JP-2026076337-A - Control device, control system, and control method

Abstract

[Problem] To provide a control device that can perform application communication and evaluation/verification communication simultaneously without straining the network's communication capacity. [Solution] A control device comprising a first hypervisor that generates a first virtual machine and a second hypervisor that generates a second virtual machine and communicates with the first hypervisor via a gateway, includes a communication control unit that, while the first virtual machine and the second virtual machine are running, dynamically limits at least one of the communication volume for application communication and the communication volume for evaluation and verification based on the execution status of application communication performed between the first hypervisor and the second hypervisor, the execution status of evaluation and verification communication performed between the first hypervisor and the second hypervisor, and the communication capacity of the gateway. [Selection Diagram] Figure 2

Inventors

• 森河 俊成
• 三ッ屋 郁哉
• 田口 元康
• 西脇 貴司
• 青木 裕哉
• 衛藤 光徳

Assignees

• パナソニックオートモーティブシステムズ株式会社

Dates

Publication Date

20260511

Application Date

20260217

Claims (12)

1. A control device that can be mounted on a vehicle, comprising a first hypervisor that controls the execution of a first virtual machine, and a second hypervisor that controls the execution of a second virtual machine and communicates with the first hypervisor via a gateway, The system includes a communication control unit that limits at least one of the traffic volume of application communication and the traffic volume of evaluation/verification communication, based on the execution status of application communication performed between the first hypervisor and the second hypervisor and the execution status of evaluation/verification communication performed between the first hypervisor and the second hypervisor. Control device.
2. The aforementioned communication control unit, If, during the startup of the first virtual machine and the second virtual machine, the sum of the traffic volume of application communications and evaluation/verification communications performed between the first hypervisor and the second hypervisor puts a strain on the gateway's communication capacity, the traffic volume of application communications and evaluation/verification communications is controlled so that the sum of the traffic volume of application communications and evaluation/verification communications does not exceed the gateway's communication capacity. The control device according to claim 1.
3. The communication control unit determines whether the communication capacity of the gateway is being strained based on a congestion control signal indicating that the communication volume of the gateway has exceeded a threshold. The control device according to claim 2.
4. The aforementioned communication control unit, When the aforementioned congestion control signal is obtained, the application communication is given priority. The control device according to claim 3.
5. The system further includes a transfer unit that, before starting the first virtual machine and the second virtual machine, transfers the execution state and execution content of the evaluation and verification virtual CPU from the first hypervisor to the second hypervisor. The control device according to claim 1.
6. If, under the second hypervisor that receives the execution state and execution details of the virtual CPU for evaluation and verification, there is no device used by the virtual CPU, the second hypervisor further includes a generation unit that virtually creates the device. The control device according to claim 5.
7. The aforementioned communication control unit, If the amount of untransmitted data between the first hypervisor and the second hypervisor exceeds a predetermined value, the operation of the first virtual machine and the second virtual machine is interrupted to transmit the untransmitted data between the first hypervisor and the second hypervisor. The control device according to claim 1.
8. The aforementioned communication control unit, When the amount of untransmitted data between the first hypervisor and the second hypervisor falls below a predetermined value, the operation of the first virtual machine and the second virtual machine is restarted. The control device according to claim 7.
9. The control device is The system includes a virtual machine that performs some of the processing performed by the first hypervisor by communicating with the first hypervisor. The control device according to claim 1.
10. The communication control unit limits at least one of the communication volume for application communication and the communication volume for evaluation and verification communication based on the execution status of application communication performed between the first hypervisor and the second hypervisor, the execution status of evaluation and verification communication performed between the first hypervisor and the second hypervisor, and the communication capacity of the gateway. The control device according to claim 1.
11. A control system that can be mounted on a vehicle, comprising a first hypervisor that controls the execution of a first virtual machine, and a second hypervisor that controls the execution of a second virtual machine and communicates with the first hypervisor via a gateway, The system includes a communication control unit that limits at least one of the traffic volume of application communication and the traffic volume of evaluation/verification communication, based on the execution status of application communication performed between the first hypervisor and the second hypervisor and the execution status of evaluation/verification communication performed between the first hypervisor and the second hypervisor. Control system.
12. A control method performed by a control device that can be mounted on a vehicle, comprising a first hypervisor that controls the execution of a first virtual machine, and a second hypervisor that controls the execution of a second virtual machine and communicates with the first hypervisor via a gateway, Based on the execution status of application communication performed between the first hypervisor and the second hypervisor, and the execution status of evaluation and verification communication performed between the first hypervisor and the second hypervisor, a communication control process is performed to limit at least one of the communication volume of the application communication and the communication volume of the evaluation and verification communication. Control method.

Description

This disclosure relates to a control device, a control system, and a control method. Recently, in the trend towards integrated ECUs (Electronic Control Units) that combine and use multiple ECUs, there has been a growing need for evaluation and verification of virtual machines (VMs) that operate across multiple ECUs. For example, Patent Document 1 discloses an example of constructing a virtualization infrastructure spanning multiple ECUs by transferring the virtual CPU context and working memory, which indicate the execution state and content of the virtual CPU managed in memory by the hypervisor, to physically different ECUs using a general-purpose network. Japanese Patent Publication No. 2022-31363 Figure 1 is a block diagram showing an example of a schematic configuration of a vehicle control system.Figure 2 is a functional block diagram showing an example of the functional configuration of the hypervisor included in a vehicle control system.Figure 3 shows an overview of the communication control performed by the hypervisor in the first embodiment.Figure 4 is a flowchart showing an example of the processing flow performed by the hypervisor of the first embodiment.Figure 5 is a block diagram showing an example of a schematic configuration of a vehicle control system according to the second embodiment.Figure 6 is a block diagram showing an example of a schematic configuration of a vehicle control system according to the third embodiment. (First embodiment) Hereinafter, various embodiments of the vehicle control system according to this disclosure will be described with reference to the drawings. (Outline configuration of the vehicle control system) First, the general configuration of the vehicle control system according to all embodiments described below will be explained. The vehicle control system 10a is mounted on a vehicle and performs desired vehicle control through the coordinated operation of an infotainment system, such as a car navigation system, and an ITS system (Intelligent In Transportation Systems). Figure 1 will be used to explain the schematic configuration of the vehicle control system 10a. Figure 1 is a block diagram showing an example of the schematic configuration of a vehicle control system. The vehicle control system 10a comprises machine 12a, machine 12b, gateway 20, CPU (1) 24a, CPU (2) 24b, and CPU (3) 24c. Machine 12a is, for example, an example of an information processing device that constitutes an infotainment system such as a car navigation system. Machine 12a is an example of a control device in this disclosure. Machine 12b is, for example, an example of an information processing device that constitutes an ITS (Intelligent Transport System). Machine 12b is an example of a control device in this disclosure. Note that Machine 12a and Machine 12b may be physically separated, or they may exist within a single ECU or CPU. Machine 12a comprises a virtual ECU VM(1) 14a, a virtual ECU VM(2) 14b, and a hypervisor 16a. Virtual ECU VM(1) 14a and Virtual ECU VM(2) 14b are virtual machines that execute various applications running on machine 12a and perform evaluation and verification related to the operation of said applications. Here, evaluation and verification refers to processes such as outputting trace data including various operation logs and timestamps related to the operating status of machine 12a. Virtual ECU VM(1) 14a and Virtual ECU VM(2) 14b are examples of the first virtual machine in this disclosure. Furthermore, virtual ECU VM(1) 14a and virtual ECU VM(2) 14b may operate on different operating systems (OS). Also, the number of virtual ECU VMs on machine 12a is not limited. Hypervisor 16a is software for virtualizing a computer. Hypervisor 16a generates virtual computers, virtual ECU VM(1) 14a and virtual ECU VM(2) 14b, within the physical machine. Note that hypervisor 16a is an example of the first hypervisor in this disclosure. The hypervisor 16a comprises memory (2-1) 18a, memory (2-2) 18b, and memory (2-3) 18c. Memory (2-1) 18a, memory (2-2) 18b, and memory (2-3) 18c are memory areas that are partitions of the main memory (e.g., RAM) provided by machine 12a. Memory (2-1) 18a is a memory area that stores data (e.g., programs) for operating the virtual ECU VM (2) 14b on the CPU (1) 24a. Memory (2-2) 18b is a memory area that stores data for operating the virtual ECU VM (2) 14b on the CPU (2) 24b. Memory (2-3) 18c is a memory area that stores data for operating the virtual ECU VM (2) 14b on the CPU (3) 24c. CPU (1) 24a, CPU (2) 24b, and CPU (3) 24c, in cooperation with the hypervisor 16a, respectively, operate virtual ECU VM (1) 14a and virtual ECU VM (2) 14b. Machine 12b comprises a virtual ECU VM(3) 14c, a virtual ECU VM(4) 14d, and a hypervisor 16b. Virtual ECU VM(3) 14c and Virtual ECU VM(4) 14d are virtual machines that run various applications, evaluations, and verifications on machine 12b. Virtual ECU VM(3) 14c and Virtual ECU VM(4) 14d are examples of the second vir