the current value and the previous value, but the current value and the previous value remain the same as shown in FIG. In this case, the slave core 53 does not copy the current value to the previous value, and does not execute the crank synchronization process at time 6.

  As described above, the electronic control device 100 according to the present embodiment can detect an erroneous notification of an event when an event is notified from one core to the other core by an interrupt. Although the processing load of the slave core 53 slightly increases as compared with the conventional case, the processing load is much smaller than when the shared memory is constantly monitored.

  In the first embodiment, the processing of the master core 52 and the slave core 53 has been described on the assumption that only two cores exist. In the present embodiment, the processing of the master core 52 and the slave core 53 when there are four cores is described. To do.

  FIG. 9 shows an example of a functional block diagram of the electronic control device 100. In FIG. 9, the description of the same part as in FIG. 5 is omitted. 9 has two master cores (referred to as master cores A and B for distinction) 52 and two slave cores (referred to as slave cores A and B for distinction) 53, respectively. The master core A and the master core B have the same function, and the slave core A and the slave core B have the same function. However, since the engine 200 is one, the electronic control unit 100 determines the engine 200 according to any set of calculation results. Control is sufficient. For example, switch the master / slave core pair used each time IG (ignition) / ON, or always perform engine control when the same operation is performed by two sets of master cores and slave cores. There are usage modes such as to do.

In the slave cores A and B of this embodiment, the crank synchronization process execution availability determination processing unit 57 determines whether or not the crank synchronization process similar to that of the first embodiment can be executed, but further has the following functions.
Each time an erroneous detection of an event is detected, the number of erroneous notifications in the shared RAM 51 is increased by one.
When the IG is OFF, the two erroneous notification counts A and B in the shared RAM 51 are saved in the nonvolatile memory.

  Each time the crank counter operation processing unit 55 of the slave core A and the slave core B detects an erroneous notification, the crank counter operation processing unit 55 compares the two erroneous notification counts A and B at the time of activation such as IG / ON or periodically. When the difference between the two erroneous notification counts A and B exceeds a predetermined value, the slave core 53 with the larger erroneous notification count notifies the slave core 53 with the smaller notification count of the processing stop request. By doing so, it is possible to avoid the arithmetic processing of the combination of the slave core 53 and the master core 52, which often causes erroneous detection of events, and improve the reliability of the arithmetic result.

  FIG. 10 is an example of a diagram illustrating calculation stop processing based on the number of erroneous notifications. In FIG. 10, the processing after the slave core A detects an erroneous notification of the event will be described. However, when the slave core B detects an erroneous detection of the event, the processing of the slave cores A and B is only reversed. The process flow is the same.

  The crank synchronization process execution availability determination processing unit 57 of the slave core A that has detected the erroneous notification of the event in step S130 counts up the number of erroneous notifications (S210). In the present embodiment, at the timing when the erroneous notification is detected, the crank synchronization process execution determination processing unit 57 compares the two erroneous notification counts A and B (S220).

  The crank synchronization process execution possibility determination processing unit 57 determines whether or not the absolute value of the difference between the erroneous notification count A and the erroneous notification count B exceeds a threshold value (S230). Since the number of false notifications A and the number of false notifications B should be approximately the same, this threshold is set to a significant difference, for example, 20-30%, which is the larger of the number of false notifications A and the number of false notifications B.

  When the absolute value of the difference between the erroneous notification count A and the erroneous notification count B does not exceed the threshold (No in S230), the crank synchronization process execution availability determination processing unit 57 does nothing and ends the flow of the figure.

If the absolute value of the difference between the number of false notifications A and the number of false notifications B exceeds the threshold (Yes in S230), the reliability of the pair of the slave core 53 and the master core 52 with the larger number of false notifications may decrease. Therefore, the crank synchronization process execution availability determination processing unit 57 stops the processing of the set of the slave core 53 and the master core 52 having the larger number of erroneous notifications.
The number of erroneous notifications A-the number of erroneous notifications B> threshold The crank synchronization process execution availability determination processing unit 57 stops the operations of its own master core A and slave core A.
The number of erroneous notifications B-the number of erroneous notifications A> threshold The crank synchronization process execution availability determination processing unit 57 stops the computation of the other master core B and slave core B.

  Therefore, the crank synchronization process execution availability determination processing unit 57 notifies the other slave core B of a stop instruction or a stop notification (S240). The determination processing unit 57 for determining whether or not the slave core B can perform the crank synchronization processing receives a stop instruction or a stop notification (S250).

  In the case of a stop instruction, the slave core B crank synchronization process execution availability determination processing unit 57 communicates with the master core B to perform a stop process (e.g., saving the actuator being controlled, saving the settings, etc.). When it becomes possible to stop, the slave core A is notified that the stop instruction has been accepted (S260).

  When the slave core A stops (in the case of a stop notification), the crank synchronization process execution availability determination processing unit 57 of the slave core B notifies the slave core A that the stop notification has been received (S260).

  Thereby, the slave cores A and B perform a stop instruction or a process necessary for the stop (S270, S280). The slave core 53 and the master core 52 on the stopping side write out any necessary variables in the slave core 53 and the master core 52 that continue the calculation, and turn off the power supply. The slave core 53 and the master core 52 on the non-stop side read out from the shared memory if there are necessary variables from the slave core 53 and the master core 52 that stop the calculation, and continue the calculation as it is.

  As described above, in the present embodiment, the master core and the slave core that are frequently erroneously detected in the event are stopped using the fact that there are four cores, so that the reliability of the calculation result can be improved.

  In the second embodiment, a decrease in reliability of the master core 52 and the slave core 53 is detected from the number of erroneous detections. However, in this embodiment, in the electronic control device 100 that controls the engine when the two calculation results match, An electronic control device 100 that detects a decrease in reliability of the slave core 53 using the number of erroneous notifications when the results do not match will be described.

  That is, it is assumed that the slave core 53 having a large number of erroneous notifications is easily affected by noise and the like and it is difficult to obtain a correct calculation result, so that a decrease in the reliability of the slave core 53 can be detected.

  FIG. 11 shows an example of a functional block diagram of the electronic control device 100. In FIG. 11, the description of the same parts as in FIG. The electronic control device 100 of FIG. 11 has one master core 52 and two slave cores 53 (slave cores A and B). Although the slave core A and the slave core B have the same function, in this embodiment, the slave core B writes the calculation result in the shared memory 51 without using it for engine control. Then, the crank synchronization processing unit 56 of the slave core A reads the calculation result from the shared memory 51, compares it with its own calculation result, and verifies the reliability of the slave core A and the slave core B based on whether or not they substantially match. .

  The slave core A may write the calculation result to the shared memory 51 and the slave core B may compare it with its own calculation result. Both the slave core A and the slave core B write the calculation result to the shared memory and The illustrated slave core C can also compare the calculation results.

  For example, when the calculation results differ by a predetermined number of times or more, the slave core A estimates that there is an abnormality in the slave core 53 having the larger number of false notifications A and the number of false notifications B, and stops the subsequent computation. By doing so, it is possible to identify not only the magnitude of the number of erroneous notifications but also the disconnection or short circuit of the slave core 53 or the communication line 43 that is highly likely to be abnormal using the calculation result. In the second embodiment, the absolute value of the difference between the false notification counts A and B needs to exceed the threshold. However, in this embodiment, the absolute value of the difference between the erroneous notification counts A and B does not exceed the threshold. It is possible to identify the slave core 53 that is highly likely to be.

  FIG. 12 is an example of a diagram illustrating a calculation process stop process based on the calculation result and the number of erroneous notifications. FIG. 12 illustrates a procedure after the slave cores A and B start crank synchronization processing.

  First, the crank synchronization processing unit 56 of the slave B writes the calculation result of the crank synchronization processing in the shared memory (S310). When written, the crank synchronization processing unit 56 preferably notifies the slave core A by interruption or inter-core communication.

  The crank synchronization processing unit 56 of the slave core A also ends the crank synchronization processing at substantially the same time (S320). The crank synchronization processing unit 56 reads the calculation result of the shared memory 51 and determines whether or not it matches the calculation result of itself (S330). Although depending on the number of significant digits of the calculation result and the rounding method, both slave cores A and B are normal but the calculation result may not completely match, so the range that can be regarded as matching (for example, several% to The difference is determined by about 10%, and the coincidence is determined.

  When the two calculation results match (Yes in S330), the crank synchronization processing unit 56 of the slave core A controls the engine 200 using its own calculation result (S340).

  When the two calculation results do not match (No in S330), the crank synchronization processing unit 56 of the slave core A reads the erroneous notification count A and the erroneous notification count B from the shared memory 51 and compares them (S350). Then, the crank synchronization processing unit 56 executes a stop instruction or a stop process according to the number of erroneous notifications (S360).

When the erroneous notification count A> the erroneous notification count B, the crank synchronization processing unit 56 of the slave core A requests the slave core B to perform crank synchronization processing. Thereby, thereafter, the crank synchronization processing unit 56 of the slave core B can control the engine 200 using the calculation result of the crank synchronization processing. Thereafter, the crank synchronization processing unit 56 of the slave core B does not have to write the calculation result to the shared memory 51.

・ If false notification count A <false notification count B,
The crank synchronization processing unit 56 of the slave core A requests the slave core B to stop the crank synchronization processing. Thereby, thereafter, the crank synchronization processing unit 56 of the slave core B does not perform the crank synchronization processing and does not write the calculation result to the shared memory 51. Further, the crank synchronization processing unit 56 of the slave core A controls the engine 200 based on the calculation result of its own crank synchronization processing.

・ In case of false notification count A = false notification count B,
In this case, the fact that the calculation results do not match may be different from the erroneous detection of the event. For example, the master core 52 is requested to perform the crank synchronization processing of the slave core 53, and the slave core A and the slave core B It is possible to verify which of the calculation results is correct, or to request the fourth core to perform the crank synchronization processing of the slave core 53 and verify which of the calculation results of the slave core A and the slave core B is correct. If it is known which of the calculation results of the slave core A and the slave core B is correct, the slave core 53 which is not correct is requested to stop the crank synchronization process.

  As described above, the electronic control device 100 according to the present embodiment estimates that the slave core 53 having a large number of erroneous notifications is easily affected by noise and the like and cannot easily obtain a correct calculation result. Can be detected.

  In this embodiment, an electronic control device 100 that stops detecting the number of erroneous events when the electronic control device 100 is mounted on a hybrid vehicle will be described.

  FIG. 13 is an example of a diagram showing an electronic control unit (engine ECU) 100 connected to the hybrid ECU 101 via an in-vehicle LAN. The hybrid ECU 101 can be switched to three modes of a power mode, an eco mode, and an EV mode based on the remaining battery level, the accelerator pedal depression amount, the vehicle speed, and the like. Among these, the EV mode is a mode in which the vehicle travels only with the electric motor, and the engine 200 is forcibly stopped.

  Even in the EV mode, if electric power is supplied to the electronic control unit 100 and the NE sensor 21 outputs the NE sensor signal, the crank counter operation process and the crank synchronization process can be executed. However, in the EV mode, the NE sensor signal cannot be output because the engine 200 is stopped, and the event notification cannot be output from the master core 52 to the slave core 53.

  Therefore, when the electronic control device 100 mounted on the hybrid vehicle as in the present embodiment detects that it is in the EV mode, the crank synchronization process execution availability determination processing unit 57 simply receives the notification of the event. It is possible to detect a false notification. Therefore, it is not necessary to compare the current value with the previous value to detect an erroneous notification of the event.

  Further, when determining the master core 52 and the slave core 53 to be stopped based on the difference in the number of erroneous notifications, and when performing engine control when a plurality of slave cores 53 execute crank synchronization processing and the calculation results match, If the number of erroneous notifications in the EV mode is counted, it becomes easy to specify the highly reliable slave core 53.

  When the electronic control device 100 of this embodiment is mounted on a hybrid vehicle, it can easily detect erroneous detection of an event using the EV mode.

21 NE sensor 51 Shared memory 52 Master core 53 Slave core 54, 56 Crank synchronization processing unit 55 Crank counter operation processing unit 57 Crank synchronization execution availability determination processing unit 100 Electronic control unit 200 Engine

Claims (9)

A first core and a second core;
Communication means for enabling communication between the first core and the second core;
A shared memory shared by the first core and the second core;
A first processing unit included in the first core that repeatedly executes a first process every time an external signal is acquired, and writes predetermined information to the shared memory for each first process;
Processing request means for outputting a processing request to the second core via the communication means for each first processing;
A second processing unit that executes a second process triggered by the processing request provided in the second core;
When the second core receives the processing request, the second core reads the latest predetermined information and the previous predetermined information from the shared memory, and the relationship defined by the latest predetermined information and the previous predetermined information is determined. A microcomputer comprising: a comparison unit that permits the second processing unit to execute the second process only in some cases. The comparison unit determines that the processing request is an erroneous notification when there is no relationship defined in the latest predetermined information and the previous predetermined information.
The microcomputer according to claim 1. The comparison means, when there is a relationship defined in the latest predetermined information and the previous predetermined information, the latest predetermined information of the shared memory is copied to the previous predetermined information;
The microcomputer according to claim 1 or 2.   The microcomputer according to claim 1, wherein the prescribed relationship is that the latest predetermined information is different from the previous predetermined information. The first processing means stores, in the shared memory, the processing result of the first processing whose numerical value increases for each of the first processing as the predetermined information,
5. The microcomputer according to claim 4, wherein the specified relationship is that the latest predetermined information is larger than the previous predetermined information. A third core comprising the first processing means;
A fourth core provided with the second processing means and the comparison means,
The comparing means of the second core and the fourth core respectively count the number of times the relationship between the latest predetermined information and the previous predetermined information is not defined,
When the difference between the two times exceeds a threshold, the first processing of the first core and the second core or the third core and the fourth core having the larger number of times Stopping the means, the second processing means and the comparison means;
The microcomputer according to any one of claims 1 to 5. A third core comprising the second processing means and the comparison means;
The comparing means of the second core and the third core respectively count the number of times that there was no relationship defined in the latest predetermined information and the previous predetermined information,
The second processing unit of the second core outputs a processing result when the processing result of the second processing unit of the third core substantially matches the processing result of the second processing unit of its own. Used for control,
When the processing result of the second processing means of the third core does not substantially match the processing result of the second processing means of its own,
The second processing unit of the second core stops the second processing unit and the comparison unit of the third core when the number of times of the second core is smaller than the number of times of the third core. And
Stopping the second processing means and the comparing means of itself when the number of times of the self is greater than the number of times of the third core;
The microcomputer according to any one of claims 1 to 5. The first process is a process of counting the crank angle, and the second process is a determination of the energization timing of the igniter and a determination of the ignition start timing of the igniter, or the determination of the fuel injection amount by the injector and the fuel injection timing Is a decision,
The microcomputer according to any one of claims 1 to 7, characterized in that: A process synchronization method for a microcomputer having a plurality of cores,
The first processing unit of the first core repeatedly executes the first process every time an external signal is acquired, and the first core and the second core share predetermined information for each first process. Writing to the shared memory;
The processing request means of the first core sends a processing request to the second core for each of the first processes via a communication means that enables communication between the first core and the second core. Output step;
When the second core comparison unit accepts the processing request, it reads the latest predetermined information and the previous predetermined information from the shared memory, and is defined in the latest predetermined information and the previous predetermined information. A step of permitting the second processing means to execute the second process only when there is a relationship,
The second processing means of the second core executing the second processing triggered by the processing request;
A process synchronization method comprising:

Images