JP6945672B2 - Fail-safe system - Google Patents

Description

The present application relates to a fail-safe system.

The vehicle is equipped with control devices such as engine control, transmission control, brake control, and running control, which are necessary for running the vehicle. These plurality of control devices are configured so that data can be exchanged with each other via a communication line, and a vehicle integrated control system that realizes stable control of the entire vehicle is adopted.

Input devices such as sensors and switches for each in-vehicle control device are independently connected via a communication line, and output devices such as actuators and motor drivers for each in-vehicle control device are independently connected via a communication line. A control system has been proposed that implements integrated control such as engine control, transmission control, brake control, and running control by connecting to a control device for each control device via a communication line. Such an integrated control device is provided with a fail-safe system.

Japanese Unexamined Patent Publication No. 2002-221075

Patent Document 1 provides a manager control unit that monitors the operation of each control device, and when any of the control devices necessary for traveling of the vehicle fails, the other control device having a low priority fails. A fail-safe system that acts as a substitute is disclosed. The manager control unit causes another low-priority control device to download a basic program, which is an alternative control program that simplifies the specifications of the failed control device, to function as a substitute control device. As a result, the vehicle can ensure the minimum running performance.

In this fail-safe system, if any of the control devices required for driving the vehicle fails, the manager control unit predetermines the priority of which control device should be used as a substitute for the failed control device. There is. In addition, each basic program, which is an alternative control program to be downloaded by the substitute control device, is stored in the manager control unit. However, the technique of Patent Document 1 has the following problems.

The manager control unit is indispensable, which causes an increase in the cost of the control system. In addition, the manager control unit needs to have a storage capacity for storing each basic program which is an alternative control program of each control device, which causes an increase in the cost of the control system.

Therefore, an object of the present application is to provide a fail-safe system that enables execution of alternative control in the event of a failure of a control device, regardless of the manager control unit.

The fail-safe system according to the present application is
In a fail-safe system in which multiple control devices that monitor each other are connected
The first control device, which is one of the control devices,
A control program used for normal control and an alternative control program used for backing up the first control device in the event of a failure of the first control device are stored in the storage unit of the first control device.
The alternative control program is uploaded from the first control device to the free area of the storage unit of the second control device which is one of the other control devices.
The second control device is
Monitor the first controller and
When the second control device determines that the first control device has failed, the alternative control program stored in the storage unit of the second control device is executed .
Each of the plurality of control devices, as the first control device, uploads the alternative control program used for control at the time of failure to a free area of a storage unit of another control device as the second control device. It is characterized by.

The control device determines another control device that executes its own alternative control program, and uploads the alternative control program to monitor the control device by the other control device and control the other control device in the event of a failure of the control device. It is possible to implement alternative control by the device. As a result, the number of manager control units can be reduced, and the cost of the fail-safe system can be reduced.

It is a figure which shows the structure of the fail safe system which concerns on Embodiment 1. FIG. It is a figure which shows the hardware structure of the control device which concerns on Embodiment 1. FIG. It is a figure which shows the structure of the storage part of each control device which concerns on Embodiment 1. FIG. It is a flowchart which shows the whole processing of the control apparatus which concerns on Embodiment 1. FIG. It is a flowchart which shows the activation process of the control device which concerns on Embodiment 1. FIG. It is a flowchart which shows the control process of the control device which concerns on Embodiment 1. FIG. It is a flowchart which shows the download process of the control device which concerns on Embodiment 1. FIG. It is a flowchart which shows the upload process of the control device which concerns on Embodiment 1. It is a flowchart which shows the detail of the upload process of the control device which concerns on Embodiment 1. FIG. It is a flowchart which shows the upload process of the control device which concerns on Embodiment 2.

Hereinafter, embodiments of the vehicle control device according to the present application will be described with reference to the drawings. This embodiment mainly describes a vehicle control system and a vehicle control device in a vehicle system, and is suitable for implementation in a vehicle system, but does not prevent application to other than the vehicle system.

1. 1. Embodiment 1
FIG. 1 is a block diagram showing a configuration of a fail-safe system 100 according to the first embodiment. A plurality of control devices 1, 2, 3, 4, 5, 6 mounted on a vehicle, a plurality of actuators 12, 22, 32, 42 for operating in-vehicle devices, and a plurality of detecting state quantities used for control, respectively. Sensors 11, 21, 31, 41 are shown. The plurality of sensors 11, 21, 31, 41, the plurality of actuators 12, 22, 32, 42, and the plurality of control devices 1, 2, 3, 4, 5, 6 are provided by a communication line 60 capable of exchanging information with each other. It is connected.

<1-1. Control device>
FIG. 2 is a diagram showing a hardware configuration of control devices 1 to 6 according to the first embodiment. In the first embodiment, the control devices 1 to 6 include engine control, transmission control, driving control, navigation control, instrument display control, door lock control, steering control, brake control, audio control, video control, collision prevention control, and inter-vehicle distance. It is a control device that controls in-vehicle devices such as distance control, headlight control, power window control, and automatic driving control. Each function of the control devices 1 to 6 is realized by the processing circuit provided in the control devices 1 to 6. Specifically, as shown in FIG. 2, the control devices 1 to 6 have storages for exchanging data with the arithmetic processing unit 90 (computer) such as a CPU (Central Processing Unit) and the arithmetic processing device 90 as processing circuits. A device 91, an input circuit 92 for inputting an external signal to the arithmetic processing unit 90, an output circuit 93 for outputting a signal from the arithmetic processing unit 90 to the outside, and the like are provided.

The arithmetic processing device 90 is provided with an ASIC (Application Specific Integrated Circuit), an IC (Integrated Circuit), a DSP (Digital Signal Processor), an FPGA (Field Programmable Gate Array), various logic circuits, various signal processing circuits, and the like. You may. Further, a plurality of arithmetic processing units 90 of the same type or different types may be provided, and each processing may be shared and executed. As the storage device 91, a RAM (Random Access Memory) configured to be able to read and write data from the arithmetic processing device 90, a ROM (Read Only Memory) configured to be able to read data from the arithmetic processing device 90, and a flash memory. Etc. are provided. The input circuit 92 includes an A / D converter or the like to which various sensors and switches are connected and the output signals of these sensors and switches are input to the arithmetic processing device 90. The output circuit 93 includes a drive circuit or the like to which an electric load is connected and the control signal from the arithmetic processing unit 90 is converted and output to the electric load.

For each function included in the control devices 1 to 6, the arithmetic processing unit 90 executes software (program) stored in the storage device 91 such as a ROM to control the storage device 91, the input circuit 92, the output circuit 93, and the like. It is realized by cooperating with other hardware of devices 1 to 6. The setting data such as the threshold value and the determination value used by the control device 3 are stored in a storage device 91 such as a ROM as a part of the software (program).

<1-2. Functions of each control device>
The functions of the components of the control devices 1, 2, 3, 4, 5, and 6 of FIG. 1 will be described. The sensor 11 connected to the communication unit indicated by 1b, 2b, 3b, 4b, 5b, 6b described inside the control devices 1, 2, 3, 4, 5, and 6 of FIG. 1 by the communication line 60. , 21, 31, 41 and actuators 12, 22, 32, 42, respectively, may be composed of software modules, or may be composed of a combination of software and hardware. Further, although the arithmetic processing unit 90 and the storage device 91 are described as microcomputers 1a, 2a, 3a, 4a, and 5a as a unit, the internal circuit of the microcomputer has a configuration according to FIG. These may be configured by a separate CPU, ROM and RAM. The input circuit 92 and the output circuit 93 correspond to the communication units 1b, 2b, 3b, 4b, 5b, and 6b. However, the interface circuits provided in the sensors 11, 21, 31, 41, 51 and the actuators 12, 22, 32, 42 connected by the communication line 60 may be regarded as the input circuit 92 and the output circuit 93 in FIG. ..

In FIG. 1, the control device 1 (for example, an ECU that controls an engine) required for traveling of a vehicle includes a microcomputer 1a having a processing speed of 25 [MIPS] and a storage capacity of 320 [KB], and has a communication unit 1b. It is configured so that a predetermined communication process can be executed via the device. Further, the minimum sensor (for example, a crank angle sensor) 11 required for the vehicle to travel is directly connected to the communication line 60 via the built-in communication unit 11a, and similarly, the minimum actuator (for example, an injector) required for the vehicle to travel is connected. Etc.) 12 is directly connected to the communication line 60 via the built-in communication unit 12a.

Therefore, the signal input from the sensor 11 to the control device 1 and the signal output from the control device 1 to the actuator 12 are performed via the communication line 60.

The control device 2 (for example, a transmission ECU) includes a microcomputer 2a having a processing speed of 25 [MIPS] and a storage capacity of 320 [KB], and is configured to be able to execute a predetermined communication process via the communication unit 2b. There is. Further, the sensor (for example, rotation speed sensor, vehicle speed sensor, etc.) 21 is directly connected to the communication line 60 via the built-in communication unit 21a, and the actuator (for example, line pressure solenoid, etc.) 22 is connected via the built-in communication unit 22a. Is directly connected to the communication line 60. Therefore, the signal input from the sensor 21 to the control device 2 and the signal output from the control device 2 to the actuator 22 are performed via the communication line 60.

The control device 3 (for example, a travel control ECU) includes a microcomputer 3a having a processing speed of 15 [MPIS] and a storage capacity of 128 [KB], and is configured to be able to execute a predetermined communication process via the communication unit 3b. There is. Further, the sensor (for example, master cylinder pressure sensor or the like) 31 is directly connected to the communication line 60 via the built-in communication unit 31a, and the actuator (for example, brake actuator or the like) 32 is connected to the communication line via the built-in communication unit 32a. It is directly connected to 60.

Therefore, the signal input from the sensor 31 to the control device 3 and the signal output from the control device 3 to the actuator 32 are performed via the communication line 60.

The control device 4 (for example, a navigation ECU) includes a microcomputer 4a having a processing speed of 25 [MPIS] and a storage capacity of 400 [KB], and is configured to be able to execute a predetermined communication process via the communication unit 4b. .. Further, the sensor (for example, various sensors for detecting position information) 41 is directly connected to the communication line 60 via the built-in communication unit 41a, and an actuator (for example, a display device for displaying the current position of the vehicle). The 42 is directly connected to the communication line 60 via the built-in communication unit 42a.

In the control device 4, the signal input from the sensor 41 to the control device 4 and the signal output from the control device 4 to the actuator 42 are performed via the communication line 60, and further, information such as the vehicle speed using the position information for calculation is performed. Is acquired via the communication line.

The control device 5 (for example, the first body ECU) includes a microcomputer 5a having a processing speed of 3 [MIPS] and a storage capacity of 64 [KB], and is configured to be able to execute a predetermined communication process via the communication unit 5b. ing. The control device 5 is configured to control various instruments such as a speed meter housed in the instrument panel, and various actuators for operating these instruments are connected to the control device 5.

The control device 5 drives and controls each actuator based on data representing the vehicle speed, water temperature, etc. transmitted via the communication line 60.

The control device 6 (for example, the second body ECU) includes a microcomputer 6a having a processing speed of 1 [MIPS] and a storage capacity of 16 [KB], and is configured to be able to execute a predetermined communication process via the communication unit 6b. ing. The control device 6 is configured to control, for example, opening / closing of a power window and locking / unlocking of a door. Various actuators for operating power window motors, door lock motors, etc. are connected.

When the control device 6 detects that the vehicle speed exceeds a certain level based on the data representing the vehicle speed transmitted via the communication line 60, the control device 6 automatically locks the door by driving the door lock motor.

The control devices 1 to 6 and the sensors 11, 21, 31, and 41 are configured to be able to transmit and receive data to and from each other via the built-in communication units and communication lines 60 in order to optimally control the vehicle. Has been done.

<1-3. Fail safe ＞
Next, the process executed in the fail-safe system 100 of this embodiment will be described. The fail-safe system 100 of this embodiment prevents the vehicle from being unable to travel due to any failure of any of the above-mentioned control devices 1 to 6, and any control device fails. Also, it is possible to drive the vehicle to at least the place where help is sought by substituting the minimum processing by at least one or more other control devices that are not out of order.

In order to realize this, each control device 1 to 6 provides a control program (hereinafter referred to as an alternative control program) to be executed even when the control device fails and the stored control program cannot be executed. , Each is stored. This alternative control program is a program executed by at least one other control device that has not failed when any of the control devices fails, and performs detailed processing such as correction processing in normal vehicle control. The part to be realized (including diagnosis) is omitted. Therefore, the alternative control program is configured on a small scale (small capacity) because the program is simplified. As a specific example, the control device 1 and the control device 2 will be described.

As an alternative control program 1g of the control device 1 (engine ECU that controls the engine), for example, an alternative control program 1g that realizes a basic injection / ignition function in which the fuel injection amount and the ignition timing are fixed is stored. Therefore, in the alternative control program 1g, the portion for optimally correcting the fuel injection amount and the ignition timing as seen in the control program 1f executed at the normal time is omitted. By executing the alternative control program 1g, the injector is instructed to execute the combustion injection process at a constant injection amount, and the igniter is instructed to execute the ignition process at a constant ignition timing. As a result, by executing the alternative control program 1g, at least the minimum engine torque required for the running of the vehicle is secured.

Further, as an alternative control program 2g of the control device 2 (transmission ECU), for example, an alternative control program 2g that realizes a fixed transmission function in which the transmission stage of the transmission is fixed is stored. Therefore, in the alternative control program 2g, the part that executes the fine shift control as seen in the control program 2f that is normally executed is omitted. The shift stage is fixed to a constant speed one, and a predetermined axle torque can be obtained by executing the alternative control program 2g. As a result, by executing the alternative control program 2g, the vehicle can be driven with a limited output. Further, when the alternative control program 1g of the control device 1 is functioning, even if the alternative control program 2g of the control device 2 is functioning, the vehicle is driven while preventing the so-called engine stop. Can be done.

<1-4. Alternative control program>
FIG. 3 is a diagram showing the configurations of the storage units 1e, 2e, 3e, 4e, 5e, and 6e of the control devices 1, 2, 3, 4, 5, and 6 according to the first embodiment. Control programs 1f, 2f, 3f, 4f, 5f, alternative control programs 1g, 2g, 3g, 4g, 5g, 6g, and free areas 1h, 2h, 3h, 4h, 5h, 6h are described. The control device 1 will be described as a representative. A storage unit 1e including a communication unit 1b, a CPU 1c, a RAM 1d, and a flash memory is provided, and a control program 1f and an alternative control program 1g are stored in the storage unit 1e, and a free area is provided. 1h is secured.

(A) The fail-safe system 100
A fail-safe system 100 in which a plurality of control devices 1 to 6 are connected.
The first control device, which is any of the control devices 1 to 6, is
A control program used for normal control and an alternative control program used for control in the event of a failure are stored in the storage unit of the first control device.
Upload the alternative control program to the free space in the storage of the second controller, which is one of the other controllers.
The second control device is
Monitor the first controller,
When the first control device fails, the alternative control program stored in the storage unit of the second control device is executed.

For example, consider a case where the control device 1 uploads the alternative control program 1g to the control device in the free area 2h of the storage unit 2e of 2. In that case, the control device 1 is monitored by the control device 2 which has uploaded the alternative control program 1g, and when the control device 1 fails, the control device 2 stores the alternative control program in the free area 2h of the storage unit 2e. By executing 1 g, it will serve as a substitute for the control device 1. At this time, the control device 2 acting as a substitute for the control device 1 additionally executes the alternative control program 1g of the control device 1 on its own storage unit 2e while executing its own control program 2f. .. In this way, the control devices 1 to 6 determine other control devices that execute their own alternative control programs 1g to 6g, and upload the alternative control programs 1g to 6g to monitor themselves and when their own failure occurs. It has become possible to implement alternative control of. As a result, the cost of the control system can be reduced by reducing the number of manager control units. In addition, the controller capable of accepting the alternative control program of the other controller downloads it into the free space of the storage device, so that the controller executing the alternative program continues to execute its own control. Can be done.

Here, the control device for uploading the alternative control program to another control device can be limited to the control device required for traveling at a minimum. For example, the alternative control program may be downloaded to another control device only for the engine ECU and the transmission ECU. It is only necessary to be able to drive the vehicle to at least a place where help can be sought. In addition, upload and download are two sides of the same name, uploading that the subject writes (stores) data in another storage area, and downloading that the subject reads (stores) data in its own storage area. Refer to.

<1-5. Upload alternative control program for all controllers>
FIG. 3 shows an example of the upload situation of the alternative control programs 1 g to 6 g between the control devices 1 to 6. In FIG. 3, the alternative control program 1g of the control device 1 is uploaded to the free area 2h of the storage unit 2e of the control device 2 (arrow 51). The alternative control program 2g of the control device 2 is uploaded to the free area 1h of the storage unit 1e of the control device 1 (arrow 52). The alternative control program 3g of the control device 3 is uploaded to the free area 2h of the storage unit 2e of the control device 2 (arrow 53). The alternative control program 4g of the control device 4 is uploaded to the free area 3h of the storage unit 3e of the control device 3 (arrow 54). The alternative control program 5g of the control device 5 is uploaded to the free area 4h of the storage unit 4e of the control device 4 (arrow 55). The alternative control program 6g of the control device 6 is uploaded to the free area 5h of the storage unit 5e of the control device 5 (arrow 56). The control device to which the alternative control program is uploaded (the control device that downloads the alternative control program of another control device to its own storage unit) is given the mission to monitor the control device of the upload source, and the control device of the upload source When it is determined that the device is out of order, the alternative control program uploaded to the free area of the storage unit is executed to function as a substitute for the failed control device of the upload source.

(B) This fail-safe system 100 is
Each of the plurality of control devices 1 to 6 uploads the alternative control programs 1 g to 6 g used for the control at the time of failure to the free area of the storage unit of the other control device.

All the control devices 1 to 6 constituting the fail-safe system 100 are free to store the alternative control programs 1 g to 6 g in the free areas 1h to 6h of the storage units 1e to 6e of the other control devices 1 to 6. Since the total capacity of the regions 1h to 6h must be larger than the total capacity of the alternative control programs 1g to 6g of the respective control devices 1 to 6, it is necessary to secure a sufficient free area as a whole.

As a result, all the control devices 1 to 6 can be dealt with in the event of a failure while eliminating the need for the manager control unit. Cost can be reduced because a manager control unit is not required. Further, since only the free areas 1h to 6h of the storage units 1e to 6e of the control devices 1 to 6 are used to store the alternative control programs 1g to 6g, the alternative control programs 1g to 6g are executed. The control devices 1 to 6 can continuously execute the respective control programs 1f to 6f.

<1-6. Inquiries before uploading>
In order to specify the upload destination of the alternative control programs 1g to 6g, each control device 1 to 6 may periodically disclose its own computational resources and share them with each other using the communication line 60. As a computational resource, the most important index is the relationship between the capacity of the alternative control program to be uploaded and the capacity of the free area of the storage unit of the other party to be uploaded. Since the computational resources of each control device 1 to 6 are shared, each control device 1 to 6 uploads in the order of the control device having the largest free area, which is likely to be allowed to upload its own alternative control program 1 g to 6 g. Ask if it is possible. In doing so, it communicates the capacity of its alternative control program and asks if it is capable of accepting it.

The controller that received the inquiry confirms its own computational resources, for example, has already accepted the offer to upload the alternative control program of another controller, and the free space of the storage unit is insufficient. If you do not have the ability to accept it, reply to that effect. The inquiring controller asks the next candidate controller if it is capable of transmitting the capacity of its alternative controller and accepting its alternative controller. The control device on the inquiring side uploads its own alternative control program to the free area of the storage unit of the control device that responds that it has the ability.

(C) This fail-safe system 100 is
Ability of controllers 1 to 6 to transmit the program capacity of the alternative control program to the other controller and the other controller to accept the alternative control program before uploading the alternative control programs 1g to 6g to the other controller. Inquire if there is,
If you answered that you do not have the ability, contact another controller and
The alternative control program is uploaded to the free area of the storage unit of the control device that answered that it has the ability.

Before uploading 1g to 6g of the alternative control program, the other party's controller is informed of the capacity of the alternative control program and inquired whether or not it is capable of accepting the upload. You can search for possible control devices. This prevents upload failures and allows the upload to proceed appropriately in a relatively short time.

<1-7. Presentation of necessary computational resources ＞
Further, in order to specify the upload destination of the alternative control programs 1 g to 6 g, each control device 1 to 6 periodically discloses its own computational resources and shares them with each other using the communication line 60. In addition to the free area of the storage unit, the computational resources may include the average load of each control device, the peak load, and the free area of the RAM memory. By referring to the computational resources of other controllers, it is possible to narrow down the candidate controllers to upload their own alternative controller. Then, before uploading the alternative control program, in addition to the program capacity of the alternative control program, the execution load, the execution speed, and the RAM capacity required at the time of execution are transmitted to the other control device of the other party. You may ask if the controller is capable of accepting alternative control programs.

(D) This fail-safe system 100 is
Before the control devices 1 to 6 upload the alternative control programs 1 g to 6 g of the control devices 1 to 6 to another control device, in addition to the program capacity of the alternative control program, the RAM capacity and processing load used at the time of execution. Inquire if at least one of the other controllers is capable of accepting an alternative controller,
If you answered that you do not have the ability, contact another controller and
The alternative control program is uploaded to the free area of the storage unit of the control device that answered that it has the ability.

Specifically, for example, the control device 5 uses the control device 3 as another control device that executes the alternative control program 5g when it fails from the shared computational resources of the control devices 1 to 4 and 6. Select as a candidate. In this case, the control device 5 transmits to the control device 3 at least one of the RAM capacity and the processing load used at the time of execution in addition to the program capacity of the alternative control program 5g, and performs alternative control. Ask if you are capable of accepting 5g of program.

When the control device 3 is in automatic driving according to the current state of computational resources and, for example, a navigation system, it is expected that the processing load will increase from the future driving environment, thereby executing the alternative control program 5g of the control device 5. If it is determined that the control device 3 is difficult, the control device 3 transmits to the control device 5 that the control device 5 does not have the ability to accept the data via the communication line 60.

When the control device 5 replies that it does not have the ability to accept from the control device 3, the control device 5 adds the program capacity of the alternative control program 5g to the next candidate control device, and the RAM capacity used for execution. , Tell at least one of the processing load and execution speed, and inquire whether it is capable of accepting its own alternative control program 5g. The control device 5 uploads its own alternative control program 5g to the free area of the storage unit of the control device 4 that responds that it has the ability.

The above is an example of the procedure for finding the upload destination of the own alternative control program. In this way, before uploading 1 g to 6 g of the alternative control program, in addition to the program capacity of the alternative control program, at least one of the RAM capacity and the processing load used for execution is notified to the other control device and uploaded. By inquiring whether or not it has the ability to accept, it is possible to search for a control device that can be uploaded more accurately according to the actual situation of the control device of the other party. This prevents upload failures and allows the upload to proceed appropriately in a relatively short time.

<1-8. Division of alternative control program>
As a result of inquiring whether the candidate control devices are capable of accepting the upload of the alternative control program in sequence before the control devices 1 to 6 upload the alternative control programs 1g to 6g, the ability from any control device is obtained. Consider the case where you cannot get the answer that there is. The total capacity of the free areas 1h to 6h of the storage units 1e to 6e of all the control devices 1 to 6 constituting the fail-safe system 100 is larger than the total capacity of the alternative control programs 1g to 6g of each control device 1 to 6. Even in the case, each alternative control program 1g to 6g is stored in the free areas 1h to 6h of the storage units 1e to 6e of each control device 1 to 6, and the RAM and ROM of each control device 1 to 6 are used. Such a situation may occur due to dynamic changes in volume and processing load. In that case, look for a controller that is capable of splitting the alternative control program and accepting uploads.

(E) This fail-safe system 100 is
Before controllers 1 to 6 upload 1 g to 6 g of alternative control programs 1 to 6 to another controller, inquire whether the other controller is capable of accepting the alternative control program.
If you answered that you do not have the ability, contact another controller and
If all the controllers respond that they are incapable, split the alternative control program and split it.
For each divided alternative control program, the inquiry is repeated to see if the other control device has the ability to accept the divided alternative control program, and the alternative control program divided into the free area of the storage unit of the control device that answered that it has the ability is displayed. It is something to upload.

Specifically, for example, consider the case where the control device 1 is informed by all the other control devices that it does not have the ability to accept the upload of the alternative control program 1g. In that case, the control device 1 divides 1 g of its own alternative control program into at least two or more, and searches for a control device capable of accepting each of the divided alternative control programs. Consider a case where the control device 1 selects the control device 2 and the control device 4 as candidate control devices for accepting uploads. The control device 1 inquires of the control device 2 and the control device 4 via the communication line 60 whether or not it has the ability to accept the divided alternative control program. The control device 2 and the control device 4 examine the current state of the computational resources and the expected state of the computational resources, and transmit via the communication line 60 that they are capable of accepting them if they are acceptable.

Upon receiving a reply from the control device 2 and the control device 4 that it has the ability to accept the divided alternative program, the control device 1 gives the control device 2 and the control device 4 its own divided alternative control program. , Upload via communication line 60.

In this way, by dividing the alternative control program to be uploaded and inquiring whether the target control device has an accepting capacity, the alternative control is performed by utilizing the free areas 1h to 6h remaining in the storage units 1e to 6e. The program can be divided and uploaded. As a result, the free areas 1h to 6h of the storage units 1e to 6e can be efficiently used. Since the alternative control program can be stored in the storage unit of another control device without securing an excessive free area of the storage unit, the capacity of the entire storage unit can be optimized, which contributes to cost reduction.

<1-9. Changes in computational resources>
Here, in response to the fact that it has the ability to accept alternative programs in the past, even though the alternative control programs of other control devices are stored in the free area of the storage unit, alternatives are made due to dynamic changes in computational resources. Consider the case where you can predict that you will lose the ability to accept the program.

For example, when the control device 3 related to travel control starts automatic travel according to the navigation system, an increase in processing load may be expected from the future travel environment.

In the control device 3, at least one of the free area 3h of the storage unit 3e, the free area of the RAM, the average load of the computer, and the peak load of the computer increases or decreases due to the change in the control state, and the control device 4 is stored in the storage unit. When it is predicted that the ability to accept the alternative control program 4g of the above will be lost, the control device 4 is notified that the ability to accept the alternative control program 4g will be lost. In this case, the control device 4 transmitted to the effect that the ability to accept is lost will search for a new candidate and find a control device capable of accepting the alternative control program 4g.

(F) This fail-safe system 100 is
In the control devices 1 to 6, at least one of the free area of the storage unit, the free space of the RAM, the average load of the computer, or the peak load of the computer changes due to the change of the control state, and the control devices 1 to 6 of the other control devices stored in the storage unit change. If it predicts that it will no longer be able to accept an alternative controller, it will notify other controllers that it will no longer be able to accept it.
When another controller is notified that it is no longer capable of accepting, it repeatedly inquires whether another controller is capable of accepting an alternative control program, and in the free space of the storage unit of the controller that responds that it is capable. It uploads an alternative control program.

As a result, it is possible to secure another control device capable of accepting the alternative control program while confirming the feasibility of the alternative control program in response to the dynamic change of each control device 1 to 6. , The reliability of the fail-safe system is improved. It should be noted that the control device notified that the ability to accept is lost accepts the original alternative control program until the backup system is established by completing the upload of the alternative control program to the free area of the storage unit of the new control device. The control device that has been used may maintain the backup system.

<1-10. Independence of input / output device>
In the fail-safe system 100 described in the first embodiment, even if the control devices 1 to 6 fail, another control device executes an alternative control program 1g to 6g of the device to substitute for the failed control device. It will be fulfilled. In this way, even if the control device is changed, the sensors 11, 21, 31, 41 which are input devices and the actuators 12, 22, 32, 42 which are output devices can maintain the control independently. However, it is connected by the communication line 60.

(G) This fail-safe system 100 is
The control devices 1 to 6 are connected to the sensors 11, 21, 31, 41 and the actuators 12, 22, 32, 42 via the communication line 60, and are based on the input information received from the sensors 11, 21, 31, 41. It performs arithmetic processing and transmits output information to the actuators 12, 22, 32, and 42 to control an external device.

As a result, even if the control devices 1 to 6 are changed, the control can be continued, and the backup control with high reliability can be executed regardless of which control device the alternative control programs 1g to 6g are executed.

<1-11. Upload order>
Further, in the fail-safe system 100 described in the first embodiment, the control devices 1 to 6 exchange information when the power is started, and the alternative control programs 1 to 6 of the control devices 1 to 6 are numbered in descending order of capacity. Then, the control device for uploading the alternative control may be selected in numerical order, that is, in descending order of the capacity of the alternative control program 1 g to 6 g. By doing so, it is possible to find a large free space in which a large-capacity alternative control program is stored at the beginning. In the latter half of the uploading order, the area of the large free area becomes smaller, but the capacity of the alternative control program to be uploaded also becomes smaller, so there is no problem.

(H) This fail-safe system 100 is
At startup, the control devices 1 to 6 start uploading the alternative control program in the order of the control devices having the alternative control program having the larger capacity.

By doing so, the free areas 1h to 6h of the storage units 1e to 6e of each control device 1 to 6 can be effectively used, and all the control devices 1 have an appropriate capacity of the storage units 1e to 6e. It is possible to upload 1 g to 6 g of alternative control programs from 1 to 6. It contributes to cost reduction by eliminating the need for excessive storage capacity.

<1-12. Flowchart>
The operation of the fail-safe system 100 of the first embodiment will be described with a flowchart.

FIG. 4 is a flowchart showing the entire processing of the control devices 1 to 6 according to the first embodiment. FIG. 5 is a flowchart showing the activation processing of the control devices 1 to 6 according to the first embodiment. FIG. 6 is a flowchart showing the control processing of the control devices 1 to 6 according to the first embodiment. FIG. 7 is a flowchart showing the download process of the control devices 1 to 6 according to the first embodiment. FIG. 8 is a flowchart showing the upload process of the control devices 1 to 6 according to the first embodiment. FIG. 9 is a flowchart showing the details of the upload process of the control devices 1 to 6 according to the first embodiment.

<1-13. Main processing>
FIG. 4 is a flowchart showing the entire configuration of the main processing that each control device 1 to 6 individually processes for each control device. The execution interval may differ depending on the functions of the control devices 1 to 6, but here, for example, the process of FIG. 4 is executed every 5 ms. The processing may be executed not at regular time intervals but at each external signal input timing.

The process is started from step S101, the start process is executed in step S200, the control process is executed in step S300, the download process is executed in step S400, the upload process is executed in step S500, and the process ends in step S109. do.

The start-up process in step S200 determines whether or not the fail-safe system 100 has just started up, and executes the process immediately after the start-up process. The contents of the activation process of step S200 are described in steps S201 to S209 of FIG.

In the control process of step S300, the control process peculiar to each control device, which is the original function of the control devices 1 to 6, is executed. Further, when the alternative control program of the other control device is downloaded to the free area of the recording unit, the other control device is monitored, and if it is out of order, the alternative control program is executed. The processing content of the control process in step S300 is described in steps S301 to S319 of FIG.

In the download process of step S400, it is confirmed whether or not the download request of the alternative control program (permission to upload when viewed from the other control device) is received from the other control device, and the presence or absence of the accepting ability is returned, and it is necessary. Download alternative controllers for other controllers accordingly (allow uploads for other controllers). The processing content of step S400 is described in steps S401 to S419 of FIG.

In the upload process of step S500, a process of selecting a candidate control device for uploading its own alternative control program, inquiring whether or not it has the ability to accept the upload, and uploading the program is shown. The processing contents of step S500 are described in steps S501 to S509 of FIG.

<1-14. Startup process>
FIG. 5 is a flowchart showing the activation process. Step S201 of FIG. 5 is a process called from step S200 of FIG. The process is started from step S201, and in step S202, it is determined whether or not the fail-safe system 100 has just started. If it is not immediately after the startup, the process proceeds to step S209 to end the process. If it is just after startup, in step S203, the download completion flag (hereinafter referred to as DL completion flag), the upload completion flag (hereinafter referred to as UP completion flag), and the upload NG flag (hereinafter referred to as UL-NG flag) are cleared. ..

The DL completion flag is a flag indicating that the alternative control program of another control device has been downloaded to the free area of its own storage unit. The UL completion flag is a flag indicating that the upload of its own alternative control program to the free area of the storage unit of another control device has been completed. The UL-NG flag asks other controllers if they are capable of uploading their alternative control program and accepts them, and all controllers respond that they are not capable. It is a flag indicating that the upload could not be performed. Next, the process proceeds to step S204.

In step S204, the own controller number is acquired. The control devices included in the fail-safe system present the capacities of their alternative control programs, and the control device numbers are determined in descending order of capacity. Next, the process proceeds to step S205.

In step S205, it is confirmed whether or not its own control device number is 1. If its own control device number is not 1, the process ends in step S209. If its own control device number is 1, the process proceeds to step S206. In step S206, 1 is set in the control device number counter (hereinafter referred to as CU-N counter). The CU-N counter is a counter that indicates the order in which the alternative control program is uploaded to another control device for each control device, and the control device in which the number of the CU-N counter and its own control device number match is the alternative control program. Try to download. Immediately after startup, the controller whose controller number is 1 first uploads the alternative control program to another controller. After step S206, the process ends in step S209.

<1-15. Control processing>
FIG. 6 is a flowchart showing the control process. Step S301 of FIG. 6 is a process called from step S300 of FIG. The process is started from step S301, and in step S302, it is confirmed whether or not the completion flag is 1. If the DL completion flag is not 1, the process proceeds to step S310. If the DL completion flag is 1, the process proceeds to step S303, and the capacity for accepting alternative control programs of other currently downloaded controllers is lost from the prediction of the computational resources of the current controller and the computational resources of the future. Judge whether to predict.

If it is not predicted that the capacity will be lost, the process proceeds to step S308. If it is predicted that the accepting capacity will be lost, the process proceeds to step S304, and as a result of notifying the control device that the accepting capacity will be lost, the control device receives a notification that the alternative control program has been uploaded to another control device. Check if it is (stated that the notified CU has been uploaded to another CU). If the notification has not been received, the control device is notified in step S307 that the receiving capacity is lost, and the process proceeds to step S308.

When the control device has notified that the alternative control program has been uploaded to another control device, the alternative control program of the control device stored in its own storage unit is deleted in step S305, and the alternative control program of the control device is deleted in step S306. Clear the DL completion flag with. As a result, the storage unit is ready to accept a new alternative control program of another control device within the margin calculated from the prediction of future computational resources. Then, the process proceeds to step S310.

Here, when it is confirmed that the alternative control program accepted by the control device has been uploaded to another control device, the alternative control program is deleted from its own storage unit in step S305. You may not do it. If it is predicted that the reason for predicting that the receiving capacity of the control device will be lost is not the problem of the free area of the storage unit but the problem of RAM capacity, processing load, and execution speed, the alternative control program is deleted in step S305. It does not have to be. If there is enough free space in the storage unit, it is advantageous to leave the alternative control program without erasing it. This is because when the accepting capacity of the control device is restored, it is possible to wait in the alternative control program upload completed state. If an alternative control program is uploaded and another controller waiting for the alternative control program to execute has a new acceptance capacity problem, the response is promptly changed without the time spent re-uploading the alternative control program. This is significant because it can be set to wait for the execution of the alternative control program.

In step S308, a failure determination is performed for another control device (the control device to which the alternative control program is uploaded) that has downloaded the alternative control program to its own storage unit. If there is no failure, the process proceeds to step S310. If it is out of order, it executes an alternative control program for the control device in its own storage unit. As a result, even if the control device fails, it can function as a substitute for the control device with limited contents. Then, the process proceeds to step S310.

In step S310, its own control program is executed. Processing is performed based on the input information input from the sensor, and the output information is output to the actuator to control the device. Then, the process proceeds to step S311. In step S311, the information related to the own computational resource is transmitted to another control device. This is because by sharing the computational resource data of all the control devices, it is possible to quickly find a candidate for uploading an alternative control program. After that, the process ends in step S309.

<1-16. Download process>
FIG. 7 is a flowchart showing the download process. Step S401 in FIG. 7 is a process called from step S400 in FIG. The process is started from step S401, and in step S402, it is confirmed whether or not an inquiry about whether or not the alternative control program can be accepted has been received from another control device (stated that there is an inquiry about whether or not the alternative control program can be accepted).

If no inquiry has been received, the process ends in step S419. If an inquiry is received, in step S403, the information such as the capacity of the alternative control program of the sender, which is transmitted together with the inquiry for acceptance ability, is compared with its own computational resources to confirm the ability to accept. do.

The result is confirmed in step S404, and if there is no ability to accept, the control device is returned to the effect that there is no ability to accept in step S408, and the process ends in step S419. If it has the ability to accept, it returns in step S405 that it has the ability to accept and proceeds to step S406.

In step S406, it is confirmed whether or not the control device has requested the download of the alternative control program. When there is a download request, the alternative control program of the control device is downloaded to the free area of the storage unit in step S407, and the process ends in step S419. If no download request has arrived, the process ends in step S419. The download process will be sent to the next time.

<1-17. Upload process>
FIG. 8 is a flowchart showing the upload process. Step S501 of FIG. 8 is a process called from step S500 of FIG. The process is started from step S501, and in step S502, it is confirmed whether or not the controller number counter (CU-NC) matches its own controller number. If they do not match, it is not the order of uploading the alternative control program of its own to another control device, and the process ends in step S509. If the CN-UC matches its own control device number, the process proceeds to step S503.

In step S503, it is confirmed whether the UL completion flag is 1. If the UL completion flag is not 1, the alternative control program has not been uploaded to another control device yet, so the alternative control program upload process is performed in step S600. By doing so, the upload process of the alternative control program is executed as soon as possible after the startup, and the backup system of each control device can be quickly set up. The content of the alternative control program upload process in step S600 is described in steps S601 to S629 of FIG.

If the UL completion flag is 1 in step S503, the process proceeds to step S504. In step S504, it is confirmed whether or not the control device to which the alternative control program has been uploaded has notified that the acceptance capacity will be lost by prediction. If the contact is received, it is necessary to upload the alternative control program to the storage unit of another control device again. Therefore, the process proceeds to step S600 to execute the alternative control program upload process. If there is no notification that the acceptance capacity will be lost due to the prediction, the process proceeds to step S506.

After executing the alternative control program upload process in step S600, the controller number counter (CU-NC) is added in step S506. As a result of the addition, if the number of equivalent control devices of the fail-safe system is exceeded, the value is returned to 1. As a result, the judgment of the upload process is passed to the control device of the next control device number. After step S506, the process ends in step S509.

<1-18. Details of upload process>
FIG. 9 is a flowchart showing the details of the upload process. Step S601 of FIG. 9 is a process called from step S600 of FIG. A control device candidate that starts processing in step S601, checks the computer resource data of all the control devices from the computer resource data received from other control devices in step S602, and inquires whether or not it has the ability to accept its own alternative control program. To determine. Next, in step S603, it is inquired whether the candidate control devices are capable of sequentially accepting them. Next, in step S604, it is confirmed whether or not there is a control device m that is capable.

If there is a capable control device m, its own alternative control program is uploaded to the control device m in step S605. After uploading in step S606, the DL completion flag of the control device m is set, and the control device number of the uploaded control device is stored in the control device m. The fact that the DL completion flag is set indicates that the control device m is obliged to monitor the control device to which the alternative control program has been uploaded. Next, in step S607, the UL-NG flag is cleared, and in step S608, the UL completion flag is set to 1. After that, the process ends in step S629. If no controller is found capable in step S604, the alternative control program to be uploaded in step S610 is split. The number of divisions may be 2 or more, but here, it is divided into the first half and the second half. In step S611, with respect to the divided latter half, after sending data such as the capacity of the alternative control program in the latter half, the candidates of other control devices are sequentially inquired as to whether or not they have the ability to accept.

It is determined whether or not there is a control device n that replied that it has the ability to accept in step S612. If there is no control device capable of accepting even if the division is performed, the process proceeds to step S621 to set the UL-NG flag. The fact that the UL-NG flag is set means that the alternative control program could not be uploaded, and this is picked up as a problem. Next, the UL completion flag is cleared in step S622, and the process ends in step S629.

If there is a control device n capable of accepting in step S612, the divided latter half of the alternative control program is uploaded to the free area of the storage unit of the control device n in step S613. Then, the process proceeds to step S614.

In step S614, with respect to the divided first half portion, data such as the capacity of the alternative control program of the first half portion is similarly sent, and then the candidates of other control devices are sequentially inquired as to whether or not they have the ability to accept. In step S615, it is determined whether or not there is a control device k that replies that it has the ability to accept. If there is no control device capable of accepting the divided first half, the process proceeds to step S621.

If there is a control device k that replies that it has the ability to accept in step S615, the process proceeds to step S616, and the divided first half of the alternative control program is uploaded to the free area of the storage unit of the control device k. Then, the process proceeds to step S617. In step S617, the start address information in which the latter half of the alternative control program of the control device n is written is stored in the control device k. This is because when the alternative program is executed by the control device k, after the execution of the first half portion, when the second half portion is executed, the alternative program is smoothly executed from the first half to the second half portion. Then, the process proceeds to step S618.

In step S618, the DL completion flag of the control device k is set. By setting the DL completion flag, it means that the control device k is obliged to monitor the control device that has downloaded the alternative program. Next, the DL-NG flag is cleared in step S619, the UL completion flag is set in step S620, and the process ends in step S629.

Here, it takes time from the control device to send an inquiry to another control device and obtain an answer from the other control device. Also, it takes time to write the program in the free area of the storage unit. Therefore, these executions may be executed separately from the processing for each control cycle.

2. Embodiment 2
In the first embodiment, a system in which each control device deploys an alternative control program in an empty area of a storage unit of another control device to complete and maintain a backup system as soon as possible after the vehicle system is started is described. I came.

<2-1. Upload after abnormality judgment ＞
In the second embodiment, the alternative control program is not always expanded in the free area of the storage unit of the other control device, but the alternative control program of the required control device is stored in the storage of the other control device each time it is needed. The fail-safe system that is deployed in the free space of the department will be explained.

FIG. 10 is a flowchart showing an upload process of the control device according to the second embodiment. The flowchart of FIG. 10 differs from the flowchart of FIG. 8 only in that step S521 is added. In step S503, when the UL completion flag is not set, that is, when the alternative control program has not yet been uploaded to another control device, in FIG. 8 according to the first embodiment, the alternative control program is quickly uploaded. Is running.

In FIG. 10, when the UL completion flag is not set in step S503, the alternative control program is uploaded in step S600 only when the abnormality occurrence counter of the control device is larger than the specific value f in step S521. ..

When the UL completion flag is set in step S503, the process proceeds to step S504, and in step S504, it is confirmed whether or not the control device to which the alternative control program has been uploaded has notified that the acceptance capacity will be lost by prediction. If the contact is received, it is necessary to upload the alternative control program to the storage unit of another control device again. Therefore, the process proceeds to step S600 to execute the alternative control program upload process. This part is the same as FIG. 7 of the first embodiment.

From the above, in the second embodiment, the upload of the alternative control program is not rushed, and the upload of the alternative control program is executed after the abnormality occurrence counter of the control device becomes larger than the specific value f. In this way, if there is no abnormality in the control device by uploading the alternative control program after it is needed, by not uploading the alternative control program, the storage unit of the other control device can be stored. You don't have to consume free space. In other words, it is not necessary to secure a large amount of free space in the storage unit of the control device under the situation where many abnormalities of the control device do not occur at one time. That is, since there is no problem even if the capacity of the storage unit is reduced, it is possible to contribute to cost reduction, miniaturization, and weight reduction of the device by reducing the capacity of the storage unit.

Here, the abnormality determination of the control device is a case where the control device is unlikely to malfunction. For example, the output voltage of the internal power supply circuit of the control device is out of the standard voltage range, resulting in a failure. This is the case of determining a gray zone such as a state where the voltage is not within the determination voltage range.

In FIG. 10, a state in which the abnormality occurrence counter of the control device is larger than a specific value f is used as a trigger for uploading the alternative control program, but when the control device detects an abnormality for the first time, the control device repeats the abnormality determination. When an abnormality is confirmed, can also be used as a trigger. As mentioned above, in any case, it goes without saying that uploading is not possible unless an inquiry is made to another control device and an answer is received that it is capable of accepting. Including the above conditions and the case where the alternative control program is uploaded as soon as possible after the vehicle system of the first embodiment is started, the following requirements are obtained.

(I) This fail-safe system 100 is
Control devices 1 to 6
If you ask if another controller is capable of accepting the alternative control program and answer that it is capable,
If the answer is that it is capable and the control device detects an abnormality,
If the answer is that it is capable and the control device detects anomalies a specific number of times within a specific period,
If the answer is that it is capable and the control device is confirmed to be abnormal,
In at least one of the cases, the alternative control program is uploaded to the free area of the storage unit of the other control device.

As a result, after the control devices 1 to 6 have passed the abnormality determination, the alternative control programs 1 g to 6 g are started to be uploaded to other control devices, so that the free areas 1h of the storage units 1e to 6e of the control devices 1 to 6 are started. It is not necessary to set 6h excessively, which can contribute to cost reduction. In addition, the timing for starting uploading from the alternative control program 1 g to 6 g to another control device can be optimally set according to the seriousness from the initial occurrence of the abnormal state to the occurrence of a specific number of times or the confirmation of the abnormality. can.

Although the present application describes various exemplary embodiments and examples, the various features, embodiments, and functions described in one or more embodiments are applications of a particular embodiment. It is not limited to, but can be applied to embodiments alone or in various combinations. Therefore, innumerable variations not illustrated are envisioned within the scope of the techniques disclosed herein. For example, it is assumed that at least one component is modified, added or omitted, and further, at least one component is extracted and combined with the components of other embodiments.

1,2,3,4,5,6 control device, 1e, 2e, 3e, 4e, 5e, 6e storage unit, 1f, 2f, 3f, 4f, 5f, 6f control program, 1g, 2g, 3g, 4g, 5g, 6g Alternative control program, 1h, 2h, 3h, 4h, 5h, 6h Free space, 11, 21, 31, 41 sensors, 12, 22, 32, 42 actuators, 60 communication lines, 100 fail-safe system

Claims (9)

In a fail-safe system in which multiple control devices that monitor each other are connected
The first control device, which is one of the control devices,
A control program used for normal control and an alternative control program used for backing up the first control device in the event of a failure of the first control device are stored in the storage unit of the first control device.
The alternative control program is uploaded from the first control device to the free area of the storage unit of the second control device which is one of the other control devices.
The second control device is
Monitor the first controller and
When the second control device determines that the first control device has failed, the alternative control program stored in the storage unit of the second control device is executed .
Each of the plurality of control devices, as the first control device, uploads the alternative control program used for control at the time of failure to a free area of a storage unit of another control device as the second control device. A fail-safe system featuring. The fail-safe system according to claim 1, wherein three or more of the control devices that mutually monitor are connected. The first controller transmits the program capacity of the alternative control program to another controller and inquires whether the other controller is capable of accepting the alternative control program.
If you answered that you do not have the ability, contact another controller and
The fail-safe system according to claim 1 or 2, wherein the alternative control program is uploaded to an empty area of a storage unit of the control device using the control device that answered that it has the ability as the second control device. In a fail-safe system with multiple controls connected
The first control device, which is one of the control devices,
A control program used for normal control and an alternative control program used for control in the event of a failure are stored in the storage unit of the first control device.
The alternative control program is uploaded to the free area of the storage unit of the second control device, which is one of the other control devices.
The second control device is
Monitor the first controller and
When the first control device fails, the alternative control program stored in the storage unit of the second control device is executed.
The first control device transmits at least one of the RAM capacity and the processing load used at the time of execution in addition to the program capacity of the alternative control program to another control device, and the other control device performs the alternative. Inquire if you are capable of accepting control programs,
If you answered that you do not have the ability, contact another controller and
A control unit that answered the ability second full E-yl-safe system upload to Rukoto the said alternative control program in the free area of the storage unit and the feature of the control device as the control device. In a fail-safe system with multiple controls connected
The first control device, which is one of the control devices,
A control program used for normal control and an alternative control program used for control in the event of a failure are stored in the storage unit of the first control device.
The alternative control program is uploaded to the free area of the storage unit of the second control device, which is one of the other control devices.
The second control device is
Monitor the first controller and
When the first control device fails, the alternative control program stored in the storage unit of the second control device is executed.
The first controller asks if the other controller is capable of accepting the alternative controller.
If you answered that you do not have the ability, contact another controller and
If all the control devices responded that they were incapable, the alternative control program was split and the alternative control program was split.
For each of the divided alternative control programs, the other control device is repeatedly inquired as to whether or not the other control device has the ability to accept the divided alternative control program, and the control device that answers that the ability is available is used as the second control device of the control device. full E-yl-safe system in which the divided alternate control program in the free area of the storage unit to said upload to Rukoto. In a fail-safe system with multiple controls connected
The first control device, which is one of the control devices,
A control program used for normal control and an alternative control program used for control in the event of a failure are stored in the storage unit of the first control device.
The alternative control program is uploaded to the free area of the storage unit of the second control device, which is one of the other control devices.
The second control device is
Monitor the first controller and
When the first control device fails, the alternative control program stored in the storage unit of the second control device is executed.
In the second control device, at least one of the free area of the storage unit of the control device, the free area of RAM, the average load of the computer, and the peak load of the computer changes due to the change of the control state, and the storage of the control device. When it is predicted that the first control device stored in the unit will no longer be able to accept the alternative control program, the first control device is notified that it will no longer be able to accept it.
When the first control device is notified that it is no longer capable of accepting, the first control device repeatedly inquires whether another control device is capable of accepting the alternative control program, and the storage unit of the control device that replies that it is capable of accepting the alternative control program. full E-yl-safe system, wherein uploading to Rukoto the said alternative control program in the free space. In a fail-safe system with multiple controls connected
The first control device, which is one of the control devices,
A control program used for normal control and an alternative control program used for control in the event of a failure are stored in the storage unit of the first control device.
The alternative control program is uploaded to the free area of the storage unit of the second control device, which is one of the other control devices.
The second control device is
Monitor the first controller and
When the first control device fails, the alternative control program stored in the storage unit of the second control device is executed.
The first control device is
Asked if the other controller was capable of accepting the alternative control program, and answered that it was capable.
When the control device detects an abnormality,
When the control device detects an abnormality a specific number of times within a specific period,
When the control device confirms an abnormality,
At least in the case one, full E-yl-safe system characterized upload to Rukoto the other of said alternative control program in the free area of the storage unit of the control device a control device as a second control device. Any of claims 1 to 6, wherein each of the plurality of control devices as the first control device starts uploading the alternative control program in the order of the control device having the alternative control program having a larger capacity at startup. The fail-safe system described in item 1. The first control device is connected to an input device and an output device via a communication line, performs arithmetic processing based on the input information received from the input device, and transmits the output information to the output device to control an external device. The fail-safe system according to any one of claims 1 to 8.

Images