JPWO2020148870A1 - Alternative control device, alternative control method, alternative control program and fail operational system - Google Patents

Abstract

The alternative control device (20) detects that any one of the plurality of ECUs (Electronic Control Units) (30) mounted on the moving body (100) has failed. The alternative control device (20) has failed from the alternative storage unit that stores the alternative identifier that is the identifier of the alternative ECU (30) and the processing identifier that is the identifier of the termination process for each ECU (30). Reads out the alternative identifier and the processing identifier for the failed machine, which is the ECU (30) in which is detected. The alternative control device (20) finishes the process indicated by the read process identifier with respect to the alternative machine which is the ECU (30) indicated by the read alternative identifier, and the process executed by the failed machine. Instruct to execute.

Description

The present invention relates to a fail operation technique in which when a failure occurs in an ECU (Electronic Control Unit), processing of the failed ECU is continued by another ECU.

Research on autonomous driving technology that automatically controls vehicles without human intervention is in progress. When realizing automatic driving, a plurality of ECUs are mounted on the vehicle.
If some ECUs fail to perform processing, it may affect the safety of the vehicle. Therefore, when a failure occurs in such an ECU, it is necessary to realize a fail operation in which processing is continued by another ECU.

As a method of realizing the fail operation, there is a method in which the ECUs are multiplexed and the processing is continued by the standby ECU when a failure occurs. However, the ECU for realizing the automatic operation needs to be equipped with a processor having a high processing capacity and a large-capacity memory, and is expensive. Therefore, it is difficult to simply multiplex the ECU from the viewpoint of cost.

In Patent Document 1, when a failure of the minimum required ECU for traveling of a vehicle is detected, an alternative ECU having the required performance is selected from other non-failed ECUs according to a predetermined priority order. , It is described that the selected ECU replaces the failed ECU. As a result, in Patent Document 1, the fail operation of the ECU, which is the minimum necessary for traveling the vehicle, is realized without simply multiplexing the ECU.

Japanese Unexamined Patent Publication No. 2002-221075

When the ECU breaks down while the vehicle is running by automatic driving, it is necessary to shorten the time during which the processing executed by the failed ECU is stopped as much as possible. In the technique described in Patent Document 1, a process of identifying an alternative ECU is executed after an ECU failure occurs. Therefore, it takes time to identify the alternative ECU, and the processing executed by the failed ECU is stopped for a long time.
An object of the present invention is to make it possible to shorten the time during which the processing executed by the failed ECU is stopped.

The alternative control device according to the present invention is
A failure detection unit that detects that one of a plurality of ECUs (Electronic Control Units) mounted on a moving body has failed, and a failure detection unit.
A failure of the ECU detected by the failure detection unit from an alternative storage unit that stores an alternative identifier that is an identifier of a substitute ECU for each ECU and a processing identifier that is an identifier of the termination process to be terminated. An alternative selection unit that reads out the alternative identifier and the processing identifier for the machine,
For the alternative machine which is the ECU indicated by the alternative identifier read by the alternative selection unit, the processing indicated by the processing identifier read by the alternative selection unit is completed and executed by the failed machine. It is provided with a processing instruction unit that instructs the execution of the processing.

In the present invention, when a failure of the ECU is detected, the alternative identifier and the processing identifier for the failed machine are read from the alternative storage unit, and the processing indicated by the processing identifier for the alternative machine indicated by the alternative identifier is terminated. Instruct them to perform the processing that was being performed on the failed machine. Since the substitute ECU is specified only by reading the substitute identifier or the like from the substitute storage unit, it is possible to specify the substitute ECU in a short time.

The block diagram of the fail operational system 10 which concerns on Embodiment 1. FIG. The block diagram of the alternative control device 20 which concerns on Embodiment 1. FIG. The block diagram of the ECU 30 which concerns on Embodiment 1. FIG. The figure which shows the information stored in the alternative storage part 231 which concerns on Embodiment 1. FIG. The flowchart of the operation of the alternative control device 20 which concerns on Embodiment 1. FIG. The flowchart of the operation of the ECU 30 which is the alternative machine which concerns on Embodiment 1. FIG. The explanatory view of the specific example of the operation of the fail operation system which concerns on Embodiment 1. FIG. The block diagram of the alternative control device 20 which concerns on modification 1. FIG. The block diagram of the alternative control device 20 which concerns on Embodiment 2. FIG. The flowchart of the registration process which concerns on Embodiment 2. The figure which shows the resource information which concerns on Embodiment 2.

Embodiment 1.
*** Explanation of configuration ***
The configuration of the fail operational system 10 according to the first embodiment will be described with reference to FIG.
The fail operational system 10 includes an alternative control device 20 mounted on the mobile body 100 and a plurality of ECUs 30 mounted on the mobile body 100. The alternative control device 20 and each ECU 30 are connected via a transmission line 40.
The moving body 100 is a vehicle, a ship, an aircraft, or the like.

The configuration of the alternative control device 20 according to the first embodiment will be described with reference to FIG.
The alternative control device 20 is a computer such as an ECU.
The alternative control device 20 includes hardware for a processor 21, a memory 22, a storage 23, and a communication interface 24. The processor 21 is connected to other hardware via a signal line and controls these other hardware.

The alternative control device 20 includes a failure detection unit 211, an alternative selection unit 212, and a processing instruction unit 213 as functional components. The functions of each functional component of the alternative control device 20 are realized by software.
The storage 23 stores a program that realizes the functions of each functional component of the alternative control device 20. This program is read into the memory 22 by the processor 21 and executed by the processor 21. As a result, the functions of each functional component of the alternative control device 20 are realized.
Further, the storage 23 realizes the alternative storage unit 231. The alternative storage unit 231 may be realized by a storage provided outside the alternative control device 20.

The configuration of the ECU 30 according to the first embodiment will be described with reference to FIG.
The ECU 30 includes hardware for a processor 31, a memory 32, a storage 33, and a communication interface 34. The processor 31 is connected to other hardware via a signal line and controls these other hardware.

The ECU 30 includes a resource securing unit 311 and a processing execution unit 312 as functional components. The functions of each functional component of the ECU 30 are realized by software.
The storage 33 stores a program that realizes the functions of each functional component of the ECU 30. This program is read into the memory 32 by the processor 31 and executed by the processor 31. As a result, the functions of each functional component of the ECU 30 are realized.

The processors 21 and 31 are ICs (Integrated Circuits) that perform processing. Specific examples of the processors 21 and 31 are a CPU (Central Processing Unit), a DSP (Digital Signal Processor), and a GPU (Graphics Processing Unit).

The memories 22 and 32 are storage devices that temporarily store data. Specific examples of the memories 22 and 32 are SRAM (Static Random Access Memory) and DRAM (Dynamic Random Access Memory).

The storages 23 and 33 are storage devices for storing data. As a specific example, the storage 23 is an HDD (Hard Disk Drive). As a specific example, the storage 33 is a ROM (Read Only Memory). The storages 23 and 33 include SD (registered trademark, Secure Digital) memory card, CF (Compact Flash, registered trademark), NAND flash, flexible disk, optical disk, compact disk, Blu-ray (registered trademark) disk, DVD (Digital Versaille Disk), and the like. It may be a portable recording medium.

Communication interfaces 24 and 34 are interfaces for communicating with an external device. Specific examples of the communication interfaces 24 and 34 are Ethernet (registered trademark), USB (Universal Serial Bus), and HDMI (registered trademark, High-Definition Multimedia Interface) ports.

In FIG. 2, only one processor 21 was shown. However, the number of processors 21 may be plural, and the plurality of processors 21 may execute programs that realize each function in cooperation with each other. Similarly, the number of processors 31 may be plural, and the plurality of processors 31 may execute programs that realize each function in cooperation with each other.

*** Explanation of operation ***
The operation of the fail operational system 10 according to the first embodiment will be described with reference to FIGS. 4 to 7.
The operation of the alternative control device 20 in the operation of the fail operational system 10 according to the first embodiment corresponds to the alternative control method according to the first embodiment. Further, the operation of the alternative control device 20 in the operation of the fail operational system 10 according to the first embodiment corresponds to the processing of the alternative control program according to the first embodiment.

The information stored in the alternative storage unit 231 according to the first embodiment will be described with reference to FIG.
The alternative storage unit 231 stores, for each ECU 30, an alternative identifier that is an identifier of the alternative ECU 30 and a processing identifier that is an identifier of the termination process to be terminated.

The operation of the alternative control device 20 according to the first embodiment will be described with reference to FIG.
(Step S11: Failure detection process)
The failure detection unit 211 monitors a plurality of ECUs 30 and attempts to detect that any one of the plurality of ECUs 30 has failed. As a failure detection method, for example, an existing method such as sending a message and confirming whether or not there is a response may be used.
It should be noted that the failure detection unit 211 does not detect that all the ECUs 30 have failed, but even if it detects that only some of the ECUs 30 that are executing the process that needs to be continuously operated have failed. Good.

(Step S12: Failure determination process)
The failure detection unit 211 determines whether or not it is detected that the ECU 30 has failed in step S11.
If detected, the failure detection unit 211 proceeds to step S13. On the other hand, if the failure detection unit 211 does not detect the failure, the process returns to step S11 and attempts to detect that the ECU 30 has failed again after a certain period of time has elapsed.

(Step S13: Alternative selection process)
The alternative selection unit 212 reads out the alternative identifier and the processing identifier for the failed machine, which is the ECU 30 detected in step S11, from the alternative storage unit 231.
For example, the information shown in FIG. 4 is stored in the alternative storage unit 231. When the ECU 30A fails, the identifier "B" of the ECU 30B is read out as the alternative identifier, and the identifier of the process y is used as the processing identifier. A certain "y" is read out.

(Step S14: Processing instruction processing)
The processing instruction unit 213 finishes the process indicated by the processing identifier read in step S13 with respect to the alternative machine which is the ECU 30 indicated by the alternative identifier read in step S13, and is executed by the failed machine. Instruct to perform the process.
Note that the process instruction unit 213 does not instruct the alternative machine to execute all the processes executed by the failed machine, but executes only some processes that need to be continuously operated. You may instruct them to do so.

The operation of the ECU 30 which is the alternative machine according to the first embodiment will be described with reference to FIG.
(Step S21: Resource securing process)
When instructed in step S14 of FIG. 5, the resource securing unit 311 ends the process indicated by the process identifier. As a result, resources such as the processor 31 and the memory 32 in the alternative machine ECU 30 are freed up, and resources for executing the processing executed by the failed machine are secured.

(Step S22: Process execution process)
When the resource is secured in step S21, the process execution unit 312 executes the process executed by the failed machine. At this time, the process execution unit 312 executes only the specified process when the process to be executed is specified among the processes executed by the failed machine.

A specific example of the operation of the fail operational system according to the first embodiment will be described with reference to FIG. 7.
It is assumed that in step S11 of FIG. 5, the alternative control device 20 detects that the ECU 30A has failed. Then, when the information shown in FIG. 4 is stored in the alternative storage unit 231, the alternative control device 20 reads out the identifier “B” of the ECU 30B as the alternative identifier in step S13 of FIG. 5, and the processing identifier. Is read out as "y" which is an identifier of the process y. Then, in step S14 of FIG. 5, the alternative control device 20 instructs the alternative ECU 30B to end the process y and execute the process executed by the failed ECU 30A. Here, it is assumed that among the processes executed by the ECU 30A, the process P1 is instructed to be executed.
Then, in step S21 of FIG. 6, the ECU 30B, which is an alternative machine, ends the process y. Then, in step S22 of FIG. 6, the ECU 30B executes the process P1 executed by the ECU 30A.
The ECU 30, which may be selected as a substitute machine, stores the execution file of the substitute process in the storage 33 in advance. For example, in FIG. 7, the storage 33 of the ECU 30B stores a process P1 execution file which is an execution file of the process P1 executed by the ECU 30A.

*** Effect of Embodiment 1 ***
As described above, in the fail operation system 10 according to the first embodiment, when the failure of the ECU 30 is detected, the alternative control device 20 reads out the alternative identifier and the processing identifier for the failed machine from the alternative storage unit 231. Then, the alternative control device 20 instructs the alternative machine indicated by the alternative identifier to end the process indicated by the process identifier and execute the process executed by the failed machine.
Since the alternative ECU 30 is specified only by reading the alternative identifier and the like from the alternative storage unit 231, it is possible to specify the alternative ECU 30 in a short time. As a result, it is possible to shorten the time during which the processing executed by the failed ECU is stopped. Thereby, it is possible to increase the safety of the moving body 100.

*** Other configurations ***
<Modification example 1>
In the first embodiment, each functional component is realized by software. However, as a modification 1, each functional component may be realized by hardware. The difference between the first modification and the first embodiment will be described.

The configuration of the alternative control device 20 according to the first modification will be described with reference to FIG.
When each functional component is realized in hardware, the alternative control device 20 includes an electronic circuit 25 instead of the processor 21, the memory 22, and the storage 23. The electronic circuit 25 is a dedicated circuit that realizes the functions of each functional component, the memory 22, and the storage 23.

Examples of the electronic circuit 25 include a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, a logic IC, a GA (Gate Array), an ASIC (Application Specific Integrated Circuit), and an FPGA (Field-Programmable Gate Array). is assumed.
Each functional component may be realized by one electronic circuit 25, or each functional component may be realized by being distributed in a plurality of electronic circuits 25.

<Modification 2>
As a modification 2, some functional components may be realized by hardware, and other functional components may be realized by software.

The processor 21, the memory 22, the storage 23, and the electronic circuit 25 are referred to as processing circuits. That is, the function of each functional component is realized by the processing circuit.

Embodiment 2.
The second embodiment is different from the first embodiment in that the alternative control device 20 registers information in the alternative storage unit 231 according to the situation of the mobile body 100. In the second embodiment, these different points will be described, and the same points will be omitted.

*** Explanation of configuration ***
The configuration of the alternative control device 20 according to the second embodiment will be described with reference to FIG.
The alternative control device 20 is different from the alternative control device 20 shown in FIG. 2 in that it includes an alternative determination unit 214 and a data registration unit 215.

*** Explanation of operation ***
The operation of the fail operational system 10 according to the second embodiment will be described with reference to FIGS. 10 to 11.
The operation of the alternative control device 20 in the operation of the fail operational system 10 according to the second embodiment corresponds to the alternative control method according to the second embodiment. Further, the operation of the alternative control device 20 in the operation of the fail operational system 10 according to the second embodiment corresponds to the processing of the alternative control program according to the second embodiment.

In the second embodiment, the operation of the alternative control device 20 includes a registration process and an alternative control process. The alternative control process is the process described with reference to FIG. 5 in the first embodiment.

The registration process according to the second embodiment will be described with reference to FIG.
In the second embodiment, the alternative control device 20 periodically executes the registration process. The alternative control device 20 may execute the registration process every time the situation of the mobile body 100 changes, instead of executing the registration process periodically.
In the second embodiment, the situation of the moving body 100 is the moving environment of the moving body 100. As a specific example, the situation of the moving body 100 is a moving road type such as an expressway and a general road when the moving body 100 is a vehicle. Further, the situation of the moving body 100 is a time zone such as daytime and nighttime, a weather condition such as sunny weather, rain and fog, and the like.

(Step S31: Resource information acquisition process)
The alternative determination unit 214 acquires resource information indicating the resource usage status from each ECU 30. As shown in FIG. 11, the resource information indicates the amount of resources used for each process executed by the ECU 30, and also indicates the current amount of free resources not used by the ECU 30. In FIG. 11, each ECU 30 includes a 4-core processor 31, and the upper limit of the usage rate of the processor 31 is 400%. Further, the memory 32 of each ECU 30 is said to be 512 MB (megabytes).

(Step S32: Situation identification process)
The alternative determination unit 214 identifies the situation of the moving body 100.
Specifically, the alternative determination unit 214 acquires information indicating the status of the mobile body 100 from an external device connected via the communication interface 24. For example, the alternative determination unit 214 acquires position information indicating the position where the moving body 100 moves from the navigation system mounted on the moving body 100.

The processes from step S33 to step S37 are executed with each of the plurality of ECUs 30 as the target ECU 30.
If it is detected in step S11 of FIG. 5 that only a part of the ECUs 30 that are executing the processes that need to be continuously operated have failed, the processes from steps S32 to S37 have failed. It suffices to be executed only for a part of the ECUs 30 to be detected.

(Step S33: Required resource identification process)
The alternative determination unit 214 specifies the required resource amount required for the process executed by the target ECU 30, and is the required resource amount according to the situation of the mobile body 100 specified in step S32.
When the alternative determination unit 214 is instructed to execute only a part of the processes in step S14 of FIG. 5, the alternative determination unit 214 is instructed to execute the processes executed by the target ECU 30. Specify the amount of resources required only for the processing of the part.
Specifically, the alternative determination unit 214 executes each process in the target ECU 30 corresponding to the situation of the mobile body 100 specified in step S32 from the resource amount table in which the required resource amount is set for each situation. Read the necessary resources for the processing to be performed. Alternatively, the alternative determination unit 214 acquires the required resource amount required for each process when the moving body 100 moves on the road on which the moving body 100 moves from the roadside machine existing around the moving body 100. If a dynamic map is realized, it may be possible to acquire the required resource amount from the roadside aircraft.

(Step S34: Free resource amount determination process)
The alternative determination unit 214 determines whether or not the ECU 30 other than the target ECU 30 has an ECU 30 whose current free resource amount is larger than the required resource amount specified in step S33.
If the alternative determination unit 214 does not exist, the process proceeds to step S35. On the other hand, the alternative determination unit 214 advances the process to step S36 if it exists.

(Step S35: Free resource amount update process)
The alternative determination unit 214 adds a low-priority process that has not yet been added to the target process among the processes executed by the ECU 30 other than the target ECU 30 to the target process. The alternative determination unit 214 calculates the amount of free resources of each ECU 30 other than the target ECU 30 when the target process is completed. Specifically, the alternative determination unit 214 is free when the target process is completed by adding the amount of resources used by the target process to the current amount of free resources for each ECU 30 other than the target ECU 30. Calculate the amount of resources.
Then, the alternative determination unit 214 sets the amount of free resources when the target process is completed for each ECU 30 other than the target ECU 30 to the current amount of free resources, and returns the process to step S34.

Here, it is assumed that the priority of processing is set for each situation of the moving body 100 and stored in the storage 23. The reason why the priority of processing changes according to the situation of the moving body 100 is that the necessity or importance of the processing changes according to the situation of the moving body 100. For example, while driving on a highway, processing for recognizing a signal becomes unnecessary in principle. Therefore, a lower priority is set for the process for recognizing a signal while traveling on an expressway than when traveling on a general road.

(Step S36: Alternative machine determination process)
Among the ECUs 30 other than the target ECU 30, the alternative determination unit 214 specifies the ECU 30 whose free resource amount is larger than the required resource amount specified in step S32 as the alternative ECU 30.
Further, the alternative determination unit 214 determines the process set as the target process in step S35 as the end process in the alternative ECU 30. In the alternative ECU 30, when a plurality of processes are set as target processes in step S35, the substitute determination unit 214 determines all the processes as end processes.

(Step S37: Data registration process)
The data registration unit 215 substitutes the identifier of the substitute ECU 30 determined in step S36 as the substitute identifier for the target ECU 30, and substitutes the end processing identifier determined in step S36 as the processing identifier for the target ECU 30. Register in the storage unit 231.

*** Effect of Embodiment 2 ***
As described above, in the fail operation system 10 according to the second embodiment, the alternative control device 20 registers information in the alternative storage unit 231 according to the situation of the mobile body 100. Therefore, it is possible to specify an appropriate ECU 30 as a substitute ECU 30 according to the situation of the moving body 100.

Further, in the fail operational system 10 according to the second embodiment, the alternative control device 20 informs the alternative storage unit 231 periodically or every time the situation of the mobile body 100 changes regardless of the presence or absence of a failure of the ECU 30. Re-register the information. Therefore, when a failure occurs in the ECU 30, the alternative ECU 30 is specified only by reading the alternative identifier and the like from the alternative storage unit 231. Therefore, the alternative ECU 30 can be specified in a short time. As a result, it is possible to shorten the time during which the processing executed by the failed ECU is stopped. Thereby, it is possible to increase the safety of the moving body 100.

*** Other configurations ***
<Modification example 3>
In the first and second embodiments, a case where a failure occurs in the ECU 30 of the moving body 100 such as an autonomous driving vehicle has been described. However, the above-mentioned fail-operational technique can be applied even when a failure occurs in the ECU 30 mounted on a robot such as a nursing care robot. The fail operation technique described above can also be applied to a general computer system. When applied to a general computer system, the above-mentioned ECU 30 may be read as a computer.

10 fail operational system, 20 alternative controller, 21 processor, 22 memory, 23 storage, 24 communication interface, 25 electronic circuit, 211 failure detector, 212 alternative selection unit, 213 processing instruction unit, 214 alternative decision unit, 215 data registration Unit, 231 alternative storage unit, 30 ECU, 31 processor, 32 memory, 33 storage, 34 communication interface, 311 resource reservation unit, 312 processing execution unit, 40 transmission path.

Claims (7)

A failure detection unit that detects that one of a plurality of ECUs (Electronic Control Units) mounted on a moving body has failed, and a failure detection unit.
A failure of the ECU detected by the failure detection unit from an alternative storage unit that stores an alternative identifier that is an identifier of a substitute ECU for each ECU and a processing identifier that is an identifier of the termination process to be terminated. An alternative selection unit that reads out the alternative identifier and the processing identifier for the machine,
For the alternative machine which is the ECU indicated by the alternative identifier read by the alternative selection unit, the processing indicated by the processing identifier read by the alternative selection unit is completed and executed by the failed machine. An alternative control device including a processing instruction unit that instructs the processing to be executed. The alternative control device further
The target ECU is the target ECU, and the required resource amount required for processing executed by the target ECU is based on the required resource amount determined according to the situation of the moving body. The alternative ECU for determining the above, the alternative determination unit for determining the termination process, and
The identifier of the alternative ECU determined by the alternative determination unit is used as the alternative identifier for the target ECU, and the determined identifier of the end processing is used as the processing identifier for the target ECU. The alternative control device according to claim 1, further comprising a data registration unit to be registered in the unit. The alternative determination unit determines the status of the moving body with respect to the processing executed by the ECU other than the target ECU until the amount of free resources of any ECU other than the target ECU becomes larger than the required resource amount. The processing is added to the target processing in order from the lower priority processing determined according to the above, and the amount of free resources of the ECU other than the target ECU when the target processing is completed is calculated, and the free resource amount is calculated. The alternative control device according to claim 2, wherein an ECU having a larger amount of required resources is determined as the alternative ECU, and the target process in the alternative ECU is determined as the end process. The alternative control device according to claim 2 or 3, wherein the alternative determination unit determines the alternative ECU and the termination process periodically or every time the situation of the moving body changes. The failure detection unit of the alternative control device detects that one of a plurality of ECUs (Electronic Control Units) mounted on the moving body has failed, and detects that the ECU has failed.
It was detected that the alternative selection unit of the alternative control device failed from the alternative storage unit that stored the alternative identifier that is the identifier of the alternative ECU and the processing identifier that is the identifier of the termination process for each ECU. Read out the alternative identifier and the processing identifier for the failed machine that is the ECU,
The processing instruction unit of the alternative control device finishes the process indicated by the read processing identifier with respect to the alternative machine which is the ECU indicated by the read alternative identifier, and is executed by the failed machine. An alternative control method that directs the processing to be performed. A failure detection process in which the failure detection unit detects that one of a plurality of ECUs (Electronic Control Units) mounted on the moving body has failed, and
It was detected that the alternative selection unit failed by the failure detection process from the alternative storage unit that stored the alternative identifier that is the identifier of the alternative ECU and the processing identifier that is the identifier of the termination process for each ECU. An alternative selection process for reading out the alternative identifier and the processing identifier for the faulty machine that is the ECU,
The processing instruction unit terminates the process indicated by the processing identifier read by the alternative selection process with respect to the alternative machine which is the ECU indicated by the alternative identifier read by the alternative selection process, and causes the failure. An alternative control program that causes a computer to function as an alternative control device that performs processing instruction processing that instructs the machine to execute the processing that was being executed. It is a fail-operational system equipped with an alternative control device and a plurality of ECUs (Electronic Control Units) mounted on a moving body.
The alternative control device is
A failure detection unit that detects that any one of the plurality of ECUs has failed, and
A failure of the ECU detected by the failure detection unit from an alternative storage unit that stores an alternative identifier that is an identifier of a substitute ECU for each ECU and a processing identifier that is an identifier of the termination process to be terminated. An alternative selection unit that reads out the alternative identifier and the processing identifier for the machine,
For the alternative machine which is the ECU indicated by the alternative identifier read by the alternative selection unit, the processing indicated by the processing identifier read by the alternative selection unit is completed and executed by the failed machine. It is equipped with a processing instruction unit that instructs to execute the processing.
Each of the plurality of ECUs
When instructed by the processing instruction unit, the resource securing unit that terminates the processing indicated by the processing identifier and secures the resource, and the resource securing unit.
A fail-operational system including a process execution unit that executes a process executed by the faulty machine when the resource is secured by the resource allocation unit.

Images