JP2009059084A - Control system, electronic equipment, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To make another piece of electronic equipment achieve a function by an application component mounted on certain electronic equipment without uselessly consuming resources in each of a plurality of pieces of electronic equipment. <P>SOLUTION: When an application component mounted on certain electronic equipment is not normally operated (replica processing start), the application component is transferred from the electronic equipment to another piece of electronic equipment on which the application component can be mounted, so as to be mounted on the electronic equipment (size information-development). Thus, it is possible for the electronic equipment to achieve the function by the application component by mounting the application component transferred from the other electronic equipment on itself, and it is not necessary to mount it in advance. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a control system including a plurality of electronic devices each having an application component that implements a part of functions necessary for controlling the operation of a control target.

  In the control system described above, normally, any one of the electronic devices implements the function of the application component mounted on the electronic device via each electronic device, and each of the application components and the electronic device on which the electronic component is mounted. By controlling based on the mounting correspondence relationship, the operation of the control target is controlled.

Further, in recent years, when the function realized by the application component installed in a specific electronic device is not normally realized, the function (for example, data relay) by the application component is realized in another electronic device. Such a technique has been proposed (see Patent Document 1).
JP 2004-64626 A

  However, in the above-described technique, at least one or more electronic devices out of a plurality of electronic devices are also mounted with the application components so that the functions of the application components mounted on the other electronic devices can be realized. It is necessary to keep.

For this reason, there are many application components that need to be mounted on each electronic device, and there is a problem that resources (particularly memory storage areas) are unnecessarily consumed.
The present invention has been made in order to solve such a problem, and the object of the present invention is to provide functions by application components implemented in a certain electronic device without unnecessarily consuming resources in each of the plurality of electronic devices. It is to be able to be realized in another electronic device.

  In order to solve the above-mentioned problem, a plurality of electronic devices each having an application component that realizes a part of functions necessary for controlling the operation of a control target are provided, and any one of the electronic devices Realization of a function by an application component mounted on the electronic device via each of the electronic devices is referred to as a correspondence relationship between each of the application components and the electronic device on which the application component is mounted (hereinafter referred to as “mounting correspondence relationship”) The control system configured to control the operation of the control object by managing based on the first configuration (Claim 1) or the second configuration (Claim 2) shown below It is possible to do.

  First, in the first configuration, each of the electronic devices first determines whether or not the application component is operating normally based on an operation state of the application component mounted on the electronic device. To do.

  When it is determined that the operation determining unit does not operate normally, the mounting inquiry unit is mounted on the electronic device for each electronic device other than the electronic device (hereinafter referred to as “other electronic device”). Inquire whether the application component is ready to be installed.

  Then, the proxy selection means realizes the function by the application component mounted on the electronic device from the electronic devices that have received the inquiry from the mounting inquiry means and responded that "they are ready for mounting". When the electronic device to be used as a proxy is selected, the application transfer unit transfers the application component mounted on the electronic device to the electronic device thus selected.

  In addition, when receiving an inquiry from another electronic device as to whether or not the device can be mounted, the mounting determination unit determines whether or not the device is in the state based on the operation state of the electronic device. . When it is determined by the mounting determination means that the mounting is possible, the possible response means responds to the inquiry source electronic device, and the application mounting means Then, the application component transferred from the electronic device as the response destination is mounted on the electronic device.

  Then, the correspondence updating unit updates the electronic device corresponding to the application component mounted by the application mounting unit among the mounting correspondences of the electronic device to the electronic device, and thus the mounting correspondence is updated. When this happens, the update notification means notifies the other electronic devices to that effect.

  Further, when the fact that the mounting correspondence relationship has been updated is notified from another electronic device, the correspondence matching unit updates the mounting correspondence relationship of the electronic device in accordance with the notified content.

  On the other hand, in the second configuration, among the electronic devices, the transfer-side electronic device that is one or more electronic devices, first, the operation determination unit is based on the operation state of the application component mounted on the electronic device, It is determined whether or not the application component is operating normally.

  When it is determined that the operation determining unit does not operate normally, the mounting inquiry unit is mounted on the electronic device for each electronic device other than the electronic device (hereinafter referred to as “other electronic device”). Inquire whether the application component is ready to be installed.

  Then, the proxy selection means realizes the function by the application component mounted on the electronic device from the electronic devices that have received the inquiry from the mounting inquiry means and responded that "they are ready for mounting". When the electronic device to be used as a proxy is selected, the application transfer unit transfers the application component mounted on the electronic device to the electronic device thus selected.

  Further, when the fact that the mounting correspondence relationship has been updated is notified from another electronic device, the correspondence matching unit updates the mounting correspondence relationship of the electronic device in accordance with the notified content.

  In addition, among the electronic devices, the transferred-side electronic device that is an electronic device other than the transfer-side electronic device is mounted when receiving an inquiry from another electronic device as to whether or not it is ready for mounting. The determination unit determines whether or not the electronic device is in the state based on the operation state. When it is determined by the mounting determination means that the mounting is possible, the possible response means responds to the inquiry source electronic device, and the application mounting means Then, the application component transferred from the electronic device as the response destination is mounted on the electronic device.

  Then, the correspondence updating unit updates the electronic device corresponding to the application component mounted by the application mounting unit among the mounting correspondences of the electronic device to the electronic device, and thus the mounting correspondence is updated. When this happens, the update notification means notifies the other electronic devices to that effect.

  In the case of a control system having such a configuration, when an installed application component does not operate normally in an electronic device, the application component is transferred from the electronic device to another electronic device. Can be transferred and mounted on this electronic device.

  In this way, the electronic device only needs to mount the transferred application component in itself, and the function of the application component can be realized without mounting it in advance.

  As a result, the number of application components that should be implemented in each electronic device is not increased unnecessarily, and as a result, applications implemented in a certain electronic device without unnecessarily consuming resources (particularly memory storage areas). The function of the component can be realized in another electronic device.

  The specific configuration for determining whether or not the application component is operating normally by the operation determination unit in the above configuration is not particularly limited. For example, when a request for the application component occurs, the request It may be configured to determine that the device is not operating normally when there is no normal response to the.

  In addition, the specific configuration for determining that the “mounting is possible” by the mounting determination unit described above is not particularly limited. For example, a third configuration in which each of the above configurations is shown below (Claim 3) is considered.

  In this configuration, when receiving an inquiry as to whether or not the mounting determination unit is in a state that can be mounted from another electronic device, when an unused storage area in the built-in memory remains more than a predetermined area, It is determined that it can be mounted.

  With this configuration, an electronic device that has received an inquiry as to whether or not it can be mounted determines whether or not it can be mounted based on an unused storage area in its internal memory. Can be determined. The electronic device that made the inquiry can select the electronic device to which the application component is to be transferred from among the electronic devices in which the unused area of the predetermined area or more remains in the built-in memory.

Further, in this configuration, in particular, it is conceivable to adopt a fourth configuration (claim 4) in which the mounting inquiry means and the mounting determination means are as described below.
In this configuration, the mounting inquiry means leaves a storage area necessary for mounting the application component as an inquiry as to whether or not the application component can be mounted to each of the other electronic devices. Inquire whether or not. When the mounting determination unit receives an inquiry from other electronic devices as to whether or not the mounting is possible, the unused storage area of the built-in memory is equal to or greater than the “necessary storage area” related to the inquiry. If it remains, it is determined that it can be mounted.

  With this configuration, an electronic device that has received an inquiry as to whether or not it can be mounted has whether or not an unused area necessary for mounting the application component remains in its internal memory. Thus, it is possible to determine whether or not it is in a mountable state. The electronic device that has made the inquiry may select an electronic device to which the application component is to be transferred from among the electronic devices in which unused areas necessary for mounting the application component remain in the built-in memory. it can.

  As for the third and fourth configurations, the configuration for determining whether or not the electronic device that has received the inquiry is in a mountable state based on the storage area of its own internal memory. Further, the possible response means and the proxy selection means may be a fifth configuration (Claim 5) as described below.

  In this configuration, when the possible response means determines that the mounting determination means is in a mountable state, as a response to that effect, the unused storage area remaining in the built-in memory is Respond to the inquiring electronic device. Then, the proxy selection unit selects an electronic device having the largest storage area in the response from the electronic devices that have responded in response to the inquiry from the implementation inquiry unit, and performs the function of the application component implemented in the electronic device. Select as an electronic device to be realized.

  With this configuration, an electronic device having the largest unused storage area in the built-in memory can be selected as an electronic device that should be used as a proxy for realizing the function by the application component.

In each of the above configurations, the proxy selection means may be sixth or seventh configurations (Claims 6 and 7) as described below.
First, in the sixth configuration, the proxy selecting unit mounts an electronic device that has responded “to be mountable” earliest after the inquiry by the mounting inquiry unit in the electronic device. Select the electronic device that should be used as a proxy for the realization of the function by the application component.

  With the sixth configuration, the electronic device that has responded the earliest upon receiving an inquiry can be selected as an electronic device that should be used as a proxy for realizing the function by the application component.

  Further, in the seventh configuration, the proxy selection means has the lightest processing load according to the operation state of the control system at that time among the electronic devices that have responded to the inquiry from the mounting inquiry means. Is selected as an electronic device to be used as a proxy for realizing a function by an application component installed in the electronic device.

  With the seventh configuration, the electronic component that is assumed to have the lightest processing load according to the operation state of the control system at that time is selected from the electronic devices that have received and responded to the inquiry. It can be selected as an electronic device to be used to represent the function.

By the way, the mounting inquiry means in each configuration described above should immediately make an inquiry when the operation determining means determines that it is not operating normally.
However, if an application component does not operate normally due to a temporary problem, it is expected that it will resume normal operation if the application component is restarted. It can be said that it is not necessary to transfer the application component to another electronic device until such time.

  Therefore, it is preferable that the application component can be restarted in advance in consideration of the above-mentioned trouble. For this purpose, each of the above-described configurations should be configured as an eighth configuration (claim 8) as shown below. Conceivable.

  In this configuration, every time it is determined that the electronic device does not operate normally until the cumulative number of times that the operation determining unit determines that it is not operating normally reaches a predetermined upper limit value, An application restarting means for repeatedly restarting the application component implemented in is provided. The mounting inquiry means makes an inquiry to each of the other electronic devices when the cumulative number of times determined as not operating normally by the operation determining means reaches a predetermined upper limit value.

  With this configuration, the application component can be repeatedly restarted until the cumulative number of times that the application component is determined not to operate normally reaches a predetermined upper limit value.

  As a result, when the application component does not operate normally due to a temporary trouble, the application component can be restarted in advance to return to a normal operation state again. In this case, the application component operates normally, and it is not determined that the application component is not operating normally. Therefore, an inquiry as to whether or not the application component can be mounted and its transfer are performed. It will never be.

  On the other hand, when the cumulative number of times determined to be not operating normally reaches a predetermined upper limit value, an inquiry is made as to whether or not the application component can be mounted for the first time. Will be able to do. In this way, it is possible to prevent the application component from being unnecessarily transferred to another electronic device.

  In this configuration, the cumulative number of times that the operation determining means determines that the device is not operating normally is, for example, the number of times that each electronic device has been determined not to operate normally after the start-up. It is only necessary to count within (for example, during activation).

  Further, when the application component is transferred by the application transfer means having the above-described configuration, the application component may be transferred as it is, but the data amount may be compressed and transferred. For this purpose, it is conceivable that each of the above-described configurations is as shown in a ninth configuration (claim 9).

  In this configuration, the application transfer unit transfers an application component mounted on the electronic device after compressing the application component using a predetermined compression algorithm, and the application mounting unit is transferred from the response destination electronic device. The incoming application component is decompressed by a decompression algorithm corresponding to the compression algorithm and then mounted on the electronic device.

  With this configuration, the transfer of application components between electronic devices can be performed with the amount of data compressed, so the communication load required for the transfer can be reduced.

  Further, when the application component is transferred by the application transfer means having the above-described configuration, it may be transferred as it is, but it may be encrypted and transferred. For this purpose, it is conceivable that each of the above-described configurations is as shown in a tenth configuration (claim 10).

  In this configuration, the application transfer unit transfers the application component mounted on the electronic device after encrypting it with a predetermined encryption algorithm, and the application mounting unit transmits the response from the response destination electronic device. The transferred application component is decrypted by a decryption algorithm corresponding to the encryption algorithm, and then mounted on the electronic device.

  With this configuration, the transfer of application components between electronic devices can be performed in an encrypted state, so that leakage of application components during the transfer can be prevented.

Moreover, as a structure for solving the said subject, it is good also as an electronic device (Claim 11) provided with all the means with which the electronic device in any one of the said 1st-10th structures is equipped.
This is because this configuration can function as the electronic device in any of the first to tenth configurations.

  Further, as a configuration for solving the above-described problem, a program for causing a computer system to execute various processing procedures for causing the computer system to function as the electronic device according to any one of the first to tenth configurations (claim 12). Also good.

This is because any computer system controlled by this program can function as an electronic device in any one of the first to tenth configurations.
Note that the above-described program is composed of an ordered sequence of instructions suitable for processing by a computer system, and is provided to each electronic device and a user using the same via various recording media and communication lines. Is.

Embodiments of the present invention will be described below with reference to the drawings.
(1) Overall Configuration and Basic Operation As shown in FIG. 1, the control system 1 includes a plurality of electronic devices (ECUs) that are communicably connected via a network 100, and are connected via an actuator 200. And a system configured to drive a predetermined control target.

  In the present embodiment, the control electronic device 2 that controls the operation of the actuator 200, the detection electronic device 3 that detects a predetermined parameter via the sensor 300, and the display unit 400 perform display related to the operation to be controlled. A configuration including the display electronic device 4 and the like will be exemplified.

  Each of these electronic devices inputs and outputs signals to and from the control unit 10 that controls the operation of the entire electronic device, the storage unit 12 that stores various data, and external devices (actuators 200, sensors 300, and display units 400). An input / output unit 14 is provided, a transmission unit 16 that controls transmission of data to the network 100, a reception unit 18 that controls reception of data from the network 100, and the like.

  In addition, as shown in FIG. 2, each electronic device has application components (hereinafter referred to as “APC”) 22, 32, and 42 that realize some of the functions necessary for controlling the operation of the controlled object. By expanding and starting this in the built-in memory of the control unit 10, processing related to driving of the controlled object is executed according to this APC. In the process of executing this process, the realization of the function by the APC 20 is managed by executing various processes described later by the component management units 24, 34, 44 as functions implemented in the control unit 10.

Here, the procedure until the control electronic device 2 operates the actuator 200 using the detection result from the sensor 300 by the detection electronic device 3 will be described with reference to FIG.
First, in the control electronic device 2, the component A management unit 24 activates the control APC 22 after being expanded in the built-in memory ("activation request" in FIG. 3).

The control APC 22 activated in this way generates an acquisition command to acquire a control parameter necessary for controlling the operation of the actuator 200 ("acquisition command" in the figure).
Receiving this acquisition command, the component management unit 34 issues an acquisition request for requesting the control parameter to another electronic device in which the APC capable of generating the corresponding control parameter is mounted (“Acquisition” in the figure). request").

  Here, first, based on the management information table stored in the storage unit 12, another electronic device in which APC capable of generating the corresponding control parameter is mounted is specified. As shown in FIG. 4, the management information table includes each APC mounted in each electronic device (“target APC” in the figure) and an electronic device in which the APC is mounted (“mounted electronic device” in the figure). Are registered in association with each other, and if a parameter based on the detection result of the sensor 300 is required as a control parameter, the detection electronic device in which the detection APC 32 capable of generating the parameter is mounted is used. Device 3 is identified. Then, an acquisition request is made to the detection electronic device 3 thus identified.

  In each data record in the management information table, “OK” indicating an appropriately activated state is registered as an initial value as a value indicating the activated state of the APC registered therein (see FIG. "Status").

  On the detection electronic device 3 side that has received the acquisition request described above, the component management unit 34 activates the detection APC 32 to expand it in the built-in memory, and then indicates that a control parameter is required for the detection APC 32. Make the required request (“Required Request” in the figure).

  The detection APC 32 that has received the necessary request performs an acquisition source notification for notifying the component management unit 34 of the sensor 300 that is an acquisition source of the sensor parameters necessary for generating the requested control parameter ( ("Source notification").

  Receiving this acquisition source notification, the component management unit 34 acquires sensor parameters indicating the detection result by the sensor 300 from the sensor 300 notified thereby ("parameter request", "parameter notification" in the figure).

  In this way, the component management unit 34 that has acquired the sensor parameter makes a generation request to the detection APC 32 to generate a control parameter based on the sensor parameter (“generation request” in the figure). Upon receiving this generation request, the detection APC 32 generates a control parameter based on the sensor parameter, and transmits this control parameter to the component management unit 34 ("parameter response 1" in the figure).

  In this way, the component management unit 34 that has received the control parameter from the detection APC 32 transmits the control parameter to the requesting control electronic device 2 that has previously made an acquisition request ("parameter response 2" in the figure). .

Then, on the control electronic device 2 side that has received this control parameter, the component management unit 24 passes the control parameter to the control APC 22 (“parameter response 3” in the figure), and the control APC 22 that has received this control parameter receives the control parameter. The actuator 200 is operated by a control amount determined based on the parameters ("control" in the figure).
(2) Processing by Component Management Unit In the following, various processing procedures executed by the component management unit of each electronic device according to the program stored in the built-in memory in the process of controlling the actuator 200 as described above will be described in order. .
(2-1) Failure detection process First, after the electronic device is activated, a failure detection process that is executed each time a request to the APC (see “activation request”, “necessary request”, “generation request”) occurs. The processing procedure will be described with reference to FIG. This failure detection process is realized by the failure detection function of the component management unit (see FIG. 2).

When this failure detection process is activated, first, counting by a timer is started (s110).
Next, it is checked whether a response to the request issued prior to the activation of the failure detection process has been received (s120).

  If it is determined that a response has been received in s120 (s120: YES), after the timer started in s110 is stopped and reset (s130), the failure detection process ends.

  If it is determined in s120 that no response has been received (s120: NO), it is checked whether the APC is operating normally (s140). Here, when the count value of the timer at this time reaches a predetermined threshold value, it is determined that the APC is not operating normally.

  If it is determined that the APC is operating normally in s140, that is, if the count value of the timer has not reached the predetermined threshold value (s140: YES), the process returns to s120.

  On the other hand, when it is determined that the APC is not operating normally, that is, when the count value of the timer reaches a predetermined threshold (s140: NO), the cumulative number of restarts of the APC is set. It is checked whether the value of the variable N (initial value “0”) reaches a predetermined upper limit value Nmax (s150).

  If the value of the variable N does not reach the upper limit value Nmax in s150 (s150: NO), the APC 10 is restarted (see “restart request” in FIG. 6) (s160), and the variable N is incremented (N + 1 → N) (s170), the process proceeds to s130, and the failure detection process ends.

  In this way, when the failure detection processing is completed after restarting the APC, the request that triggered the failure detection processing is reissued (see “Required Request” in FIG. 6). (Refer to (Retransmission) ”), the failure detection process is newly activated based on the request reissued in this manner.

Further, if the value of the variable N has reached the upper limit value Nmax in s150 (s150: YES), it is considered that the APC has failed (s180), and after the replica processing described later is started (s190), The process proceeds to s130 and the failure detection process ends.
(2-2) Replica Process Next, the process procedure of the replica process started in s190 of the failure detection process will be described with reference to FIG. This replica processing is realized by the replica management function of the component management unit (see FIG. 2).

  When this replica process is activated, first, the target APC is expanded in the built-in memory for the APC (hereinafter referred to as “target APC”) that was the target in the failure detection process that was executed prior to the activation. Therefore, size information indicating the memory size (storage area) necessary for this is generated as information to which the identification information of the target APC is added (s210).

  Next, after the size information generated in s210 is transferred to the transmission unit 16 (s220), the transmission unit 16 is instructed to transmit the size information thus transferred to each of the other electronic devices. (S230). Receiving the instruction to transmit in this way, the transmitting unit 16 transmits (broadcasts) the previously transferred size information to each of the other electronic devices (see “size information” in FIG. 6).

  On the electronic device side that has received this size information, whether or not an unused area that can expand the target APC identified by the identification information added thereto remains in the built-in memory of the control unit 10. When it is determined that the unused area remains, a response to the size information is returned (ACK is returned). That is, this size information is information for inquiring whether or not an application component can be mounted in an unused area in the built-in memory.

  Thus, after the transmission of the size information, responses from each of the other electronic devices are collected (s240), and the electronic device that has made one of the collected responses is the target APC. The destination is selected (s250).

  Here, for example, it is conceivable to select the electronic device that has responded earliest to the size information as the transfer destination. In this case, the electronic device that has responded when the responses are first collected in s240. The device may be selected as the transfer destination.

  In addition, it is conceivable to select the electronic device having the largest unused area as the transfer destination. In this case, the electronic device that has received the size information notifies the remaining unused area, and Of the responses collected over a certain period of time in s240, the electronic device that has made the largest response to the notified unused area may be selected as the transfer destination.

  Further, it is conceivable to select an electronic device having the lowest operating rate in accordance with the operating state of the control system 1, and in this case, the control system 1 at that time is selected from the electronic devices from which responses are collected by s240. The electronic device that is assumed to have the lightest processing load according to the operation state may be selected as the transfer destination.

  Further, it is conceivable to select the electronic device having the highest priority as the transfer destination from among the electronic devices that have responded to the size information, and in this case, among the electronic devices that are the response collection sources in s240. Therefore, the electronic device having the highest priority order may be selected as the transfer destination.

  Then, the target APC is transferred to the electronic device selected in s250 (s260). Here, the component management unit 34 transmits a transfer permission request to the corresponding electronic device, and after receiving a response (ACK) to the request, starts the transfer of the target APC. After the transfer start is notified by the transfer start frame, the target APC starts transfer (see “transfer permission request” to “APC transfer” in FIG. 6), and when the transfer ends, A transfer end frame for notifying the effect is transmitted (see “transfer start frame” to “transfer end frame” in the figure).

The APC transfer is performed in a state where the APC is compressed with a predetermined compression algorithm and encrypted with a predetermined encryption algorithm.
(2-3) Loading Process Next, the processing procedure of the loading process that is started each time the size information from the other electronic device 2 (transmitted by s230 in FIG. 7) is received will be described with reference to FIG. explain. This loading process is realized by the loading function of the component management unit (see FIG. 2).

  When this loading process is activated, first, based on the size information received prior to the activation, an unused area necessary for developing the APC having the memory size indicated by this size information remains in the internal memory. It is determined whether or not (s310).

If it is determined in s310 that the corresponding unused area does not remain in the memory (s310: NO), the loading process ends immediately.
On the other hand, if it is determined in s310 that the corresponding unused area remains in the memory (s310: YES), a response to the size information is made (see “ACK” immediately after “size information” in FIG. 6). ) (S320). This response is collected in the other electronic device, and the electronic device that has collected the response sends a transfer permission request (see FIG. 6) to any one of the electronic devices that have selected the response. Come forward. If the size information received prior to the activation of the loading process is for requesting notification of an unused area, in s320, the unused area is notified as a response to the size information. Is made.

  Next, after a response is made in s320, if a transfer permission request is not transmitted within a predetermined period from another electronic device that is the response destination (s330: NO), the loading process is immediately terminated. Thus, the fact that the transfer permission request has not been transmitted means that the electronic device has not been selected as the APC transfer destination.

  On the other hand, when a transfer permission request is transmitted within a predetermined period from another electronic device as a response destination (s330: YES), reception of APC transferred from the electronic device is started (s340). Here, when a response to the transfer permission request is made (ACK is returned), the transfer start is notified by the transfer start frame, and reception of APC transferred thereafter is started. Thereafter, the APC reception is continued until the end of the transfer is notified by the transfer end frame (see “APC transfer” in FIG. 6).

  In this way, after the APC reception is started, until the end of the APC transfer is notified by the transfer end frame, that is, until the APC reception ends (s350: NO).

  Thereafter, when it is notified by the transfer end frame that the APC transfer has ended (s350: YES), a response to the transfer end frame is made (see “ACK” immediately after the “transfer end frame” in FIG. 6) (s360). .

  Next, the APC notified of the end of transfer in s350 is expanded on the built-in memory (s370). When deploying this APC, the APC is decompressed by a decompression algorithm corresponding to the compression algorithm used in the electronic device of the transfer source, and decrypted by a decryption algorithm corresponding to the encryption algorithm used in the electronic device. Then, the development is done.

  Next, the communication paths between the APC developed on the memory in s370 (see “Detected APC replica” in FIGS. 2 and 6) and the component management unit 44, the transmission unit 16, and the reception unit 18 are as follows. And the link of APC is established (s380).

  Then, after a link completion notification indicating that the link establishment by s380 has been completed is issued (s390), the loading process ends. This link completion notification is a trigger for starting a replica recognition process to be described later.

(2-4) Replica Recognition Processing Next, a replica recognition processing procedure started every time a link completion notification (issued in s390 in FIG. 8) is issued will be described with reference to FIG. This replica recognition process is realized by the replica management function of the component management unit (see FIG. 2).

  When the replica recognition process is activated (s410: YES), first, based on the link completion notification issued prior to the activation, the APC developed in the loading process at the time of the issuance and the electronic device are described above. Is registered in the management information table (s420).

  Here, first, a new data record is generated in the management information table of the electronic device (for example, refer to the data record of identifier 4 in FIG. 4B), and this is followed by the APC (see FIG. "Detected APC replica") is registered as "target APC", and the electronic device (see "display electronic device" in the figure) is registered as "mounted electronic device" and the electronic device (sender of the APC) ( "Refer to" Electronic device for control "in the figure") is registered as "Old electronic device".

Note that “NG” indicating a state in which the data record is not properly activated is set in the activated state (“state” in the figure) in the data record.
Then, after issuing a replica recognition notification indicating that the replica of the APC 10 is recognizable by s420 (s430), the replica recognition process ends. This replica recognition notification is a trigger for starting a process allocation process to be described later.
(2-5) Process Allocation Process Next, a process procedure of a process allocation process that is started every time a replica recognition notification (issued in s420 in FIG. 9) is issued will be described with reference to FIG. This replica recognition process is realized by the process control function of the component management unit (see FIG. 2).

  When this process allocation process is activated (s440: YES), first, regarding the replica recognition notification issued prior to the activation, the APC replica (that is, loading) registered in the management information table in the replica recognition process at the time of issuance is issued. A process is assigned to the replica so that the APC developed in the processing becomes a state of functioning as an APC on the memory of the corresponding electronic device (s450).

  Here, the management information table is also updated along with the process allocation. Specifically, first, the activation state (“state” in FIG. 3) of the data record corresponding to the replica is appropriately set. It is updated to “OK” indicating the activated state. Then, another data record in which the same electronic device as the electronic device set in the “old electronic device” in the data record is set as the “mounted electronic device” is extracted, and the activation state (same as above) in this data record is It is updated to “NG” indicating a state where it has not been properly activated (see the data record of identifier 4 in FIG. 4B). In this way, the previously deployed APC is mounted on the electronic device.

  Then, after the replica generation completion notification that the process has been assigned to the APC replica in s450 is transferred to the transmission unit 16 (s460), the transferred replica generation completion notification is transmitted to each of the other electronic devices. The transmitter 16 is instructed to do (s470). Receiving the instruction to transmit in this way, the transmitting unit 16 transmits (broadcasts) the replica generation completion notification transferred earlier to each of the other electronic devices.

The replica generation completion notification is generated by associating the update information indicating the update contents of the management information table in s450, and each electronic device that has received the replica generation completion notification The management information table is updated based on the update information.
(2-6) Update Process Next, a process procedure of an update process that is executed every time a replica generation completion notification transmitted from another electronic device is received will be described with reference to FIG.

  When the update process is activated (s510: YES), the management information table of the electronic device is updated based on the replica generation completion notification received prior to the activation (s520). Here, based on the update information associated with the replica generation completion notification, the management information table is updated according to the update content indicated by the update information.

In this way, after the management information table is updated, the update process ends.
(3) Operation after Management Information Table Update The procedure until the control electronic device 2 that has updated the management information table through the above processes operates the actuator 200 using the detection result of the detection electronic device 3 is shown in FIG. 11 will be described.

  First, after updating the management information table, the control electronic device 2 is restarted after the APC 22 is expanded in the built-in memory by the component management unit 24 ("start request" in the figure).

The control APC 22 activated in this way generates an acquisition command to acquire a control parameter necessary for controlling the operation of the actuator 200 ("acquisition command" in the figure).
Receiving this acquisition command, the component management unit 24 issues an acquisition request for requesting the control parameter to another electronic device in which the APC capable of generating the corresponding control parameter is mounted (“Acquisition” in the figure). request").

  Here, based on the management information table shown in FIG. 4B, first, another electronic device in which APC capable of generating the corresponding control parameter is mounted is specified. If a parameter based on the detection result by the sensor 300 is required as a control parameter, the display electronic device 4 is specified as the electronic device on which the detection APC replica 46 capable of generating the parameter is mounted. Then, an acquisition request is made to the display electronic device 4 thus specified.

  On the display electronic device 4 side that has received the acquisition request described above, the component management unit 44 activates the detection APC replica 46 to expand it in the built-in memory, and then requires a control parameter for the detection APC replica 46. A necessary request to the effect is made ("Necessary request" in the figure).

  The detection APC replica 46 that has received this necessary request is connected to the component management unit 44 with the sensor 300 from which the sensor parameters necessary for generating the requested control parameter are obtained, and the sensor 300. An acquisition source notification is sent to notify the electronic device ("Acquisition source notification" in the figure).

  Upon receipt of this acquisition source notification, the component management unit 34 requests a sensor parameter indicating the detection result by the sensor 300 to the electronic device (in this case, the detection electronic device 3) notified thereby ("parameter" in the figure). Request 1 ").

  In the detection electronic device 3 that has received this request, the component management unit 34 acquires sensor parameters indicating the detection results of the sensor 300 from the sensor 300 ("parameter request 2", "parameter notification 1" in the figure). This is returned to the display electronic device 4 (“parameter notification 2” in the figure).

  In this way, the component management unit 44 of the display electronic device 4 that has acquired the sensor parameter requests the detection APC replica 46 to generate a control parameter based on the sensor parameter (see “Generation request” in the figure). "). The detection APC replica 46 that has received this generation request generates a control parameter based on the sensor parameter, and then passes this control parameter to the component management unit 44 ("parameter response 1" in the figure).

  In this way, the component management unit 44 that has received the control parameter from the detected APC replica 46 transmits the control parameter to the requesting control electronic device 2 that has previously made the acquisition request (see “Parameter Response 2” in the figure). ").

Then, on the control electronic device 2 side that has received this control parameter, the component management unit 24 passes the control parameter to the control APC 22 (“parameter response 3” in the figure), and the control APC 22 that has received this control parameter receives the control parameter. The actuator 200 is operated by a control amount determined based on the parameters ("control" in the figure).
(4) Operation and Effect With the control system 1 configured as described above, when an installed application component does not operate normally in an electronic device (s180 in FIG. 5), the electronic device The application component can be transferred to another electronic device (s210 to s260 in FIG. 7) and mounted on the electronic device.

  In this way, the electronic device only has to mount the transferred application component on itself (s310 to s390 in FIG. 8 and s410 to s470 in FIG. 9). Can be realized (see “display electronic device 4” in FIG. 11).

  As a result, the number of application components that should be implemented in each electronic device is not increased unnecessarily, and as a result, applications implemented in a certain electronic device without unnecessarily consuming resources (particularly memory storage areas). The function of the component can be realized in another electronic device.

  Further, in the above embodiment, when each electronic device receives size information from another electronic device, that is, when it receives an inquiry as to whether or not it is in a mountable state, an unused storage area in the built-in memory is stored. When a predetermined area (an unused area necessary for developing the APC) or more remains, it is determined that the state is mountable (s310 “YES” in FIG. 8). Thereby, each electronic device can determine whether or not it is in a mountable state based on an unused storage area in its own internal memory.

  Then, the electronic device that made the inquiry can select an electronic device to which the application component is to be transferred from among the electronic devices in which an unused area of a predetermined area or more remains in the built-in memory (see FIG. 7 s250).

  Specifically, for example, the electronic device that has responded the earliest to the size information, the remaining electronic device that has the largest unused area, and the lightest processing load depending on the operating state of the control system 1 at that time It is possible to select an electronic device that is assumed to be the highest priority or an electronic device having a highest priority set in advance as an electronic device that should act as a transfer destination, that is, an APC function.

  In the above embodiment, even when it is determined that the APC is not operating normally (s140 “NO” in FIG. 5), the APC is restarted a predetermined number of times (s150 “YES” in FIG. 5). "), For the first time, it is considered that the APC is out of order (s180 in the figure).

  If the APC does not operate normally due to a temporary trouble, it is expected that if the APC is restarted, it will resume normal operation. It can be said that there is no need to transfer the APC to another electronic device.

  Therefore, if the APC is configured to be restarted as in the above embodiment, the APC is repeatedly restarted until the cumulative number of times that the APC is determined not to operate normally reaches a predetermined upper limit value. can do. As a result, when the APC does not operate normally due to a temporary trouble, the APC can be restarted in advance to return to a normal operation state. In this case, the application component operates normally, and it is not determined that the application component is not operating normally. Therefore, an inquiry as to whether or not the application component can be mounted and its transfer are performed. It will never be.

  On the other hand, when the cumulative number of times determined to be not operating normally reaches a predetermined upper limit value, an inquiry is made as to whether or not APC can be mounted for the first time, and the transfer is performed. (S210 to s260 in FIG. 7). In this way, it is possible to prevent the APC from being unnecessarily transferred to another electronic device.

  In the above embodiment, APC transfer between electronic devices can be performed in a state where the amount of data is compressed by a predetermined compression algorithm, so that the communication load required for the transfer can be reduced.

In the above embodiment, since APC transfer between electronic devices can be performed in a state encrypted by a predetermined encryption algorithm, leakage of APC during the transfer can be prevented.
(5) Modifications Embodiments of the present invention have been described above, but the present invention is not limited to the above-described embodiments, and can take various forms as long as they belong to the technical scope of the present invention. Needless to say.

  For example, in the above embodiment, the case where the control system 1 includes three electronic devices, that is, the control electronic device 2, the detection electronic device 3, and the display electronic device 4 is illustrated in the above embodiment. The number of electronic devices is not limited to three.

  In the above-described embodiment, all electronic devices are configured not only to transfer APC to other electronic devices but also to develop and mount APC transferred from other electronic devices. Illustrated. However, any one of the electronic devices constituting the control system is one of the transfer of APC to other electronic devices and the deployment and implementation of APC transferred from the other electronic devices. You may comprise so that only.

  In the above embodiment, after the electronic device is activated, a failure detection process is executed every time a request for APC occurs, and when it is determined that the APC has failed (s180 in FIG. 5), Application components are transferred (s190 in FIG. 7 and s210 to s260 in FIG. 7). However, the transfer of the application component may be performed when an event other than a request for the APC occurs or at regular intervals.

  Further, in the above embodiment, even if the APC is not operating normally (s140 “NO” in FIG. 5), after the APC is restarted a predetermined number of times (s150 “YES” in FIG. 5), For the first time, the APC is considered to have failed (s180 in the figure).

However, the APC may be immediately regarded as having failed because the APC is not operating normally without restarting the APC. In this case, if “NO” is determined in s140 of FIG. 5, the process may be shifted to s180 immediately without performing s150.
(6) Corresponding relationship with the present invention In the embodiment described above, the management information table is the mounting corresponding relationship in the present invention, s110 to s140 in FIG. 5 are the operation determining means in the present invention, and s150 to s170 in FIG. Is an application restart means in the present invention, s210 to s230 in FIG. 7 are implementation inquiry means in the present invention, s240 and s250 in FIG. 7 are proxy selection means in the present invention, and s260 in FIG. 7 is an application in the present invention. S310 in FIG. 8 is an implementation determination unit in the present invention, s320 in FIG. 8 is a possible response unit in the present invention, and s370 to s390 in FIG. 9 and s410 to s450 in FIG. 9 are application implementations in the present invention. S420 is a correspondence updating means in the present invention, and s460 and s470 in FIG. S520 in FIG. 10 is a correspondence matching means in the present invention.

  In the above embodiment, the electronic device configured to transfer APC to another electronic device is the transfer-side electronic device in the present invention, and the APC transferred from the other electronic device is expanded and mounted. The electronic device configured to perform is the transferred-side electronic device in the present invention.

Block diagram showing the overall configuration of the control system The figure which shows the image of APC and component management part which were mounted in each electronic device Timing chart showing information exchange by each electronic device (Part 1) The figure which shows the data structure of a management information table Flow chart showing failure detection processing Timing chart showing exchange of information by each electronic device (part 2) Flow chart showing replica processing Flow chart showing loading process Flow chart showing replica recognition process and process allocation process Flow chart showing management information update processing Timing chart showing the exchange of information by each electronic device (Part 3)

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... Control system, 2 ... Control electronic device, 3 ... Detection electronic device, 4 ... Display electronic device, 10 ... Control part, 12 ... Memory | storage part, 14 ... Input-output part, 16 ... Transmission part, 18 ... Reception , 24 ... Component management part, 34 ... Component management part, 44 ... Component management part, 46 ... Detection APC replica, 100 ... Network, 200 ... Actuator, 300 ... Sensor.

Claims (12)

Each of the electronic devices includes a plurality of electronic devices on which application components that realize some of the functions necessary for controlling the operation of the control target are mounted, and each of the electronic devices By managing the realization of the function by the application component mounted on the electronic device based on the correspondence between each of the application components and the electronic device on which the application component is mounted (hereinafter referred to as “mounting correspondence”), A control system configured to control the operation of the controlled object,
Each of the electronic devices
Operation determining means for determining whether or not the application component is operating normally based on the operation state of the application component mounted on the electronic device;
When the operation determining means determines that the device is not operating normally, the application component mounted on the electronic device is mounted on each electronic device other than the electronic device (hereinafter referred to as “other electronic device”). Implementation inquiry means to inquire whether or not it is possible,
Among the electronic devices that have received an inquiry from the mounting inquiry means and responded that “they are ready for mounting”, an electronic device that should be used as a proxy for realizing the function by the application component mounted on the electronic device. Proxy selection means to select;
An application transfer means for transferring an application component mounted on the electronic device to the electronic device selected by the proxy selection means;
When receiving an inquiry as to whether or not it is in a state that can be mounted from another electronic device, mounting determination means for determining whether or not it is in that state based on the operating state of the electronic device,
When it is determined by the mounting determination means that it is in a mountable state, possible response means that makes a response to that effect to the inquiring electronic device;
Application mounting means for mounting an application component transferred from the electronic device of the response destination on the electronic device after the response by the possible response means;
Corresponding update means for updating the electronic device corresponding to the application component mounted by the application mounting means out of the mounting correspondence relationship of the electronic device;
An update notification means for notifying each of the other electronic devices when the mounting correspondence is updated by the correspondence update means;
When it is notified from another electronic device that the mounting correspondence has been updated, a correspondence matching unit that updates the mounting correspondence of the electronic device in accordance with the notified content;
A control system comprising: Each of the electronic devices includes a plurality of electronic devices on which application components that realize some of the functions necessary for controlling the operation of the control target are mounted, and each of the electronic devices By managing the realization of the function by the application component mounted on the electronic device based on the correspondence between each of the application components and the electronic device on which the application component is mounted (hereinafter referred to as “mounting correspondence”), A control system configured to control the operation of the controlled object,
Among the electronic devices, the transfer-side electronic device, which is one or more electronic devices,
Operation determining means for determining whether or not the application component is operating normally based on the operation state of the application component mounted on the electronic device;
When the operation determining means determines that the device is not operating normally, the application component mounted on the electronic device is mounted on each electronic device other than the electronic device (hereinafter referred to as “other electronic device”). Implementation inquiry means to inquire whether or not it is possible,
Among the electronic devices that have received an inquiry from the mounting inquiry means and responded that “they are ready for mounting”, an electronic device that should be used as a proxy for realizing the function by the application component mounted on the electronic device. Proxy selection means to select;
An application transfer means for transferring an application component mounted on the electronic device to the electronic device selected by the proxy selection means;
When it is notified from another electronic device that the mounting correspondence has been updated, a correspondence matching unit that updates the mounting correspondence of the electronic device in accordance with the notified content;
With
Of the electronic devices, the transferred-side electronic device that is an electronic device other than the transfer-side electronic device is:
When receiving an inquiry as to whether or not it is in a state that can be mounted from another electronic device, mounting determination means for determining whether or not it is in that state based on the operating state of the electronic device,
When it is determined by the mounting determination means that it is in a mountable state, possible response means that makes a response to that effect to the inquiring electronic device;
Application mounting means for mounting an application component transferred from the electronic device of the response destination on the electronic device after the response by the possible response means;
Corresponding update means for updating the electronic device corresponding to the application component mounted by the application mounting means out of the mounting correspondence relationship of the electronic device;
An update notification means for notifying each of the other electronic devices when the mounting correspondence is updated by the correspondence update means;
A control system comprising: When the mounting determination unit receives an inquiry from another electronic device as to whether or not the mounting is possible, the mounting determination unit can be mounted when an unused storage area in the built-in memory remains more than a predetermined area. The control system according to claim 1, wherein the control system is determined to be. The mounting inquiry means determines whether or not a storage area necessary for mounting the application component remains as an inquiry as to whether or not the application component can be mounted to each of the other electronic devices. Make an inquiry,
When the mounting determination unit receives an inquiry from another electronic device as to whether or not the mounting is possible, the unused storage area of the built-in memory remains more than “necessary storage area” related to the inquiry. When it exists, it determines with it being in the state which can be mounted. The control system of Claim 3 characterized by the above-mentioned. When the possible response means determines that the mounting determination means is in a mountable state, as a response to that effect, the unused storage area remaining in the built-in memory is replaced with the inquiry source electronic In response to the device,
The proxy selection means realizes the function of the electronic device having the largest storage area in the response from the electronic devices that responded to the inquiry by the mounting inquiry means by the application component mounted on the electronic device. The control system according to claim 3 or 4, wherein the control system is selected as an electronic device to be substituted. The proxy selection means, after the inquiry by the mounting inquiry means, realizes the function by the application component mounted on the electronic device, which is the earliest response to the response that “it is ready for mounting”. The control system according to any one of claims 1 to 4, wherein the control system is selected as an electronic device to be substituted. The proxy selection unit is an electronic device that is assumed to have the lightest processing load according to the operation state of the control system at that time from among the electronic devices that have received and responded to the inquiry from the mounting inquiry unit. The control system according to any one of claims 1 to 4, wherein the control system is selected as an electronic device to be used as a proxy for realizing a function by an application component mounted on the electronic device. It is mounted on the electronic device every time it is determined that it is not operating normally until the cumulative number of times determined that it is not operating normally by the operation determining means reaches a predetermined upper limit value. An application restarting means for repeatedly restarting the application component,
The mounting inquiry means makes an inquiry to each of the other electronic devices when the cumulative number of times determined as not operating normally by the operation determining means reaches a predetermined upper limit value. The control system according to any one of 1 to 7. The application transfer means transfers the application component mounted on the electronic device after compressing it with a predetermined compression algorithm,
The application implementation unit decompresses an application component transferred from the electronic device that is a response destination using a decompression algorithm corresponding to the compression algorithm, and then causes the electronic device to implement the application component. The control system according to any one of 8. The application transfer means transfers the application component installed in the electronic device after encrypting it with a predetermined encryption algorithm,
The application implementation unit decrypts an application component transferred from the electronic device as a response destination with a decryption algorithm corresponding to the encryption algorithm, and causes the electronic device to implement the decrypted application component. The control system according to any one of 9 to 9. All the means with which the electronic device in any one of Claim 1 to 10 is provided The electronic device characterized by the above-mentioned.   A program for causing a computer system to execute various processing procedures for causing an electronic device according to any one of claims 1 to 10 to function.

Images