Patent Description:
The present disclosure relates to a semiconductor device, and is applicable to a semiconductor device used, for example, in an Electronic Control Unit (ECU).

Vehicles such as passenger cars, trucks, and buses are equipped with a large number of ECUs. Each ECU is interconnected and cooperates via an in-vehicle network. In-vehicle electronic architectures are becoming increasingly complex. To solve this problem, simplification of in-vehicle networks and integration of ECUs have been adopted as solutions for cost reduction in the entire in-vehicle electronic architecture (for example, <CIT>).

<NPL> discloses a method for budget scheduling in a hierarchical scheduler used with vehicle ECU-software.

<NPL> teaches the integration of independently developed software components onto a single CPU. To avoid timing problems during the integration each software component is allocated a fraction of the computing resources.

Individual systems (ECUs) subject to functional integration are developed and verified by different companies (Tier1) due to the business form. Here, the Tierl is a primary supplier (primary subcontractor) that delivers products directly to a manufacturer. Thereafter, the vehicle is assembled by a vehicle manufacturer (hereinafter referred to as "OEM") that is in charge of vehicle assembly. At this time, the verification of the portion relating to the connection of each "individual system" is performed, and the verification of the function as a whole is completed. This is because the independence of "individual systems" is self-evident.

On the other hand, it is expected that "systems" developed as "individual systems" will be integrated, but this integration also requires that the functions defined and verified as "individual systems" are reliably realized.

Each Tierl develops and verifies software that implements the ECU functions for which it is responsible using the hardware of the integrated ECU. The integrated ECU may be composed of a plurality of operation resources corresponding to a single ECU function and a peripheral resource shared by the plurality of operation resources. In this case, each operation resource cannot occupy the peripheral resource, and the use is limited.

However, at the time of verification of the single ECU function in the integrated ECU, the peripheral resource is occupied, and the respective Tierl cannot verify the single ECU function in the integrated state. Other objects and new features will be apparent from the description of this specification and the accompanying drawings.

One typical aspect of the present disclosure will be briefly described below. A semiconductor device includes an operation resource which performs a plurality of ECU functions, a peripheral resource which is shared by the plurality of ECU functions, and a control mechanism which controls a period in which one of the ECU functions uses the peripheral resource. The control mechanism calculates, based on a budget value which is given in advance and is a performance allocation, a use prohibition period in which the one of the ECU functions is prohibited from using the peripheral resource within a predetermined unit time.

According to the above semiconductor device, the single ECU function can be verified in the integrated state.

An embodiment, an example and a modification will be described below with reference to the drawings. However, in the following description, the same components are denoted by the same reference numerals, and a repetitive description thereof may be omitted.

First, a function integration of an ECU will be described with reference to <FIG> and <FIG>. <FIG> is a diagram schematically showing a configuration of an ECU before integration, and <FIG> is a diagram schematically showing a configuration of an integrated ECU of a comparative example.

As shown in <FIG>, an ECU_A1a, an ECU_B1b, and an ECU_C1c before integration are mainly composed of semiconductor devices 10a, 10b, and 10c, respectively. Each of the semiconductor devices 10a, 10b, and 10c includes operation resources 100a, 100b, and 100c such as Central Processing Units (CPUs) and memories, and peripheral resources <NUM>. The ECU_A1a, the ECU_B1b, and the ECU_C1c are developed and verified by different companies (Tier1_A, Tier1_B, and Tier1_C), respectively. Thereafter, it is assembled by the OEM. At this time, verification of portions relating to the respective connections of the ECU_A1a, the ECU_B1b, and the ECU_C1c is performed, and verification of the function as a whole is completed. This is because independence of the ECU_A1a, the ECU_B1b, and the ECU_C1c is self-evident. When the Tier1_A, the Tier1_B, and the Tier1_C are represented, they are referred to as the Tierl.

As shown in <FIG>, the integrated ECU 1R of the comparative example is mainly composed of a semiconductor device 10R. The semiconductor device 10R includes an operation resource <NUM> and a peripheral resource <NUM> for performing the functions of the ECU_A1a, the ECU_B1b, and the ECU_C1c. For example, the operation resource <NUM> allocates one CPU and one memory to performance processing of the functions of ECU_A1a, ECU_B1b, and ECU_C1c in a time-division manner, and the peripheral resource <NUM> is shared. The integrated ECU 1R is developed and verified by the OEM, or any Tierl of the Tier1_A, the Tier1_B and the Tier1_C, or another Tier1. However, software for realizing the functions of the ECU_A1a, the ECU_B1b and the ECU_C1c is developed and verified in each of Tier1_A, Tier1_B, and Tier1_C.

Problems occurring in the integrated ECU 1R of the comparative example will be described with reference to <FIG>, <FIG> and <FIG>. <FIG> is a block diagram explaining verification of the integrated ECU of <FIG> by the Tierl, and <FIG> is a block diagram explaining verification of the integrated ECU of <FIG> by the OEM and the Tierl. <FIG> is a flowchart explaining verification of the integrated ECU of <FIG>.

Generally, the verification of each single ECU function is often performed by the Tierl responsible for development of each single ECU function, and the verification in the integrated state is performed by the OEM because of its nature. It is difficult for the OEM to perform the validation that the Tierl performs. Therefore, the verification of the integrated ECU function is performed at the stage of (<NUM>) verification of the function and timing of the single ECU by each Tierl, and (<NUM>) verification in the state integrated by a plurality of ECU by the OEM.

As shown in <FIG> and <FIG>, in the verification of the above (<NUM>), the Tier1_A, the Tier1_B, and the Tier1_C perform development and check of only software that each is in charge of by using the hardware of the integrated ECU 1R. That is, as shown in <FIG>, the Tier1_A develops the software for the function of the ECU_A (step SA1), and verifies the software for the function of the ECU_A (step SA2). Similarly, the Tier1_B develops the software for the function of the ECU_B (step SB1), verifies the software for the function of the ECU_B (step SB2), the Tier1_C develops the software for the function of the ECU_C (step SC1), and verifies the software for the function of the ECU_C (step SC2).

As shown in <FIG> and <FIG>, in the verification of the above (<NUM>), the OEM installs the software developed by the Tier1_A, the Tier1_B, and the Tier1_C together in the integrated ECU 1R and provided it to each Tier1 (step SO1).

Next, the Tier1_A checks (verifies) the operation of the software for the function of the ECU_A while operating the software for the function of the ECU_A, the software for the function of the ECU_B and the software for the function of the ECU_C in parallel (step SA3). Similarly, the Tier1_B checks (verifies) the operation of the software for the function of the ECU_B (step SB3), and the Tier1_C checks (verifies) the operation of the software for the function of ECU_C (step SC3). Finally, the OEM checks the operation in which the ECU_A, the ECU_B and the ECU_C cooperate (step SO2).

The steps SA1, SA2, SB1, SB2, SC1 and SC2 are the same as the design and verification performed by the Tier1 for the ECUs that are not integrated. The steps SO1 and SO2 are the same as the verification performed by the OEM for the ECUs that are not integrated. The steps of SA3, SB3 and SC3 are the validations performed by the Tierl that are increased by the integration. This is because of the following reason.

Although the peripheral resource <NUM> can be occupied in the case of the single ECU function evaluation, when the ECU integration is performed, the peripheral resource <NUM> is shared by each single ECU function. Therefore, although the verification of the function and timing of the single ECU is performed, the conflict of the peripheral resource <NUM> occurs, and therefore, it is required to confirm that the same operation as the operation at the time of the single ECU verification is performed even in the environment in which the functions are integrated. In other words, after the verification is performed alone, it is necessary to re-verify the state in which the functions are integrated.

In order to implement the integrated ECU in which a plurality of ECU functions are integrated, it is essential that the result of the verification performed in the above (<NUM>) can be used (the verification in the above (<NUM>) is unnecessary) when the verification is performed by integrating the plurality of ECU functions in the above (<NUM>). In other words, it is required to perform the verification of the above (<NUM>) so that the verification result of the above (<NUM>) can be utilized at the time of the verification of the above (<NUM>).

Therefore, in the integrated ECU, when the Tierl verifies the single ECU function, it is required to be able to perform the verification in a condition in which the peripheral resource is shared.

An integrated ECU according to an embodiment in which the single ECU_A1a, the single ECU_B1b, and the single ECU_C1c of <FIG> are integrated will be described with reference to <FIG> is a diagram schematically showing a configuration of the integrated ECU according to the embodiment.

The integrated ECU <NUM> according to the embodiment is mainly composed of a semiconductor device <NUM>. The semiconductor device <NUM> includes an operation resource <NUM> for performing the functions of the ECU_A1a, the ECU_B1b and the ECU_C1c, a peripheral resource <NUM>, and a control mechanism <NUM> for controlling the peripheral resource <NUM>. For example, the operation resource <NUM> allocates one CPU and one memory to processing of the operation resources 100a, 100b and 100c in a time-division manner, and the peripheral resource <NUM> is shared by the operation resources 100a, 100b, and 100c. Note that the operation resource <NUM> may be configured by a plurality of CPUs.

Next, the function of the control mechanism of <FIG> will be described with reference to <FIG> is a diagram showing a usable period and a use prohibition period within a unit time.

The control mechanism <NUM> creates a contended state by sharing the peripheral resource <NUM> at the time of the single ECU function verification of the above (<NUM>).

For example, the control mechanism <NUM> creates a use prohibition state corresponding to a budget value (BDG) allocated in advance to the shared peripheral resource <NUM>, thereby realizing the verification of the single ECU within the use frequency achieved at the time of integration. A setting of the BDG is determined from restriction requirements for each single ECU (performance allocation of each single ECU). A period during which the peripheral resource <NUM> is in the use prohibition state is referred to as a use prohibition period UP, and a period during which the peripheral resource <NUM> is in a usable state is referred to as a usable period UA. Assuming that a time of a unit time (UNIT TIME) is TU, a time of the use prohibition period UP is TP, the first time of the use prohibition period UP is TPa, the second time of the use prohibition period UP is TPb, and a time of the usable period UA is TA, <MAT> and <MAT> Here, when TP = TPa+TPb, T P= TU/ (<NUM>+BDG).

The time (TP) of the use prohibition period UP and the time (TA) of the usable period UA are determined based on the unit time (TU) and the budget value (BDG). As a result, the control mechanism <NUM> enables the peripheral resource <NUM> to be available only in a defined band at the time of the single ECU function evaluation.

Since the peripheral resource <NUM> may be discretely used within the budget value, it is not consistent with providing only one usable period. Thus, for example, the control mechanism <NUM> divides the usable period UA into the first usable period UA1, the second usable period UA2, the third usable period UA3 and the fourth usable period UA4, divide the use prohibition period UP into the first use prohibition period UP1, the second use prohibition period UP2, the third use prohibition period UP3, the fourth use prohibition period UP4 and the fifth usable prohibition period UP5, and cause the usable period UA to be dispersed. Here, when a time of the first usable period UA1 is TA1, a time of the second usable period UA2 is TA2, a time of the third usable period UA3 is TA3, a time of the fourth usable period UA4 is TA4, a time of the first use prohibition period UP1 is TP1, a time of the second use prohibition period UP2 is TP2, a time of the third use prohibition period UP3 is TP3, a time of the fourth use prohibition period UP4 is TP4, and a time of the fifth use prohibition period UP5 is TP5,<MAT>and<MAT>.

The use prohibition period is determined, for example, as follows:.

Moreover, the single ECU function may not continuously access the peripheral resource <NUM> due to the constraint of its own processing content. The state in which this access is not performed is referred to as an inaccessible state, and the period is referred to as an inaccessible period. If there is no use of the peripheral resource <NUM> other than during the use prohibition period, the period during which such use had not been made is deducted from the "the use prohibition period" and the inaccessible period potentially possessed by the single ECU function subject to the verification may not be recorded as the use prohibition period. Since the inaccessible period potentially possessed by the single ECU function subject to the verification is not included in the usable period, the inaccessible period potentially possessed by the single ECU function subject to the verification is recorded as the use prohibition period, and therefore, an excessive use prohibition period is not set.

The control mechanism <NUM> may be configured by hardware or software. The peripheral resource is a circuit for realizing an input or output interface function for a semiconductor device such as Input/Output (I/O) to which a peripheral device such as a communication controller for communicating with another ECU and the like, a sensor, a switch, an actuator and the like is connected, and is a circuit that can be shared by a plurality of ECU functions. In the following example, a case in which the control mechanism <NUM> according to the embodiment is configured by hardware and a case in which the peripheral resource is a communication controller will be described.

<FIG> is a diagram schematically showing a configuration of an integrated ECU of the example. As shown in <FIG>, the integrated ECU 1A is connected to a Controller Area Network (CAN) bus 2a, which is an in-vehicle network, and can communicate with another ECU and the like. The integrated ECU 1A can be connected to a debugger <NUM> via a debugger interface (I/F) <NUM>.

The ECU 1A is mainly composed of a semiconductor device 10A, such as a microcontroller or a System-On-Chip (SOC), and a transceiver Integrated Circuit (IC) 20a. The semiconductor device 10A includes a CPU <NUM>, a storage unit <NUM> for storing software programs 102a, 102b, and 102c for realizing each of the single ECU functions, a communication controller (communication peripheral circuit) 200a for CAN communication, a control circuit 300a, a control circuit <NUM> and a timer <NUM>. The operation resource <NUM> is composed of the CPU <NUM> and the storage unit <NUM>, and the CPU <NUM> executes the software programs 102a, 102b, and 102c stored in the storage unit <NUM> in a time-division manner to configure the functions of the ECU_A1a, the ECU_B1b and the ECU_C1c. The communication peripheral circuit 200a is shared similarly to the peripheral resource <NUM> of the embodiment. The operation resource <NUM> may be composed of a plurality of CPUs. The storage unit <NUM> includes, for example, a non-volatile memory, such as a flash memory, and a volatile memory, such as a Static Random Access Memory (SRAM).

The single ECU function is performed by the operation resource <NUM>, and communicates an outside of the integrated ECU 1A through the communication peripheral circuit 200a as required.

The communication peripheral circuit 200a converts a frame of a transmission buffer (not shown) into a serial transmission signal according to a communication protocol of the CAN, and outputs the serial transmission signal to the transceiver IC 20a. The transceiver IC 20a converts the transmission signal of a logic level obtained from the communication peripheral circuit 200a into a corresponding differential voltage and transmits the differential voltage to the CAN bus 2a.

At the time of data reception, the transceiver IC 20a reads the differential voltage of the CAN bus 2a, and outputs a reception signal shaped to be included in a predetermined voltage range to the communication peripheral circuit 200a. A reception terminal of the communication peripheral circuit 200a includes, for example, a comparator, compares a predetermined threshold voltage with the reception signal from the transceiver IC 20a to generate digital data of "<NUM>" and "<NUM>", and stores the digital data in a reception buffer (not shown).

The control circuit 300a sets the use prohibition period for the communication peripheral circuit 200a, and forms a contention state due to sharing in the communication peripheral circuit 200a. The use prohibition period is set in a state where the following conditions are satisfied.

In particular, the control circuit 300a:.

The communication peripheral circuit 200a is configured not to output an acknowledge signal in response to an access request signal from the CPU <NUM>, for example, when the use prohibition is notified from the control circuit 300a, and the communication peripheral circuit 200a is configured to output an acknowledge signal when the usable state is notified.

Next, a configuration of the control circuit 300a will be described with reference to <FIG> is a block diagram showing the configuration of the control circuit 300a of <FIG>.

The control circuit 300a includes a counter <NUM> for measuring an operation time of the communication peripheral circuit 200a, and a main counter <NUM> for determining whether the communication peripheral circuit 200a is available or not. The control circuit 300a:.

The counter <NUM> includes a counter register (CNTR) 301a, an incrementer (INC) 301b and a selector 301c. The counter <NUM> is initialized by assertion of a transfer end signal (SC1) from the communication peripheral circuit 200a or a reset signal (SC2) from the timer <NUM>. This is performed by the selector 301c selecting "<NUM>" by the transfer end signal (SC1) or the reset signal (SC2) and inputting the selected "<NUM>" to the counter register (CNTR) 301a. The counter <NUM> continues to count up while the communication peripheral circuit 200a is operating. This is performed by the selector 301c selecting an output of the incrementer 301b in response to an in-operation signal (SC3) indicating that the communication peripheral circuit 200a is in operation and inputting the selected output of the incrementer 301b to the counter register (CNTR) 301a. As a result, when the transfer end signal (SC1) is generated, the counter <NUM> indicates an occupied time in which the communication peripheral circuit 200a is used.

The main counter <NUM> includes a main counter register (MCNTR) 302a, a decrementer (DEC) 302b, a selector 302c, a multiplier 302d, a register 302e, an adder 302f and a negative determiner <NUM>. The main counter <NUM> is initialized by the periodic reset signal (SC2). This is performed by the selector 302c selecting "<NUM>" by the reset signal (SC2) and inputting the selected "<NUM>" to the main counter register (MCNTR) 302a. It is assumed that a cycle of the reset signal (SC2) is a unit time (UNIT TIME) for which the allocated band is to be guaranteed when the communication peripheral circuit 200a is controlled.

The main counter <NUM> operates as a subtraction counter when the communication peripheral circuit 200a is not operating. This is performed by the selector 302c selecting an output of the decrementer 302b in response to the in-operation signal (SC3) indicating that the communication peripheral circuit 200a is in operation and inputting the selected output of the decrementer 302b to the main counter register (MCNTR) 302a.

When the transfer end signal (SC1) is generated, the main counter <NUM> uses the multiplier 302d to multiply a value of the counter register (CNTR) 301a by the budget value (SC4) which is a coefficient (factor) set in advance in the register 302e by the control circuit <NUM>, and adds the operation result to a value of the main counter register (MCNTR) 302a using the adder 302f. This is performed by the selector 302c selecting an output of the adder 302f in response to the transfer end signal (SC1) and inputting the selected output of the adder 302f to the main counter register (MCNTR) 302a.

The negative determiner (<<NUM>) <NUM> determines whether the value of the main counter register (MCNTR) 302a is negative, and outputs an usable signal (SC5) to the communication peripheral circuit 200a. If the negative determiner <NUM> determines the value of the main counter register (MCNTR) 302a is negative, the usable signal (SC5) is asserted and the communication peripheral circuit 200a is available. If the negative determiner <NUM> determines the value of the main counter register (MCNTR) 302a is positive (is not negative), the usable signal (SC5) is negated and the communication peripheral circuit 200a is unavailable. The negative determiner <NUM> determines whether the value of the main counter register (MCNTR) 302a is negative, depending on whether the most significant bit of the main counter register (MCNTR) 302a is "<NUM>", for example.

As shown in <FIG>, the budget value and the unit time (cycle) are set from the debugger <NUM> to the control circuit 300a via the debugger I/F <NUM>. The settings are indicated by the OEM to the respective Tierl with static values. The control circuit <NUM> sets the budget value (SC4) set by the debugger <NUM> in the register 302e of the control circuit 300a. The control circuit <NUM> sets the unit time set by the debugger <NUM> to the timer <NUM>. The timer <NUM> generates the reset signal (SC1) every unit time.

Note that the control circuit 300a, the control circuit <NUM>, the timer <NUM> and the debugger <NUM> are used only at the time of the unit ECU function evaluation by the Tierl, and are not used at the time of evaluation by the OEM or after mass production and shipping.

Next, an operation of the control circuit 300a will be described in detail with reference to <FIG> and <FIG>. <FIG> is a diagram for explaining the operation of the control circuit 300a of <FIG>. <FIG> is a diagram for explaining the operation of the control circuit 300a of <FIG> in a plurality of unit times. <FIG> shows an example in which the use (access request) α, β, and γ of the communication peripheral circuit 200a occurs within the unit time (UNIT TIME).

Although a usable period UA is set at the beginning of the unit time, the CPU <NUM> is unavailable to the communication peripheral circuit 200a, and after becoming available, an initial access request α is generated. It is assumed that a time taken to use the communication peripheral circuit 200a for the access request α is Tα.

A use prohibition period PB for the communication peripheral circuit 200a is set by the transfer end event signal (SC1) from the communication peripheral circuit 200a, and the main counter <NUM> starts to subtract.

While the value of the main counter register (MCNTR) 302a takes a positive value, the communication peripheral circuit 200a is disabled, and the use of the communication peripheral circuit 200a of the access request β generated until the value of the main counter register (MCNTR) 302a shows a negative number waits until the value of the main counter register (MCNTR) 302a becomes negative.

A time (TB) of the use prohibition period PB of the communication peripheral circuit 200a is derived from the time (Tα) taken for the processing at the time of the immediately preceding use for the communication peripheral circuit 200a. If the use allocation (coefficient (factor)) of the communication peripheral circuit 200a to the single ECU function to be targeted is K%, the value of TB is derived from a time obtained by multiplying Tα by (<NUM>-K)/K. For example, when K=<NUM>, TB=<NUM>×Tα.

When the value of the main counter register (MCNTR) 302a becomes a negative value, the communication peripheral circuit 200a becomes available, and the use of the communication peripheral circuit 200a for the access request β starts.

A time required for the use of the communication peripheral circuit 200a for the access request β is counted by the counter <NUM>. During this time, the main counter <NUM> is not decremented and the values of the main counter register (MCNTR) 302a remain unchanged.

A time (TC) of a use prohibition period PC of the communication peripheral circuit 200a is calculated again from the time (Tβ) taken by the use of the communication peripheral circuit 200a for the access request β, and is added to the main counter register (MCNTR) 302a. The main counter <NUM> starts and continues the subtraction count process.

Although the usable period UA is set after the time (TC) of the use prohibition period PC has elapsed, the main counter <NUM> continues decrementing because there is no subsequent access request to the communication peripheral circuit 200a.

If the access request γ occurs after the elapse of a TD time (longer than the TC time) from the previous access request β, the access request γ can immediately start the use of the communication peripheral circuit 200a. This is because the value of the main counter register (MCNTR) 302a indicates a negative number.

After the use of the communication peripheral circuit 200a for the access request γ is completed, a time (TE) of a use prohibition period PE recalculated from the use of the communication peripheral circuit 200a for the access request γ is calculated, and is added to the main counter register (MCNTR) 302a. Since the time (TE) of the use prohibition period PE calculated from the time (Tγ) taken by the use of the communication peripheral circuit 200a for the access request γ is added to the main counter register (MCNTR) 302a which is a negative number, the use prohibition period PE of the communication peripheral circuit 200a determined from the main counter register (MCNTR) 302a is the time (TE) obtained by subtracting a difference between the past time (TD) and the time (TC). The subsequent access request to the communication peripheral circuit 200a can be issued after the use prohibition period PE in which the above correction is performed has elapsed.

As shown in <FIG>, the main counter <NUM> is initialized by the reset signal (SC2) regardless of the state of the main counter <NUM> after the elapse of the minimum unit time (UNIT TIME) for which the band guarantee of the communication peripheral circuit 200a is to be established. In the first unit time in <FIG>, an inaccessible period UN, a use period A, a use prohibition period P,. , and an inaccessible period UN are set, and though the main counter register (MCNTR) 302a takes a negative number, the reset signal after the elapse of the unit time is inputted during the inaccessible period UN. Here, the usable period UA includes the use period A and the inaccessible period UN. At the beginning of the second unit time, the inaccessible period UN of the first unit time continues. The reset signal after the elapse of the second unit time is also input during the inaccessible period UN. However, at the beginning of the third unit time, the use period A is set. The control circuit 300a initializes the main counter <NUM> every time a unit time elapses, and suppresses the occurrence of an access exceeding the budget allocation within the unit time.

<FIG> is a flowchart explaining a manufacturing method of the integrated ECU 1A of <FIG>. The OEM develops and manufactures hardware of the integrated ECU 1A. The semiconductor device 10A in the integrated ECU 1A is manufactured by, for example, a semiconductor manufacturer or the like. Using the hardware of the integrated ECU 1A lent from the OEM, the Tier1_A, the Tier1_B and the Tier1_C perform development and operation check of only the software that each is in charge of. That is, as shown in <FIG>, the Tier1_A develops the software for the function of the ECU_A (step SA11), verifies the software for the function of the ECU_A (step SA12), and delivers the software to the OEM. Similarly, the Tier1_B develops the software for the function of the ECU_B (step SB11), verifies the software for the function of the ECU_B (step SB12), and delivers the software to the OEM. The Tier 1_C develops the software for the function of the ECU_C (step SC11), verifies the software for the function of the ECU_C (step SC12), and delivers the software to the OEM. The respective Tierl can verify the function of the single ECU in the integrated state.

As shown in <FIG>, the OEMs install the software developed and verified by Tier1_A, Tier1_B, and Tier1_C in the integrated ECU1 (step S011). The OEM checks the operation of the ECU_A/ECU_B/ECU_C in cooperation with the ECU_A/ECU_B/ECU_C while operating the ECU_A, ECU_B, and ECU_C functions in parallel (step SO12). Note that the step SA3,SB3,SC3 of <FIG> by the Tierl is not necessary between the step SO11 and the step SO12.

In this example, in the semiconductor provided for the integrated ECU, the "control mechanism" for providing a certain "use prohibition period" to the communication peripheral circuit is mounted.

Further, the "use prohibition period" is determined in accordance with the past occupied time of the communication peripheral circuit as a target and the "band allocation" which is determined prior to the single ECU function evaluation. This function ensures that even in the integrated ECU, the processing within the "band" expected at the time of the integrated ECU is completed.

Further, since the use prohibition period is set in cooperation with the immediately preceding use time of the communication peripheral circuit, the insertion of the use prohibition period is performed at discrete timing. It is possible to realize the single ECU evaluation while avoiding the use prohibition state of the communication peripheral circuit for a long period of time.

By subtracting the potential inaccessible period of the single ECU function from the "use prohibition period" set by the control circuit, it is avoided that the use prohibition period is set excessively. This is because, when operating as the integrated ECU, accesses from other single ECU functions can be executed even during the "use prohibition period" of the single ECU function.

Several exemplary modifications will be illustrated below. In the following explanation of the modification, the same reference numerals as those of the above-mentioned example may be used for components having the same structures and functions as those described in the above-mentioned example. In the description of such portions, the description in the above-mentioned example can be appropriately incorporated within the scope not inconsistent with the technical aspects. In addition, a part of the above-mentioned example and all or a part of a plurality of modifications may be applied in combination as appropriate within the scope not inconsistent with the technical aspects.

In the example, the communication controller (communication peripheral circuit) for CAN communication is exemplified as the peripheral resource, but the communication peripheral circuit may be a circuit for FlexRay communication, Local Interconnect Network (LIN) communication, Ethernet communication, or the like. The number of peripheral resources is not limited to one, and a plurality of peripheral resources may be used. Hereinafter, a case (modification) including two communication peripheral circuits of a communication controller for CAN communication and a communication controller for Ethernet communication will be described with reference to <FIG>.

<FIG> is a diagram schematically showing a configuration of an integrated ECU of a modification.

As shown in <FIG>, the integrated ECU 1B is connected to two in-vehicle network lines, i.e., a CAN bus 2a and an Ethernet bus 2b, which are in-vehicle networks, and can communicate with another ECU and the like. The integrated ECU 1B mainly is composed a semiconductor device 10B, such as a microcontroller or an SOC and transceiver ICs 20a and 20b. The semiconductor device 10B includes a CPU <NUM>, a storage unit <NUM> storing software programs 102a, 102b, and 102c for realizing each single ECU function, a communication controller (communication peripheral circuit) 200a for CAN communication, a communication controller (communication peripheral circuit) 200b for Ethernet communication and control circuits 300a and 300b in one semiconductor chip. The operation resource <NUM> is composed of the CPU <NUM> and the storage unit <NUM>, and the CPU <NUM> executes the software programs 102a, 102b, and 102c stored in the storage unit <NUM> in a time-division manner to configure the functions of the ECU_A1a, the ECU_B1, and the ECU_C1c. The communication peripheral circuits 200a and 200b are shared similarly to the peripheral resource <NUM> of the embodiment. The operation resource <NUM> may be composed of a plurality of CPUs. The storage unit <NUM> includes, for example, a non-volatile memory, such as a flash memory, and a volatile memory, such as SRAM.

The single ECU function is performed by the operation resource <NUM>, and communicates to an outside of the integrated ECU 1B through the communication peripheral circuits 200a and 200b as required.

Although the invention made by the present inventor has been specifically described based on the embodiment, example and modification, it is needless to say that the present invention is not limited to the above-described embodiment, example and modification, and can be variously modified.

Claim 1:
A semiconductor device comprising;
an operation resource (<NUM>) configured to perform a plurality of Electronic Control Unit (ECU) functions (102a, 102b, 102c);
a peripheral resource (<NUM>; 200a) configured to be shared by the plurality of ECU functions (102a, 102b, 102c);
a control mechanism (<NUM>; 300a) configured to control a period in which one of the ECU functions (102a, 102b, 102c), which is a verification target ECU function among the plurality of ECU functions, uses the peripheral resource (<NUM>; 200a) when verification of the verification target ECU function is performed; and
a debugger interface (<NUM>) provided to connect to a debugger (<NUM>) for receiving a budget value BDG from the debugger (<NUM>), the budget value being a performance allocation of the verification target ECU function,
wherein the control mechanism (<NUM>; 300a) is configured to calculate, based on the budget value BDG, a use prohibition period TP consisting of multiple discrete use prohibition subperiods (TB, TC, TE) in which the verification target ECU function is prohibited from using the peripheral resource (<NUM>; 200a) within a predetermined unit time TU, and to notify a use prohibition (SC5) to the peripheral resource (<NUM>; 200a) based on the calculated use prohibition period TP, TP being calculated as TU/(<NUM>+BDG),
wherein the control mechanism (<NUM>; 300a) is configured, each time the verification target ECU function uses the peripheral resource (<NUM>; 200a), to dynamically calculate its subsequent use prohibition subperiod (TB, TC, TE) based on an use time (Tα, Tβ, Tγ) in which the verification target ECU function has used the peripheral resource (<NUM>; 200a) in addition to the budget value BDG, the subsequent use prohibition subperiod being calculated as the use time x (<NUM>-BDG)/BDG, and
wherein when a period (TD) in which the verification target ECU function has not used the peripheral resource (<NUM>; 200a), between an end of the previous use time (Tβ) and a start of the current use time (Tγ) is longer than a use prohibition subperiod (TC) subsequent to the end of the previous use time (Tβ), the control mechanism (<NUM>; 300a) is configured to calculate a corrected use prohibition subperiod (TE) by subtracting, from the use prohibition subperiod calculated based on the current use time (Tγ) and the budget value BDG, a difference (TD-TC) between said period (TD) and said use prohibition subperiod (TC).