Hitachi Automotive Systems, Ltd.

Hitachi, Ltd.

Hitachi Astemo Ltd.

Fumio Narisawa

Tasuku Ishigooka

Takeshi Fukuda

Tomohito Ebina

Kentaro Yoshimura

Tsunamichi Tsukidate

Satoshi Otsuka

Yuichiro Morita

Junji Miyake

Hiroaki Komatsu

Kohei Sakurai

Koji Hashimoto

Nobuhisa Motoyama

Hideyuki Sakamoto

Kazuyoshi Serizawa

Yuki Tanaka

Keiichiro Ohkawa

Takanori Yokoyama

Hidemitsu Naya

Yusuke Abe

Yoshitaka Atarashi

Kazuyoshi Sasazawa

Wataru Nagaura

Masahiro Matsubara

Hiroto Sasaki

Hideyuki Hara

Kosei Goto

Kouji Hashimoto

Masashi Mizoguchi

Hiroki Maehama

Neeraj Suri

Yuji Fukushima

Yasunori Murashima

Swarn Singh Rathour

Hiroyuki Nakamura

Habib Saissi

Thorsten Piper

Stefan Winter

Hidetoshi Ogura

Atsuhiro Ohno

Toru Irie

To appropriately execute a task by an electronic control device including a processor having a plurality of cores. An ECUincludes a multi-core CPU having a plurality of cores that execute a first task that has an execution time that varies depending on a processing amount every predetermined cycle and a second task that is higher in priority than the first task and is prohibited from being interrupted. The second task is set to be inexecutable simultaneously between the plurality of cores. A task allocation unitgenerates a first plan. A diagnosis task planning unitgenerates a second plan. Task processing unitsandexecute the first task based on the first plan. A diagnosis task correction unittimes a delay time of the first task executed by the task processing unitsand, and postpones the second task of the second plan to the subsequent executable timing in accordance with the timed delay time. A diagnosis unitexecutes the second task for each core based on the second plan corrected by the diagnosis task correction unit

Electronic control device

An object of the present invention is to provide a vehicle control device and a vehicle control system capable of further reducing system cost in failure mitigation. The vehicle control device includes a master ECU and one or more client ECUs. The master ECU generates a safety process list on a basis of a predetermined failure operation pattern and transmits the safety process list to each of the client ECUs when detecting a failure of any one of the client ECUs, the safety process list includes one or more safety processes and an execution start time limit corresponding to each of the safety processes, each of the client ECUs switches an operation mode from a normal mode to a failure operation mode in response to reception of the safety process list, and starts execution of each of the safety processes by a corresponding execution start time limit, the failure operation pattern is configured such that each of the safety processes is executed by a client ECU having a memory capacity capable of executing the safety process, and the failure operation pattern is configured such that the same safety process is not executed by a plurality of client ECUs.

Vehicle control device and vehicle control system

An object of the present invention is to provide a simulation device having a function of adding delay processing for making an execution timing of a personal computer (PC) simulation environment close to that of an actual electronic control unit (ECU). There is provided a simulation device for converting application software into an execution code, verifying the execution code, and porting the verified execution code to another computer device, wherein the simulation device adjusts an execution timing in the other computer device by performing time adjustment processing at the time of starting or ending a function in function units of a source code of an application.

Simulation device

A software management device capable of converting a term used in a model and an abstraction level thereof. The software management device includes an input unit that inputs a target model, a storage unit that hierarchically stores functions and/or names constituting the model, and an in-model name replacement unit that selects a corresponding function and/or name from the storage unit according to the input model input from the input unit, and replaces a function and/or a name in the input model with the selected function and/or name.

Software management device

In the present invention, control feasibility in a vehicle control system architecture is efficiently determined by performing determination based on control feasibility in a physical element based on a converted parameter when a logical architecture is arranged in a physical architecture. The present invention includes: an arrangement unitthat arranges a logical architecture, which includes a linkage of each of logical functions and an execution time constraint of the linkage, in a physical architecture; a delay time calculation unitthat calculates a processing delay time based on a converted parameter when the logical architectureis arranged in the physical architecture; and a verification unitthat verifies whether a total of the processing delay time satisfies the execution time constraint.

Vehicle control system validation technique and validation device, and control device

Provided is a vehicle control device capable of reducing a control gap that occurs when a system is restored to a normal state after a malfunction is corrected, thereby achieving smooth driving performance for a user. A vehicle control device according to the present invention has a first travel control mode and a second travel control mode. When in a transitional state from the second travel control mode to the first travel control mode, the vehicle control device calculates and checks a first control parameter used in the first travel control mode, calculates a second control parameter used in the second travel control mode, and uses the second control parameter for traveling control.

Vehicle control device

In the present invention, computational efficiency degradation is suppressed when diagnosing a shared storage area in a vehicle control device in which a plurality of computing units are employed. This vehicle control device suppresses computational efficiency degradation by changing an access destination in a storage device while diagnosing a shared storage area that the storage device has.

Provided is a vehicle control apparatus with which it is possible to allocate programs to multiple cores so as to satisfy a deadline even when software programs having two or more control cycles are intermixed. The vehicle control apparatus pertaining to the present invention allocates tasks to processor cores in consideration of the execution order of the tasks, the execution cycles of the tasks, and the cost of communication between the processor cores.

Vehicle control apparatus

The present invention provides a vehicle control apparatus in which a function stop caused by an access conflict when a high load is applied can be suppressed. The vehicle control apparatus according to the present invention determines the occurrence tendency of access conflicts by using a function expressed by the number of times of performing exclusive control on a shared storage area and by the number of the resultant access conflicts.

The present invention provides a vehicle control device with which, even when an abnormality is detected in a core in a multi-core processor, it is possible to reduce the time needed until the core in which the abnormality is detected restarts and re-executes application software. The present invention is characterized by being provided with: a diagnostic means for carrying out a diagnostic process when starting a processor core, the diagnostic process including hardware diagnosis performed by hardware and software diagnosis performed using software after the hardware diagnosis; and a diagnostic process information change processing means for changing the method for executing the diagnostic process when all of the processor cores are started and when one of the processor cores is restarted.

In order to detect and prevent attacks in which the network is infested with unauthorized data to cause malfunction, the invention aims, on the basis of network cycle information, to detect errors and to prevent unauthorized data forwarding in a network system such as a vehicle-mounted network. This network device is provided with a communication unit which receives data, a time management unit which manages the reception time at which data is received, and a control unit which processes data. If, for received data used as a reference, first data is received having the same identifier and a reception interval shorter than a prescribed cycle, the control unit waits to receive data having the same identifier as the first data from the reception time of the received data used as a reference up until the prescribed cycle has elapsed, and if during this interval second data is received having the same identifier as the first data, the control unit determines that an error has occurred and performs cycle abnormality detection processing.

Network device, and data sending and receiving system

Executing control software with an appropriate execution priority in accordance with a safety standard in a vehicle control device that executes a plurality of control software having different safety standards suppresses priority degree reversal. A vehicle control device is provided with an execution waiting job list retaining a list of jobs waiting for execution by a processor. A request for calling higher safety software from lower safety software is inserted at a position in the execution waiting job list in accordance with the execution priority of the lower safety software.

A method for testing control software of a controlled system is disclosed. The method may involve providing control software code data for each of the one or more electronic control units. The method may further involve providing simulation code data for the controlled system. The method may further involve providing verification requirement information data that indicates one or more verification requirement conditions corresponding to a respective control error situation. The method may further involve creating a system model based on the provided simulation code data and the provided control software code data provided for each of the one or more electronic control units. The method may further involve creating an executable program based on the created system model and performing a software verification process on the basis of the executable program.

Method and system for testing control software of a controlled system

If exclusive control is used when carrying out update processing or reference processing to a data buffer in a shared memory among plural arithmetic units, waiting time increases and it is difficult to guarantee a real time property. Accordingly, in a control device for a vehicle, a data buffer is multiplexed, and each arithmetic unit carries out update processing and reference processing to a different multiplexed data buffer. An arithmetic unit that is different from the arithmetic unit executing the data update processing synchronizes one data buffer updated by data update processing, with the multiplexed data buffer, in a shorter time than an execution cycle of the data update processing.

Arithmetic units accessing redundantly stored data in shared memory as part of a control device for a vehicle

In the present invention, on the basis of the results of determining whether or not a constituent element of a vehicle control device is malfunctioning, the malfunction determination logic for determining whether or not the vehicle control device as a whole is malfunctioning is caused to be easily reusable. This vehicle control device determines the level of functional malfunction of the vehicle control device on the basis of what combination of hardware configuring the vehicle control device is malfunctioning, and executes a failsafe function that is in accordance with the level of functional malfunction (see FIG.).

Growing community of inventors

Tokyo, Japan

Fumio Narisawa