JP3864747B2 - Redundant signal processor - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
  The present invention relates to a control system comprising a plurality of signal processing devices having mutually different circuit configurations, interconnected via a network, and performing various controls in cooperation with each other.ToThe present invention relates to a redundant signal processing device used.
[0002]
[Prior art]
Conventionally, a device failure such as an electronic control unit (ECU) that performs vehicle control may immediately lead to a decrease in safety, and in a device that requires high reliability, it is redundant by duplicating the device. It has been made to have a characteristic configuration. That is, if the apparatus is duplicated, even if one (active system) fails, the apparatus is prevented from stopping by switching to the other (redundant system).
[0003]
By the way, as shown in FIG. 10, there are a great many types of ECUs such as an engine control ECU 102, a steering control ECU 104, a brake control ECU 106, an air conditioner control ECU 108, a transmission control ECU, a suspension control ECU, and the like. Moreover, these ECUs are interconnected via a network to form a so-called in-vehicle LAN.
[0004]
Each ECU has a different function and performs vehicle control in cooperation with each other. Therefore, if one of these ECUs fails, the other ECUs are also affected. Therefore, it is desirable that all ECUs have a redundant configuration.
[0005]
[Problems to be solved by the invention]
However, since many ECUs are mounted on the vehicle as described above, it is very difficult to duplicate all these ECUs in terms of space, weight, and cost. There was a problem.
[0006]
In addition, since it is unlikely that multiple ECUs will fail at the same time, if all ECUs are duplicated, there will be a large number of redundant systems that will not be used at all. There was also.
In order to solve the above problems, the present invention provides a control system comprising a plurality of signal processing devices that have mutually different circuit configurations, are interconnected via a network, and perform various controls in cooperation with each other. It is an object of the present invention to provide redundancy to all the signal processing devices without duplicating the signal processing devices and to obtain high reliability.
[0007]
[Means for Solving the Problems]
  The invention according to claim 1, which is an invention for achieving the above object.Redundant signal processorHave different circuit configurations,Interconnected over a network,A plurality of signal processing devices that perform various controls in cooperation with each otherUsed in connection with a control system consisting of
[0008]
  Then, when an abnormality occurs in any of the signal processing devices, the signal processing device in which the abnormality has occurred is set as a target device, and the redundant signal processing device set to a circuit configuration that realizes a function equivalent to the target device Operates on behalf of the target device.
  Thus, the present inventionRedundant signal processor is connectedAccording to the control system, since the redundant signal processing device can substitute for any signal processing device, redundancy is provided to all signal processing devices without duplicating all signal processing devices. High reliability can be obtained by adding a minimum necessary configuration.
[0009]
Note that only one redundant signal processing device may be provided in the control system. However, when the number of signal processing devices connected to the network is large, a plurality of redundant signal processing devices may be provided in the control system. Also, when a plurality of redundant signal processing devices are provided, a plurality of signal processing devices may be provided, but the signal processing devices are grouped so that one or a plurality of signal processing devices are provided for each group. A signal processing device may be provided. For example, if a group is formed by signal processing devices having common input / output signal lines, the redundant signal processing device has a different configuration for each group, but the device configuration of each redundant signal processing device is simplified. Can be In addition, if a group is configured with signal processing devices that are physically close to each other, the delay of various signals does not change significantly before and after switching to the redundant system, and signal processing is executed at strict timing. However, it is possible to prevent the reliability from deteriorating.
[0010]
  Further, according to claim 1Redundant signal processor, DoubleFrom an I / F port group corresponding to all signals input to and output from a number of signal processing devices and a programmable logic device (PLD) whose circuit configuration is defined according to downloaded hardware data (also referred to as configuration data) Signal processing means. When the abnormality detection unit detects an abnormality of the signal processing device connected to the network, the download control unit uses the signal processing device in which the abnormality is detected as a target device to realize a function equivalent to that of the target device. The hardware data is downloaded to the signal processing means, and the activation means activates the signal processing means from which the hardware data has been downloaded.In addition, when the circuit configuration realized by the signal processing means includes an arithmetic processing unit that executes processing according to the control program, the program supply means supplies a control program necessary for the operation of the arithmetic processing unit.
[0011]
Thus, in the redundant signal processing device of the present invention, since the PLD is used as the signal processing means, the circuit configuration of the signal processing means is the same as that of the target device simply by downloading the hardware data corresponding to the target device. Can be easily configured to achieve equivalent functionality. Moreover, by using the PLD, even if the number of signal processing devices to be handled increases, it can be dealt with simply by increasing the hardware data. Change) can be handled very flexibly.
[0012]
The PLD includes a field programmable gate array (FPGA) and a field programmable logic array (FPLA).
The PLD may be one in which writing of hardware data is allowed only once, but is preferably one that can be rewritten repeatedly. In this case, for example, after repairing the failed signal processing device, the PLD is returned to the non-functional state, so that the redundant processing device can be used repeatedly without replacing the PLD.
[0013]
The control system using the redundant signal processing apparatus of the present invention connected thereto is, for example, an electronic control unit in which the network is an in-vehicle LAN and the signal processing apparatus shares and executes vehicle control as described in claim 2. (ECU) may be used.
[0014]
Then, the download control means stores the hardware data corresponding to each of the signal processing devices in advance in the data storage means, for example, as in claim 3, and the data reading means is the abnormality detection means. According to the detection result, the hardware data corresponding to the target device is read out of the hardware data stored in the data storage means, and the hardware data read out from the data storage means in this way is downloaded to the signal processing means. It can be constituted as follows.
[0015]
  Also,The program supply means is, for example, a claim4As described, the control program corresponding to each of the signal processing devices is stored in advance in the program storage means, and the supply program selection means is stored in the program storage means according to the detection result in the abnormality detection means. Of the control programs, the control program corresponding to the target device can be configured to be accessible from the arithmetic processing unit.
[0016]
  The program supply means is, for example, a claim5As described, the supply program acquisition unit acquires the control program corresponding to the target device via the network according to the detection result of the abnormality detection unit, and stores it in the program storage unit that can be accessed from the arithmetic processing unit. You may comprise as follows.
[0017]
  In this case, the program storage means only needs to have a capacity capable of storing a control program for one signal processing apparatus, and the apparatus can be miniaturized.
  Moreover, when acquiring a control program via a network in this way, the claim6As described, the program acquisition unit preferably acquires a control program corresponding to the target device from a signal processing device other than the target device. This is because the signal processing device (that is, the target device) in which an abnormality has been detected cannot always send the control program normally. Therefore, in this case, all the signal processing devices are controlled one by one so that the control programs for the other signal processing devices transmitted to the redundant signal processing device do not overlap with each other in addition to the control program for the own device. You should have it.
[0018]
  Further, the program acquisition means is a claim.7As described, it may be included in the circuit configuration realized by the signal processing means. In this case, it is not necessary to provide dedicated hardware other than the signal processing means for the program acquisition means, and the configuration of the redundant signal processing apparatus can be simplified.
[0019]
  By the way, the abnormality detection means is, for example, a claim8As described, the signal processing apparatus is monitored periodically for heartbeat signals including identification information for identifying at least the transmission source signal processing apparatus. It can be configured to detect.
[0020]
DETAILED DESCRIPTION OF THE INVENTION
Embodiments of the present invention will be described below with reference to the drawings.
[First Embodiment]
FIG. 1 is a schematic configuration diagram of a control system to which the present invention is applied.
[0021]
As shown in FIG. 1, the control system of this embodiment is an engine as a signal processing device via a network (hereinafter referred to as “in-vehicle LAN”) composed of a bus-like transmission line that performs communication using the TCP / IP protocol. A control ECU 2, a steering control ECU 4, a brake control ECU 6, and an air conditioner control ECU 8 (hereinafter collectively referred to as “active ECU”) are connected to each other, and any of these active ECUs 2, 4, 6, 8 is connected. A redundant ECU 10 is connected as a redundant signal processor that can be used as a substitute for the ECU.
[0022]
There are many active ECUs other than those described above, such as a transmission control ECU, a suspension control ECU, and the like. Here, in order to simplify the explanation and drawings, the above-mentioned ECUs are described above. Only four ECUs are connected to the in-vehicle LAN.
[0023]
Each of the active ECUs 2, 4, 6, and 8 is provided with a signal line for inputting / outputting an input signal from a sensor, an output signal to an actuator to be controlled, and the like. Based on various information obtained by communication with other ECUs via the LAN, each control is divided and executed. Each of the active ECUs 2, 4, 6, and 8 is assigned a unique IP number. In communication via the in-vehicle LAN, the transmission source ECU and the transmission destination ECU are identified by the IP number. Has been.
[0024]
The active ECUs 2, 4, 6, and 8 are each configured to send a heartbeat signal to the bus periodically (for example, 100 ms). Here, as shown in FIG. 2, the heartbeat signal includes identification information (IP number in this embodiment) for identifying the transmission source ECU, an identification code for indicating that the frame is a heartbeat signal, It consists of output count values that are independently given by the ECUs 2, 4, 6, and 8 and that are incremented each time a heartbeat signal is sent.
[0025]
That is, by monitoring the output count value of the heartbeat signal for each ECU 2, 4, 6, 8 according to the ECU identification information, it is possible to determine whether each ECU 2, 4, 6, 8 is operating normally. It becomes possible to judge.
Next, as shown in FIG. 3, the redundant ECU 10 has all the input / output signal lines wired to the active ECUs 2, 4, 6, and 8, and is provided corresponding to each of these signal lines. An I / F port group 12 including a digital input I / F (interface), a digital output I / F, an analog input I / F, an analog output I / F, a serial input I / F, a serial output I / F, and the like; The signal processing unit 14 as a signal processing unit including a field programmable gate array (FPGA) whose circuit configuration is defined according to the downloaded hardware (HW) data, and the hardware data to be downloaded are stored in the signal processing unit 14 Of the data ROM group 16 as data storage means and the data ROMs 16a to 16d constituting the data ROM group 16, a selection signal is selected. Operates a CPU configured on the FPGA as a part of the signal processing unit 14 and a download control unit 18 as a data reading unit that reads out hardware data from the data ROM designated according to Sd and downloads it to the signal processing unit 14 Among the program ROM group 20 as a program storage means storing a control program for causing the program ROM 20 and the program ROMs 20a to 20d constituting the program ROM group 20, the program ROM designated according to the selection signal Sp There is an abnormality when an abnormality is detected in any of the active ECUs by monitoring the ROM changeover switch 22 serving as a supply program setting means that is set to be accessible from the CPU and the heartbeat signal on the bus. Active ECU (hereinafter referred to as “target ECU”) The selection signal Sd, Sp corresponding to the target ECU is generated and the reset signal R is output to the signal processing unit 14 in which the hardware data has been downloaded by the download control unit 18 that has received the selection signal Sd. Thus, a monitoring control unit 24 that activates the signal processing unit 14 and a power supply unit 28 that supplies power to each unit of the redundant ECU 10 are provided.
[0026]
The data ROMs 16a to 16d constituting the data ROM group 16 correspond to the engine control (E control) ECU 2, the steering control (S control) ECU 4, the brake control (B control) ECU 6, and the air conditioner control (E control) ECU 8. The hardware data for realizing the function equivalent to each ECU in the signal processing unit 14 is stored.
[0027]
Similarly, the program ROMs 20a to 20d constituting the program ROM group 20 store the same control programs as those used by the CPUs provided in the ECUs 2, 4, 6, and 8, respectively.
Here, the hardware data and the control program are different for each of the ECUs 2, 4, 6, and 8. However, for example, even if the hardware data is common and only the control program is different. Good. In that case, the number of data ROMs constituting the data ROM group 16 can be reduced.
[0028]
Next, the monitoring control unit 24 monitors the heartbeat signal to detect an abnormality in the abnormality detection unit 25 that detects an abnormality in the active ECU and the abnormality detection unit 25 detects an abnormality. The setting control unit 26 performs setting and activation of the signal processing unit 14 according to the detection result.
[0029]
Among these, the abnormality detection unit 25 includes the same number (four in this embodiment) of counters corresponding to each of the active ECUs 2, 4, 6, and 8 connected to the in-vehicle LAN. Each time a beat signal is received, the value of the counter corresponding to the ECU identified by the ECU identification information of the received heartbeat signal is compared with the output count value of the heartbeat signal. If they match, the counter is incremented to prepare for the next reception. On the other hand, they do not match (missing values or consecutive values), or a fixed period (for example, When the counter is not incremented for 200 ms or more, the setting control unit 26 is notified that an abnormality has occurred in the ECU corresponding to the counter.
[0030]
Here, the process executed by the setting control unit 26 will be described with reference to the flowchart shown in FIG.
When this process is started, first, it is determined whether or not an abnormality of the active ECU is detected by the abnormality detection unit 25 (S110). If no abnormality is detected, the process waits until it is detected. Then, when an abnormality is detected in the active ECU, the ECU in which the abnormality is detected is set as a target ECU, and a selection signal Sd corresponding to the target ECU is output, so that the download control unit 18 corresponds to the target ECU. The hardware data is downloaded to the signal processing unit 14 (S120). In the FPGA, all input / output terminals not related to download are set to high impedance until the download is completed, and the signal is connected to the input / output terminals of the FPGA during the download. Thus, other components (active ECU, sensor, actuator, etc.) are not adversely affected.
[0031]
Subsequently, by outputting the selection signal Sp corresponding to the above-described target ECU, the ROM changeover switch 22 is set so that the control program corresponding to the target ECU can be accessed from the signal processing unit 14 (S130).
Then, when downloading of hardware data to the signal processing unit 14 and setting of a control program enabling access from the signal processing unit 14 are completed, a reset signal R is output to the signal processing unit 14. Then, by downloading the hardware data, the signal processing unit 14 set to have a function equivalent to that of the target ECU is activated (S140), and this process is terminated. The reset signal R may be used not only to activate the signal processing unit 14 but also as a signal for disconnecting the target ECU from the bus.
[0032]
The data ROM group 16, the download control unit 18 and S120 correspond to download control means, the program ROM group 20, the ROM changeover switch 22 and S130 correspond to program supply means, and S140 corresponds to start-up means.
In the redundant ECU 10 configured as described above, for example, when the target ECU in which an abnormality is detected is the engine control ECU 2, the engine stored in the data ROM 16a by the download control unit 18 as shown in FIG. The control hardware data is downloaded to the FPGA constituting the signal processing unit 14. Then, only the same signals as those used in the engine control ECU 2 among the signals input / output via the I / F port group 12 are input to the FPGA via the ports and ports. A / D converter that converts signals into digital values, D / A converter that converts signals output via ports into analog values, etc., CPU, RAM, bus state controller, DMA controller, interrupt controller , A timer and the like are configured, and a circuit configuration having functions equivalent to the engine control ECU is realized.
[0033]
At this time, when the reset signal R is input to the signal processing unit 14 by making the program ROM 20a accessible from the signal processing unit 14 by the ROM changeover switch 22, the CPU constituting the signal processing unit 14 The process is executed in accordance with a control program for engine control stored in the program ROM 20a. As a result, the redundant ECU 10 functions as an engine control ECU in place of the engine control ECU 2 in which an abnormality has been detected.
[0034]
FIG. 6 shows a state where the target ECU in which abnormality is detected is the air conditioner control ECU 8. The download control unit 18 converts the air conditioner control hardware data stored in the data ROM 16d into signal processing. A circuit having a function equivalent to that of the air conditioner control ECU 8 including a port, a CPU, a RAM, a bus controller, a serial control circuit (SCI), an interrupt controller and the like on the FPGA by being downloaded to the FPGA constituting the unit 14 Configuration is realized.
[0035]
At this time, when the reset signal R is input to the signal processing unit 14 by making the program ROM 20d accessible from the signal processing unit 14 by the ROM changeover switch 22, the CPU constituting the signal processing unit 14 Then, the process is executed in accordance with the control program for air conditioner control stored in the program ROM 20d. As a result, the redundant ECU 10 functions as an air conditioner control ECU in place of the air conditioner control ECU 8 in which an abnormality is detected.
[0036]
Although only the case where the engine control ECU 2 and the air conditioner control ECU 8 are the target ECUs is shown here, the same applies to the case where the other ECUs 4 and 6 are the target ECUs.
As described above in detail, the control system of the present embodiment includes the redundant ECU 10 that can substitute any of the active ECUs 2, 4, 6, and 8. When such an abnormality is detected, the redundant ECU 10 is operated on behalf of the target ECU in which the abnormality is detected.
[0037]
Therefore, according to the control system of the present embodiment, all active ECUs 2, 4, 6, and 8 can be made redundant without duplicating all active ECUs 2, 4, 6, and 8. In addition, high reliability can be obtained by adding the minimum necessary configuration of a single redundant ECU 10.
[0038]
Moreover, in the present embodiment, the signal processing unit 14 of the redundant ECU 10 is configured using an FPGA, and the hardware data is downloaded so that the circuit configuration of the signal processing unit 14 can be set arbitrarily and easily. Has been.
[Second Embodiment]
Next, a second embodiment will be described.
[0039]
As shown in FIG. 7, in the control system of the present embodiment, the active ECUs 2a, 4a, 6a, 8a and the redundant ECU 10a are connected via the in-vehicle LAN, as in the first embodiment.
Among them, the active ECUs 2a, 4a, 6a, and 8a are a control program for the steering control ECU in the engine control ECU 2a, a control program for the engine control ECU in the steering control ECU 4a, a control program for the air conditioner control ECU in the brake control ECU 6a, A control program for the brake control ECU is mounted on the air conditioner control ECU 8a, and the control program according to the request from the redundant ECU 10a can be provided via the bus constituting the in-vehicle LAN. The configuration is the same as that of the first embodiment.
[0040]
On the other hand, the redundant ECU 10a is different from that of the first embodiment only in the configuration for supplying the control program to the CPU that constitutes the signal processing unit 14, so that the configuration differs from the first embodiment. Explained.
That is, as shown in FIG. 8, the redundant ECU 10a in this embodiment stores a startup ROM 30 in which a startup program described later is stored, and a control program, instead of the program ROM group 20 and the ROM changeover switch 22. A program RAM 32 is provided. Both the activation ROM 30 and the program RAM 32 are configured to be accessible from the CPU constituting the signal processing unit 14.
[0041]
Further, in each of the data ROMs 16a to 16d constituting the data ROM group 16, in addition to hardware data for realizing the same circuit configuration as that of the first embodiment, a control program is transmitted from another ECU via the in-vehicle LAN. Hardware data for realizing a circuit necessary for acquisition (for example, a request frame generation circuit) on the FPGA constituting the signal processing unit 14 is incorporated.
[0042]
Next, in the monitoring control unit 24, the processing in the setting control unit 26a is changed from the flowchart shown in FIG. 4 to S130 omitted in accordance with the change in the configuration described above, and this setting control unit 26a executes the processing. The processing will be described with reference to the flowchart shown in FIG.
[0043]
That is, when this process is started, it is first determined whether or not an abnormality of the active ECU is detected by the abnormality detection unit 25 (S210). If no abnormality is detected, the process waits until it is detected. Then, when an abnormality is detected in the active ECU, the ECU in which the abnormality is detected is set as a target ECU, and a selection signal Sd corresponding to the target ECU is output, so that the download control unit 18 corresponds to the target ECU. The hardware data is downloaded to the signal processing unit 14 (S220).
[0044]
When the download of the hardware data to the signal processing unit 14 is completed, the reset signal R is output to the signal processing unit 14 so that the hardware data is downloaded to have the same function as the target ECU. The set signal processing unit 14 is activated (S230), and this process is terminated. The reset signal R may be used not only to activate the signal processing unit 14 but also as a signal for disconnecting the target ECU from the bus.
[0045]
As described above, in the signal processing unit 14 in which the hardware data has been downloaded, when the reset signal R is input, the CPU configured on the FPGA first executes processing according to the startup program stored in the startup ROM 30. To do.
The processing contents of the activation program will be described with reference to the flowchart shown in FIG.
[0046]
When this process starts, first, a control program provision request is output to the ECU having the control program of the target ECU via the in-vehicle LAN, and the provided control program is stored in the program RAM 32 (S310). ). For example, when the target ECU is the brake control ECU 6, a control program provision request is output to the air conditioner control ECU 8 (see FIG. 7).
[0047]
Next, the control program for the target ECU stored in the program RAM 32 is started in this way (S320), and this process is terminated.
Thereby, the redundant ECU 10a functions as the target ECU in place of the target ECU in which the abnormality is detected.
[0048]
In the present embodiment, the program RAM 32 corresponds to a program storage unit, a circuit for acquiring a control program from another ECU configured on the FPGA, and S310 corresponds to a supply program acquisition unit.
As described above in detail, the control system according to the present embodiment includes the redundant ECU 10a that can substitute any of the active ECUs 2a, 4a, 6a, and 8a, and any of the active ECUs 2a, 4a, 6a, and 8a. When such an abnormality is detected, the redundant ECU 10a is operated on behalf of the target ECU in which the abnormality is detected, and the redundant ECU 10a is configured using an FPGA.
[0049]
Therefore, according to the control system of this embodiment, the same effect as the control system of the first embodiment can be obtained.
Moreover, in the present embodiment, the active ECUs 2a, 4a, 6a, and 8a share and hold the control program to be executed by the redundant ECU 10a, and provide the control program in response to a request from the redundant ECU 10a. Has been.
[0050]
Therefore, in the redundant ECU 10a, the memory capacity required for storing the control program can be greatly reduced, and the apparatus can be configured at a low cost, as compared with the first embodiment.
[Other Embodiments]
Although the embodiment of the present invention has been described above, the present invention is not limited to the above embodiment, and can be implemented in various modes without departing from the gist of the present invention.
[0051]
For example, in the above embodiment, the redundant ECUs 10 and 10a are provided with the I / F port group 12 corresponding to all the signals so as to be compatible with all the ECUs. When it can be realized on the FPGA constituting the signal processing unit 14, only necessary signal lines need be wired without providing the I / F port group 12.
[0052]
In the above embodiment, only one redundant ECU 10, 10a is provided in the control system. However, when there are many active ECUs, a plurality of redundant ECUs 10, 10a may be provided in the control system. Good.
When a plurality of redundant ECUs 10 and 10a are provided as described above, the active ECUs may be divided into groups, and one or a plurality of redundant ECUs 10 and 10a may be provided for each group. In that case, if the ECUs are grouped for each common signal to be wired, the redundant ECUs can be reduced in size, and if the ECUs are grouped close to each other physically, the signal delay can be reduced. Can be prevented from becoming a problem.
[Brief description of the drawings]
FIG. 1 is an overall configuration diagram of a control system according to a first embodiment.
FIG. 2 is an explanatory diagram showing a configuration of a heartbeat signal.
FIG. 3 is a block diagram showing a configuration of a redundant ECU in the first embodiment.
FIG. 4 is a flowchart showing the contents of processing executed by a setting control unit.
FIG. 5 is an explanatory diagram showing a setting state of a redundant ECU when an abnormality occurs in the engine control ECU.
FIG. 6 is an explanatory diagram showing a setting state of the redundant ECU when an abnormality occurs in the air conditioner control ECU.
FIG. 7 is an overall configuration diagram of a control system according to a second embodiment.
FIG. 8 is a block diagram showing a configuration of a redundant ECU in the second embodiment.
FIG. 9 is a flowchart showing the contents of processing executed by the setting control unit and the contents of processing of a startup program.
FIG. 10 is an explanatory diagram for illustrating problems of a conventional control system.
[Explanation of symbols]
2, 2a ... Engine control ECU 4, 4a ... Steering control ECU
6, 6a ... Brake control ECU 8, 8a ... Air conditioner control ECU
DESCRIPTION OF SYMBOLS 10, 10a ... Redundant ECU 12 ... I / F port group 14 ... Signal processing part
16 ... Data ROM group 16a-16d ... Data ROM
18 ... Download control unit 20 ... Program ROM group
20a to 20d ... Program ROM 22 ... ROM changeover switch
24 ... Monitoring control unit 25 ... Abnormality detection unit 26, 26a ... Setting control unit
28 ... Power supply unit 30 ... Start-up ROM 32 ... Program RAM

Claims (8)

Have mutually different circuit configurations, be interconnected via a network, the hand is used to control systems linked to consist of a plurality of signal processing apparatus for executing various controls, it is configured to be arbitrarily set the circuit arrangement, When an abnormality occurs in any of the signal processing devices, the signal processing device in which the abnormality has occurred is set as a target device, and a circuit configuration that realizes a function equivalent to the target device is set and operates on behalf of the target device. A redundant signal processing device ,
An anomaly detecting means for detecting an anomaly of the signal processing apparatus connected to the network;
Signal processing means comprising a programmable logic device (PLD) whose circuit configuration is defined in accordance with downloaded hardware data;
An I / F port group corresponding to all signals input to and output from the plurality of signal processing devices;
Download control means for downloading, to the signal processing means, hardware data for realizing a function equivalent to the target apparatus, with the signal processing apparatus in which the abnormality is detected by the abnormality detection means as the target apparatus;
Starting means for starting the signal processing means in which the hardware data is downloaded by the download control means;
When the circuit configuration realized by the signal processing unit includes an arithmetic processing unit that executes processing according to a control program, a program supply unit that supplies a control program necessary for the operation of the arithmetic processing unit;
A redundant signal processing apparatus comprising: 2. The redundant signal processing apparatus according to claim 1, wherein the network is an in-vehicle LAN, and the signal processing apparatus is composed of an electronic control unit (ECU) that shares and executes vehicle control. The download control means includes
Data storage means in which hardware data corresponding to each of the signal processing devices connected to the network is stored in advance;
Data reading means for reading out the hardware data corresponding to the target device among the hardware data stored in the data storage means for downloading to the signal processing means according to the detection result of the abnormality detection means. ,
The redundant signal processing apparatus according to claim 1, further comprising: The program supply means includes
Program storage means in which a control program corresponding to each of the signal processing devices is stored in advance;
Supply program setting means for setting a control program corresponding to the target device among the control programs stored in the program storage means so as to be accessible from the arithmetic processing unit according to the detection result of the abnormality detection means. When,
The redundant signal processing apparatus according to claim 1, further comprising: The program supply means includes
Program storage means accessible from the arithmetic processing unit;
In accordance with the detection result of the abnormality detection means, a control program corresponding to the target device is acquired via the network and stored in the program storage means;
The redundant signal processing apparatus according to claim 1, further comprising: The redundant system signal processing device according to claim 5, wherein the supply program acquisition unit acquires a control program corresponding to the target device from a signal processing device other than the target device. The supply program acquisition means, said signal processing means redundant signal processing apparatus according to claim 5 or claim 6 further characterized in that is included in the circuit configuration for implementing. The abnormality detection means is periodically transmitted from each signal processing device to the network, and monitors at least a heartbeat signal including identification information for identifying the signal processing device of the transmission source. redundant signal processing device according to any one of claims 1 to claim 7, characterized in that to detect the abnormality.

Images