TECHNICAL FIELD

The present invention relates a method for detecting an abnormality in an execution time of a process managed by an operating system (OS) of a vehicle control device.

BACKGROUND ART

In recent years, many vehicle control systems include ECUs that operate electronic vehicle control equipment, that is, electronic control units, and in-vehicle local area networks (LANs) that enable communication between multiple ECUs. These vehicle control systems are becoming increasingly sophisticated, distributed, and complicated in accordance with reduction in environmental loads and safety requirements. As a result, the importance of standardizing software architecture of ECUs, electronic control of safety devices, and mechanisms for ensuring their safety is increasing.

A functional safety mechanism has been introduced into a vehicle control system in accordance with electronic control of a safety device in a vehicle control device. Here, functional safety is electricity. The idea is to ensure safety by making the system transition to the safe side when a failure occurs in the electronic system. For example, in the ISO 26262 functional safety standard for automobiles, the automotive safety integrity level (ASIL), which is a safety level unique to the standard, is established, and in order to comply with the highest level ASIL D, it is required to prove to a third party that the main functions, safety devices, and monitoring devices are clearly separated in functions related to the safety of vehicle control devices.

When functional safety standard ISO26262 is applied to a general vehicle control device, it is known that various ASIL software is mixed in the vehicle control system. Therefore, in order for existing software to comply with the functional safety standard, a mechanism for preventing interference between software, and technologies for speeding up processes related to the mechanism, reducing weight, and improving reliability are necessary. There are a time protection function, a memory protection function, and a data protection function as a mechanism for preventing interaction between software constituting the system. Specifically, it is to prevent QM software with a low safety level from running out of control, disturbing the operation of software with a high safety level such as ASIL D software, and affecting the system.

PTL 1 descried below realizes, in order to provide a mechanism for detecting a failure that has occurred in real time, means in which a WDT linked to a multi-stage WDT is interlinked with the system in a stepwise and powerful manner and means in which minor failures that is recovered by interrupt is dealt with interrupting, moderate failures that can only be recovered by non-maskable interrupts is dealt with non-maskable interrupt, and severe failures that cannot be recovered except by restarting is dealt with system reset.

CITATION LIST

Patent Literature

PTL 1: JP 2002-251300 A

SUMMARY OF INVENTION

Technical Problem

In a system in which operation continuity of the system is required for a certain period of time even if an abnormality occurs, a mechanism is required which stops only the process in which the abnormality has occurred, maintains the functions of the entire system, and does not stop the functions as much as possible. However, in the conventional method, a timer interrupt is used to detect an execution time abnormality (timeout), and therefore an abnormality cannot be detected when interrupt is disabled. Further, another problem is that if non-maskable interrupts (NMI) are used to solve the above-described problem, it is not possible to distinguish between critical sections (CS) necessary for design and abnormal interrupt disable.

Solution to Problem

The vehicle control according to the present invention is a vehicle control device that monitors a failure of a system, and includes task execution means for causing the system to execute a task, and interrupt processing means for performing an interrupt process when the task is executed. The vehicle control device includes a maskable interrupt and a non-maskable interrupt that is commanded to execute after the maskable interrupt. When the maskable interrupt is commanded to execute during the interrupt disable time, the non-maskable interrupt is further executed. Thus, the vehicle control device can detect an abnormality in real time and can apply an appropriate fail-safe process even if interrupt is disabled.

Advantageous Effects of Invention

According to the vehicle control device according to the present invention, when an abnormality occurs in a task, regardless of whether a critical section is being executed, timeout detection is realized by determining whether the critical section (CS) is necessary for the design in a preset task execution time and a certain period of time to distinguish between necessary interrupt disable and abnormal interrupt disable.

