System and system control method

Abstract

To provide a technique for reducing delays associated with the output of computation results based on input data.SOLUTION: Each computation device stores computation results based on input data in a storage device. An output control device determines computation results to be output among from the computation results stored in the storage device, based on preset output timing and time stamp of the input data corresponding to the computation results stored in the storage device. The output control device then outputs the determined computation results as output computation results.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a technique for determining the results of an operation on input data. [Background technology]

[0002] System reliability is particularly important for systems whose failure or shutdown could have a significant impact on human life and social life, such as traffic monitoring systems that monitor roads and intersections and send traffic messages to vehicles, and plant control systems that provide infrastructure for daily life. A known method for improving system reliability is a redundant system that provides multiple computing devices and allows service to continue even if an abnormality occurs in one of the computing devices.

[0003] There are roughly two methods for redundant systems. One is a method in which one of multiple computing devices is positioned as an active system and the other as a standby system, and services are provided by the active system under normal conditions, and if an abnormality occurs in the active system, the system is switched to the standby system to continue the service. In Patent Document 1, there are multiple control computers, each of which is assigned a priority (the control computer with a higher priority can be considered the active system, and the control computer with a lower priority can be considered the standby system). An output switching unit is provided that outputs the output data of the control computer with a higher priority to the outside. If an abnormality occurs in the control computer with a higher priority, the output switching unit can continue the service by switching to outputting the output data of the control computer with a lower priority to the outside.

[0004] Another redundant system technique does not distinguish between active and standby systems for multiple computing devices, eliminating the need for switching when an abnormality occurs. In Patent Document 2, multiple computing devices synchronize with each other, allowing them to perform calculations based on the same input data and obtain the same calculation results. At least one of the calculation results from the multiple computing devices is output externally. Even if an abnormality occurs in one of the computing devices, the calculation result from the other computing device is output externally, allowing service to continue without switching over when an abnormality occurs. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Publication No. 2-156339 [Patent Document 2] Japanese Patent Publication No. 2020-21341 Summary of the Invention [Problem to be solved by the invention]

[0006] For example, in a traffic monitoring system, image data captured by cameras of roads and intersections is provided as input data, and the input data is analyzed to generate traffic messages (hereafter referred to as output data), which are then sent to vehicles. The vehicles then control their autonomous driving based on the received output data. Vehicles need to control their autonomous driving based on the most recent traffic conditions possible. Therefore, traffic monitoring systems are required to minimize the intervals between output data transmissions and to transmit output data based on the most recent input data possible.

[0007] In Patent Document 1, unless an abnormality occurs in the control computer with a higher priority, the output data of the control computer with a higher priority is output to the outside. Therefore, if a delay occurs in processing for some reason other than an abnormality in the control computer with a higher priority, and the interval between generating output data becomes longer, the interval between transmitting the output data also becomes longer.

[0008] In Patent Document 2, multiple arithmetic devices synchronize with each other to perform calculations based on the same input data. Here, suppose that a delay occurs in calculations on certain input data (called input data 1) in some of the arithmetic devices for some reason. In that case, the other arithmetic devices must wait for the delayed arithmetic device to complete calculations on input data 1 before starting calculations on the next input data (called input data 2). Therefore, the output interval between the output data for input data 1 and the output data for input data 2 becomes longer due to the calculation delay of the delayed arithmetic device, and the transmission of output data for the most recent input data is delayed. The present invention provides a technology for reducing delays in the output of calculation results based on input data. [Means for solving the problem]

[0009] One aspect of the present invention is a system having a plurality of arithmetic units and an output control unit, wherein the arithmetic units include an acquisition means for acquiring input data and a storage control means for storing an arithmetic result based on the input data in a storage device, and the output control unit includes a determination means for determining which arithmetic result to output from among the arithmetic results stored in the storage device based on a predetermined output timing and a timestamp of the input data corresponding to the arithmetic result stored in the storage device, and an output means for outputting the arithmetic result determined by the determination means as an output arithmetic result. [Effects of the Invention]

[0010] According to the present invention, it is possible to reduce delays in outputting the results of calculations based on input data. [Brief explanation of the drawings]

[0011] [Figure 1] FIG. 1 is a block diagram showing an example of the functional configuration of a redundant system 1000. [Figure 2] 10 is a flowchart of the operation of the redundant system 1000. [Figure 3] 10 is a timing chart of the redundant system 1000. [Figure 4] FIG. 4 is a block diagram showing an example of the functional configuration of a redundant system 4000. [Figure 5] 10 is a flowchart of the operation of the redundant system 4000. [Figure 6] 4 is a timing chart of the redundant system 4000. [Figure 7] FIG. 7 is a block diagram showing an example of the functional configuration of a redundant system 7000. [Figure 8] 7 is a flowchart of the operation of the redundant system 7000. [Figure 9] 7 is a timing chart of the redundant system 7000. [Figure 10] FIG. 1 is a block diagram showing an example of the functional configuration of a redundant system 10000. [Figure 11] 10 is a flowchart of the operation of the redundant system 10000. [Figure 12] 1 is a timing chart of the redundant system 10000. [Figure 13] FIG. 13 is a block diagram showing an example of the functional configuration of a redundant system 13000. [Figure 14] 13 is a flowchart of the operation of the redundant system 13000. [Figure 15] 1 is a timing chart of the redundant system 13000. [Figure 16] FIG. 1 is a block diagram showing an example of the hardware configuration of a computer device. DETAILED DESCRIPTION OF THE INVENTION

[0012] Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. Note that the following embodiments do not limit the scope of the invention claimed. Although multiple features are described in the embodiments, not all of these multiple features are necessarily essential to the invention, and multiple features may be combined arbitrarily. Furthermore, in the accompanying drawings, the same reference numerals are used to designate the same or similar components, and redundant explanations will be omitted.

[0013] [First embodiment] In this embodiment, a redundant system in which two arithmetic units are provided for redundancy will be described. More specifically, in this embodiment, a redundant system in which processing can be continued without an abnormality (a serious abnormality such as a halt in the operation of the arithmetic unit) occurring in either of the two arithmetic units will be described.

[0014] First, an example of the functional configuration of a redundancy system 1000 according to this embodiment will be described using the block diagram of Fig. 1. As shown in Fig. 1, the redundancy system 1000 according to this embodiment includes two arithmetic units (arithmetic units 1100 and 1200), a storage device 1002, a setting input unit 1101, and an output control device 1300.

[0015] First, we will explain the arithmetic device 1100. The arithmetic device 1100 is a device that acquires input data and stores (controls storage of) the results of calculations based on the input data in the storage device 1002, which is an example of a storage area, and is, for example, a computer device such as a PC, a tablet terminal device, or a smartphone.

[0016] The input unit 1101 acquires input data required for calculation from outside the redundant system 1000. A timestamp indicating the timing (date and time) when the input data was generated is attached to the input data. Note that the method by which the input unit 1101 acquires the input data is not limited to a specific method.

[0017] The calculation unit 1102 performs calculations based on the input data acquired by the input unit 1101. The acquisition unit 1103 acquires the timestamp attached to the input data acquired by the input unit 1101.

[0018] The transmitting unit 1104 generates a timestamped calculation result (data including the calculation result and the timestamp) by adding the timestamp acquired by the acquiring unit 1103 to the calculation result (calculation result) by the calculating unit 1102. The transmitting unit 1104 then stores the generated timestamped calculation result (calculation data) in the storage device 1002.

[0019] Next, we will explain the arithmetic device 1200. The arithmetic device 1200 has the same configuration as the arithmetic device 1100 and is a device that performs the same operations as the arithmetic device 1100, and is, for example, a computer device such as a PC, a tablet terminal device, or a smartphone.

[0020] Similar to the input unit 1101, the input unit 1201 acquires input data required for calculations (the input data is provided with a timestamp indicating the timing (date and time) when the input data was generated) from outside the redundant system 1000. The source of the input data acquired by the input unit 1101 and the source of the input data acquired by the input unit 1201 are assumed to be the same.

[0021] Similar to the calculation unit 1102, the calculation unit 1202 performs calculations based on the input data acquired by the input unit 1201. Similar to the acquisition unit 1103, the acquisition unit 1203 acquires the timestamp attached to the input data acquired by the input unit 1201.

[0022] The transmitting unit 1204, like the transmitting unit 1104, generates a timestamped calculation result by adding a "timestamp acquired by the acquiring unit 1203" to a "calculation result (calculation result) by the calculating unit 1202." The transmitting unit 1204 then stores the generated timestamped calculation result in the storage device 1002.

[0023] Next, the setting input unit 1001 will be described. The setting input unit 1001 is a device for acquiring settings necessary for the redundant system 1000 to operate, and is, for example, a computer device such as a PC, a tablet terminal device, or a smartphone. The setting input unit 1001 may be implemented as a functional unit of another device such as the arithmetic device 1100, the arithmetic device 1200, or the output control device 1300. In this embodiment, the setting input unit 1001 acquires, as a setting, "the timing at which the redundant system 1000 outputs the calculation result to the outside (output timing)."

[0024] Next, a description will be given of the storage device 1002. The storage device 1002 is a storage device for storing the calculation results with time stamps generated by the calculation device 1100 and the calculation results with time stamps generated by the calculation device 1200.

[0025] Next, we will explain the output control device 1300. The output control device 1300 determines which calculation result to output from among the calculation results stored in the storage device 1002 based on a preset output timing and the timestamp of the input data corresponding to the calculation result stored in the storage device 1002, and outputs the determined calculation result as an output calculation result.

[0026] The output determination unit 1301 determines the time-stamped calculation result to be output from the time-stamped calculation results stored in the storage device 1002, based on the timestamp in the time-stamped calculation result stored in the storage device 1002 and the output timing acquired by the setting input unit 1001. Then, the output determination unit 1301 acquires the determined time-stamped calculation result from the storage device 1002.

[0027] The output unit 1302 outputs the calculation result with the time stamp that the output determination unit 1301 has acquired from the storage device 1002 as an output calculation result to the outside of the redundancy system 1000 .

[0028] In addition, the output unit 1302 may obtain a calculation result from the time-stamped calculation result obtained by the output determination unit 1301 from the storage device 1002, and output the obtained calculation result to the outside of the redundancy system 1000 as an output calculation result.

[0029] Furthermore, when the output determination unit 1301 determines the time-stamped calculation result to be output, it may acquire the determined time-stamped calculation result from the storage device 1002 and acquire the calculation result from the acquired time-stamped calculation result. Furthermore, when the output determination unit 1301 determines the time-stamped calculation result to be output, it may acquire the calculation result included in the determined time-stamped calculation result from the storage device 1002. In this case, the output unit 1302 may output the calculation result acquired by the output determination unit 1301 to the outside of the redundant system 1000 as the output calculation result.

[0030] The output destination of the output calculation result by the output unit 1302 is not limited to a specific output destination. For example, the output unit 1302 may transmit the output calculation result to an external device via a network such as a LAN or the Internet. The output unit 1302 may also display images or text based on the output calculation result on a display device included in the redundant system 1000 or a display device that can communicate with the redundant system 1000.

[0031] Next, the operation of the redundant system 1000 will be described with reference to the flowchart of FIG.

[0032] In step S2000, the setting input unit 1001 acquires the output timing of the output calculation result by the redundant system 1000. In this embodiment, the output timing acquired by the setting input unit 1001 includes "the first output time T1 of the output calculation result and the output interval T thereafter." However, the output timing acquired by the setting input unit 1001 may include any information as long as it is information that can specify the output timing of the output calculation result by the redundant system 1000.

[0033] The method for setting the output timing of the output calculation result is not limited to a specific setting method, and may include, for example, editing a parameter file or setting via a Web UI. Such setting may be performed in the redundant system 1000, or may be performed in a device or system other than the redundant system 1000.

[0034] In step S2001, the arithmetic unit 1100, the arithmetic unit 1200, and the output control device 1300 are started up. Here, the time when the arithmetic unit 1100, the arithmetic unit 1200, and the output control device 1300 are started up is defined as T0.

[0035] The method for starting the calculation device 1100, the calculation device 1200, and the output control device 1300 is not limited to a specific method, and various methods can be applied depending on the implementation form of each component, such as executing a start-up command or script, or starting by pressing a physical switch.

[0036] After the calculation device 1100, the calculation device 1200, and the output control device 1300 are started in step S2001, step S2100, which is processing performed by the calculation device 1100 and the calculation device 1200, and step S2200, which is processing performed by the output control device 1300, are executed in parallel.

[0037] From here, we will explain the processing flow with reference to the timing chart in Figure 3. First, we will explain how to read the timing chart in Figure 3. In the timing chart in Figure 3, time progresses from left to right, and the vertical direction shows data and various timings at each time.

[0038] Reference numeral 3000 denotes a timestamp (time) added to each piece of input data input to the redundant system 1000, and in FIG. 3, a total of 18 timestamps from t0 to t17 are shown.

[0039] Reference numeral 3010 indicates, with arrows, the timing at which input data to which timestamps t0 to t17 have been assigned is generated at the input source of the input data.

[0040] Reference number 3020 indicates the timing at which the arithmetic device 1100 acquires input data. The arithmetic device 1100 acquires input data with the latest time stamp at the current time. For example, since the latest time stamp at input timing 3021 is t0, in this case the arithmetic device 1100 acquires input data with the time stamp of t0. Furthermore, since the latest time stamp at input timing 3022 is t2, in this case the arithmetic device 1100 acquires input data with the time stamp of t2.

[0041] Reference number 3030 represents, as one rectangular block, the time span during which the arithmetic device 1100 performs an operation based on input data. For example, time span 3031 is the time span for an operation on input data input at input timing 3021, and time span 3032 is the time span for an operation on input data input at input timing 3022.

[0042] Reference number 3040 indicates the timing at which the time-stamped calculation result generated by the calculation device 1100 is stored (sent) to the storage device 1002. For example, the timing at which the time-stamped calculation result generated by the calculation in the time span 3031 is stored (sent) to the storage device 1002 is timing 3041. Also, the timing at which the time-stamped calculation result generated by the calculation in the time span 3032 is stored (sent) to the storage device 1002 is timing 3042.

[0043] Reference numeral 3050 represents the time-stamped calculation result stored (sent) to the storage device 1002 at each timing indicated by reference numeral 3040. For example, the time-stamped calculation result stored (sent) to the storage device 1002 at timing 3041 is the time-stamped calculation result 3051, and its timestamp is t0. Also, the time-stamped calculation result stored (sent) to the storage device 1002 at timing 3042 is the time-stamped calculation result 3052, and its timestamp is t2.

[0044] Reference numeral 3060 indicates the timing at which the arithmetic device 1200 acquires input data, and like the arithmetic device 1100, the arithmetic device 1200 acquires input data with the latest time stamp at the current time.

[0045] Reference number 3070 represents, as one rectangular block, the time span during which the arithmetic device 1200 performs calculations based on input data. Reference number 3080 indicates the timing at which the calculation results with time stamps generated by the arithmetic device 1200 are stored (sent) to the storage device 1002. Reference number 3090 indicates the calculation results with time stamps that are stored (sent) to the storage device 1002 at each timing indicated by reference number 3080.

[0046] Here, the calculation device 1100 and the calculation device 1200 are not synchronized with each other, and each performs processing on a best-effort basis. Therefore, the input data acquired by the calculation device 1100 and the calculation device 1200 at the same time may not be the same. For example, the input data acquired for the second time after the calculation device 1100 is started is input data with a timestamp of t2, whereas the input data acquired for the second time after the calculation device 1200 is started is input data with a timestamp of t3.

[0047] Reference numeral 3100 indicates the output timing acquired by the setting input unit 1001. As described above, the first output timing of the output calculation result is T1, followed by T2, T3, T4, ... at intervals of the output interval T (shown up to T7 in FIG. 3).

[0048] Reference numeral 3110 denotes an output calculation result determined by the output determination unit 1301 as an output calculation result to be output at each output timing indicated by reference numeral 3100. For example, the output calculation result determined by the output determination unit 1301 as an output calculation result to be output at output timing 3101 is t0, so the latest timestamp at the time of output timing 3101 is t0, and therefore the time-stamped calculation result 3051 including the timestamp of t0 is determined as output calculation result 3111. Also, for example, the output calculation result determined by the output determination unit 1301 as an output calculation result to be output at output timing 3102 is t3, so the latest timestamp at the time of output timing 3102 is t3, and therefore the time-stamped calculation result 3092 including the timestamp of t3 is determined as output calculation result 3112.

[0049] Furthermore, the timing at which input data is generated, the timing at which the calculation by the calculation device starts / ends, and the timing at which the calculation result is output do not necessarily need to be synchronized or have a relationship of equal magnitude. Furthermore, since the calculation devices 1100 and 1200 do not operate in synchronization with each other, the input data to be calculated and the timing at which the calculation starts / ends are different for each.

[0050] Next, the processing in step S2100 and the processing in step S2200 will be described using the timing chart in Fig. 3 as an example. First, step S2100 will be described. Arithmetic device 1100 and arithmetic device 1200 execute the processing in step S2100 in parallel. Below, the operation of arithmetic device 1100 in step S2100 will be described, but this description can also be applied to the operation of arithmetic device 1200 in step S2100.

[0051] In step S2101, the input unit 1101 acquires input data required for calculation from outside the redundant system 1000. The following describes a case where the input unit 1101 acquires input data with a timestamp of t0 at input timing 3021 in step S2101.

[0052] In step S2102, the acquiring unit 1103 acquires the timestamp added to the input data acquired by the input unit 1101 in step S2101, that is, the timestamp of t0.

[0053] In step S2103, the calculation unit 1102 performs calculation within the time range 3031 based on the input data acquired by the input unit 1101 in step S2101.

[0054] In step S2104, the transmitting unit 1104 generates a timestamped calculation result 3051 by adding the timestamp of t0 acquired in step S2102 to the result of the calculation in step S2103 (calculation result). The transmitting unit 1104 then stores the generated timestamped calculation result 3051 in the storage device 1002 at timing 3041. The process then proceeds to step S2101, and the input unit 1101 acquires the input data to which the timestamp of t2 has been added at timing 3022.

[0055] In the calculation device 1200, in step S2101, the input unit 1201 acquires input data having a timestamp of t0 at input timing 3061. Then, in step S2102, the acquisition unit 1203 acquires the timestamp assigned to the input data acquired by the input unit 1201 in step S2101, i.e., the timestamp of t0. In step S2103, the calculation unit 1202 performs calculation within a time range 3071 based on the input data acquired by the input unit 1201 in step S2101. Then, in step S2104, the transmission unit 1204 generates a timestamped calculation result 3091 by assigning the timestamp of t0 acquired in step S2102 to the result of the calculation in step S2103 (calculation result). Then, the transmission unit 1204 stores the generated timestamped calculation result 3091 in the storage device 1002 at timing 3081. The process then proceeds to step S2101, where the input unit 1201 acquires, at timing 3062, the input data to which the timestamp t3 has been added.

[0056] Next, the processing in step S2200 will be described. First, in step S2201, the output control device 1300 waits until output timing arrives. In the first step S2201, the output control device 1300 waits until time T1, which is the first output timing 3101, arrives. When the current time arrives at the output timing, the processing proceeds to step S2202.

[0057] In step S2202, the output determination unit 1301 determines the time-stamped calculation result to output from the time-stamped calculation results stored in the memory device 1002 based on the timestamp in the time-stamped calculation result stored in the memory device 1002 and the output timing acquired by the setting input unit 1001.

[0058] Here, an example of a method for determining a timestamped calculation result to be output will be described. The recipient of the output calculation result wants to receive a calculation result based on input data that is as recent as possible. Therefore, the output determination unit 1301 determines, from among the timestamped calculation results stored in the storage device 1002, the timestamped calculation result that has the latest (most recent) timestamp with respect to the output timing as the timestamped calculation result to be output.

[0059] For example, in the case of output timing 3101, of the timestamped calculation results stored in the storage device 1002, the timestamped calculation result with the latest timestamp with respect to the output timing 3101 is the timestamped calculation result 3051 stored by the calculation device 1100 at timing 3041. Therefore, the output determination unit 1301 determines the timestamped calculation result 3051 as the timestamped calculation result to be output, and outputs the timestamped calculation result 3051 as the output calculation result 3111.

[0060] In step S2203, the output unit 1302 outputs the output calculation result determined in step S2202. Thereafter, the process proceeds to step S2201 to wait for the next output timing.

[0061] Similarly, the arithmetic device 1100, the arithmetic device 1200, and the output control device 1300 perform processing in parallel. As a result, at time T2, which is output timing 3102, the timestamped arithmetic result of the latest timestamp stored in the storage device 1002 is the timestamped arithmetic result 3092 generated by the arithmetic device 1200. Therefore, at output timing 3102, the timestamped arithmetic result 3092 is output as the output arithmetic result 3112. In this way, at each output timing, it is possible to output to the outside the arithmetic result calculated based on the input data of the latest timestamp regardless of the arithmetic device.

[0062] Further processing is performed in the same manner, and at output timing 3103 (time T3), the calculation result 3093 with the time stamp generated by the calculation device 1200 is output as the output calculation result 3113. Thereafter, at output timing 3104 (time T4), the calculation result 3094 with the time stamp generated by the calculation device 1200 is output as the output calculation result output 3114.

[0063] Here, the time span over which the arithmetic device 1100 performs an operation on the input data with timestamp t4 input at input timing 3023 is time span 3033, which is longer than the other time spans due to some factor. Therefore, the timing at which the timestamped operation result for the input data with timestamp t4 is sent to the storage device 1002 is timing 3043, which is a long period of time since timing 3042 when the previous timestamped operation result was sent. On the other hand, the arithmetic device 1200 is able to perform the operation without a significant delay. Therefore, the timestamped operation result sent by the arithmetic device 1200 is selected as the output operation result, and the operation result calculated based on the input data with the new timestamp can be output to the outside within a certain period of time.

[0064] A traffic monitoring system is an example of a redundant system applicable to the redundant system 1000 according to this embodiment. In the case of a traffic monitoring system, input data may be, for example, captured images obtained by capturing an intersection with an imaging device, and a computation based on the input data may be, for example, processing for detecting objects such as vehicles and pedestrians from the captured images. The computation result may be, for example, detection result data that structured information such as the position and movement speed of objects in the captured images. The computation result may be output to an autonomous vehicle or the like. Since an autonomous vehicle that receives the computation result controls its autonomous driving based on the computation result, it is important to receive computation results based on the most recent input data (i.e., the intersection situation) possible. Thus, the redundant system 1000 according to this embodiment can be applied to any system that processes input data with a timestamp.

[0065] Regarding "B with A attached," as long as the redundant system 1000 is configured to be able to identify one of A and B from the other, the data format represented by "B with A attached" is not limited to a specific data format.

[0066] [Second embodiment] In this embodiment, a redundant system that continues processing even if an abnormality (a serious abnormality such as the operation of the arithmetic device stopping) occurs in one of the two arithmetic devices will be described. In this embodiment, a case will be described in which the "abnormality" is "the arithmetic device has hung up," but the following explanation is equally applicable to abnormalities other than hanging. Below, the differences from the first embodiment will be explained.

[0067] An example of the functional configuration of a redundancy system 4000 according to this embodiment will be described with reference to the block diagram of Fig. 4. As shown in Fig. 4, the redundancy system 4000 according to this embodiment includes a calculation device 4100, a calculation device 4200, a recovery unit 4005, an abnormality notification unit 4004, an abnormality determination unit 4003, a storage device 1002, a setting input unit 4001, and an output control device 4300. The recovery unit 4005, the abnormality determination unit 4003, the abnormality notification unit 4004, and the setting input unit 4001 may all be computer devices such as those described above, or may be functional units included in other computer devices.

[0068] The transmitting unit 4104 stores the calculation results with the time stamp in the storage device 1002 and transmits them to the abnormality determining unit 4003. The transmitting unit 4204 stores the calculation results with the time stamp in the storage device 1002 and transmits them to the abnormality determining unit 4003.

[0069] If the abnormality determination unit 4003 does not receive the next timestamped calculation result from the calculation device 4100 within a specified period (hereinafter referred to as a hang determination period) after receiving a timestamped calculation result from the calculation device 4100, the abnormality determination unit 4003 determines that the calculation device 4100 has hung up. Similarly, if the abnormality determination unit 4003 does not receive the next timestamped calculation result from the calculation device 4200 within the hang determination period (specified period) after receiving a timestamped calculation result from the calculation device 4200, the abnormality determination unit 4003 determines that the calculation device 4200 has hung up. Note that the method for determining whether or not the calculation device has hung up is not limited to a specific method.

[0070] If the abnormality determination unit 4003 determines that a computing device is hung, it generates abnormality information indicating which computing device is hung, such as information including identification information (ID, character string, etc.) of the computing device determined to be hung, the type of abnormality, and the time when the abnormality was determined, and outputs the generated abnormality information.

[0071] The setting input unit 4001 acquires the above-mentioned hang determination period in addition to the output timing.

[0072] When the abnormality notification unit 4004 acquires abnormality information from the abnormality determination unit 4003, it outputs the acquired abnormality information to the outside of the redundant system 4000. The output destination and output method of the abnormality information are not limited to a specific output destination or a specific output method. For example, the abnormality notification unit 4004 may display an image or text based on the abnormality information on a display device, or may send an email containing an image or text based on the abnormality information to the outside of the redundant system 4000.

[0073] When the recovery unit 4005 acquires anomaly information from the anomaly determination unit 4003, it performs processing to recover the arithmetic device corresponding to the identification information included in the acquired anomaly information (the arithmetic device determined to be hung). The method for recovering the arithmetic device determined to be hung is not limited to a specific method, and for example, the recovery unit may be instructed to perform recovery and restart the arithmetic device, or the recovery method may be changed depending on the content of the anomaly indicated by the anomaly information. Furthermore, when the recovery unit 4005 instructs the arithmetic device to perform recovery, it notifies the output determination unit 4301 of the fact that the instruction has been made.

[0074] The output determination unit 4301 operates in the same manner as the output determination unit 1301 described above, but when it acquires abnormality information from the abnormality judgment unit 4003, it does not select the time-stamped calculation result of the calculation unit corresponding to the identification information contained in the abnormality information as the time-stamped calculation result to be output until it acquires a notification from the recovery unit 4005 indicating that a recovery instruction has been issued to the calculation unit corresponding to the identification information contained in the abnormality information.

[0075] Next, the operation of the redundant system 4000 according to this embodiment will be described with reference to the flowchart of Fig. 5. The following description will be given taking the timing chart of Fig. 6 as an example.

[0076] In step S5000, the setting input unit 4001 acquires the output timing and the hang determination period. As in the first embodiment, the output timing includes time T1 as the first output time and a subsequent output interval T. In the following description, the hang determination period is assumed to be 2.5T. The timing chart in FIG. 6 similarly shows T1, T, and 2.5T.

[0077] After step S2001, step S5100, which is the processing performed by the arithmetic unit 4100 and the arithmetic unit 4200, and step S5200, which is the processing performed by the output control device 4300, are executed in parallel.

[0078] The arithmetic device 4100 and the arithmetic device 4200 execute the process of step S5100 in parallel. The operation of the arithmetic device 4100 in step S5100 will be described below, but this description is equally applicable to the operation of the arithmetic device 4200 in step S5100.

[0079] In step S5104, the transmitting unit 4104 generates a timestamped calculation result by adding the timestamp acquired in step S2102 to the result of the calculation in step S2103 (calculation result).The transmitting unit 4104 then stores the generated timestamped calculation result in the storage device 1002 and transmits it to the abnormality determination unit 4003.

[0080] Next, step S5200 will be described. In step S5202, the output determination unit 4301 determines the time-stamped calculation result to be output in the same manner as the output determination unit 1301, but when abnormality information is acquired from the abnormality judgment unit 4003, the output determination unit 4301 does not select the time-stamped calculation result of the calculation unit corresponding to the identification information included in the abnormality information as the time-stamped calculation result to be output until it acquires from the recovery unit 4005 a notification indicating that a recovery instruction has been issued to the calculation unit corresponding to the identification information included in the abnormality information.

[0081] On the other hand, after the processing of step S2001, the abnormality determination unit 4003 determines whether or not an abnormality has occurred in the arithmetic device in step S5003, in parallel with the processing of the arithmetic devices 4100, 4200 and the output control device 4300. The processing of step S5003 will now be described using the timing chart of Fig. 6. Although different reference numbers from those in Fig. 4 are used, descriptions of the same contents as those shown in the figure will be omitted.

[0082] Reference number 6100 indicates the process by which the abnormality determination unit 4003 determines whether or not a hang has occurred. Here, Fig. 6 shows the process of determining whether or not a hang has occurred for the arithmetic device 4100, and does not show the process of determining whether or not a hang has occurred for the arithmetic device 4200, but the process content is the same. In this embodiment, as described above, if the period from when a arithmetic device transmits a calculation result with a timestamp to when it transmits the next calculation result with a timestamp is longer than the hang determination period, the arithmetic device is determined to have hung up.

[0083] For example, in the hang-up determination process during the period indicated by rectangular block 6101, the abnormality determination unit 4003 starts timing at timing 6041 when the calculation device 4100 transmits a timestamped calculation result, and determines whether the next timestamped calculation result will be transmitted within the period of 2.5T, which is the hang-up determination period. In this case, the next timestamped calculation result is transmitted at timing 6042, before the time 2.5T has elapsed since timing 6041, so the time being measured is reset and timing is started again. The hang-up determination process based on one time measurement as described above is represented by one rectangular block 6101, and also represents the processing of step S5003.

[0084] Although the hang detection process for rectangular block 6101 did not detect a hang, the following example of detecting a hang will be described using the timing chart of FIG. 6 again. Assume that the arithmetic device 4100 hangs for some reason at timing 6034. After the hang, the arithmetic device 4100 is unable to acquire input data, perform calculations, or output calculation results. This hung state is indicated by rectangular block 6035. Meanwhile, in the hang detection process for reference number 6100, since the arithmetic device 4100 outputs a calculation result with a timestamp at timing 6042, clocking begins at timing 6042, and a hang is detected at timing 6111, after the hang detection period of 2.5T has elapsed. This hang detection process is indicated by rectangular block 6102.

[0085] If it is determined in step S5003 that the arithmetic device has hung, then in step S5004 the recovery unit 4005 recovers the arithmetic device that has been determined to have hung, and in step S5005 the abnormality notification unit 4004 outputs abnormality information, which are executed in parallel.

[0086] The processing content of step S5004 will be explained again with reference to the timing chart of Fig. 6. If the abnormality determination unit 4003 determines at timing 6111 that the arithmetic unit 4100 has hung up, it outputs abnormality information.

[0087] The recovery unit 4005 acquires the abnormality information at timing 6111 and starts recovery processing to recover the arithmetic device 4100 identified by the identification information included in the abnormality information. Here, the recovery processing instructs the arithmetic device 4100 to restart. Reference numeral 6121 indicates the processing of the recovery unit 4005 with a rectangular block and represents the processing of step S5004. Reference numeral 6130 indicates with an arrow the timing at which the arithmetic device 4100 is instructed to restart. The recovery processing for timing 6111 is indicated by rectangular block 6121, and the timing at which the arithmetic device 4100 is actually instructed to restart as recovery processing is timing 6131. ​​Therefore, the arithmetic device 4100 starts restarting at timing 6131, and the state during restart is indicated by rectangular block 6036. After the arithmetic device 4100 has restarted, the processing of step S5100 is repeated again. Although not shown in the timing chart, at timing 6111, the abnormality notification unit 4004 starts processing to notify the outside of abnormality information.

[0088] 6, the calculation device 4100 starts acquiring input data again at timing 6027, and outputs a calculation result with a timestamp at timing 6047. Therefore, from timing 6047, the abnormality determination unit 4003 starts the hang determination process (rectangular block 6103).

[0089] Here, a supplementary explanation will be given regarding the processing of step S5202 by the output determination unit 4301. In the timing chart of FIG. 6, from timing 6111 when an abnormality is detected until timing 6131 when a recovery instruction is issued, the timestamped calculation result of the arithmetic device 4100 is not selected as an output target. However, in this embodiment, there is no output timing between timing 6111 and timing 6131, so there is no impact on the process of determining the output calculation result. Furthermore, in this embodiment, a hang of the arithmetic device is determined as an abnormality. However, if a arithmetic device hangs, it will no longer transmit timestamped calculation results in the first place, so the timestamped calculation result of the hung arithmetic device will not be determined as an output calculation result. However, if a security anomaly other than a hang is detected as an abnormality, the arithmetic device in which the security anomaly has occurred may continue to transmit timestamped calculation results. Suppose that the output timing occurs between the time when the anomaly determination unit 4003 detects a security anomaly and the time when the recovery unit 4005 issues a recovery instruction to the arithmetic device in which the security anomaly has occurred. In this case, it is possible to prevent the timestamped calculation result transmitted by the arithmetic device in which the security anomaly has occurred from being determined as an output target.

[0090] As described above, even if the arithmetic device 4100 is in a state where it cannot perform calculations, such as when it hangs or is being restarted, as in the rectangular block 6035 or rectangular block 6036, it is possible to output calculation results with time stamps from the arithmetic device 4200. Furthermore, it is possible to continue outputting the latest calculation results to an external output destination at regular intervals.

[0091] [Third embodiment] In this embodiment, a redundant system is described in which a timestamp included in an output calculation result is notified to a calculation device, and the calculation is interrupted based on the notified timestamp. The differences from the second embodiment are described below.

[0092] An example of the functional configuration of a redundancy system 7000 according to this embodiment will be described with reference to the block diagram of Fig. 7. As shown in Fig. 7, the redundancy system 7000 according to this embodiment includes a calculation device 7100, a calculation device 7200, a recovery unit 4005, an abnormality notification unit 4004, an abnormality determination unit 4003, a storage device 1002, a setting input unit 4001, and an output control device 7300.

[0093] The output determination unit 7301 outputs the timestamp (output calculation result timestamp) included in the output calculation result to the calculation unit 7102 and the calculation unit 7202.

[0094] When the calculation unit 7102 and the calculation unit 7203 obtain the output calculation result timestamp from the output determination unit 7301, if the timestamp of the input data that is the subject of the calculation being performed (obtained from the acquisition unit 7103 and the acquisition unit 7203, respectively) is the same as or older than the output calculation result timestamp, the calculation unit 7102 and the calculation unit 7203 will interrupt the calculation being performed.

[0095] Next, the operation of the redundant system 7000 according to this embodiment will be described with reference to the flowchart of Fig. 8. The following description will be given taking the timing chart of Fig. 9 as an example.

[0096] After step S2001, step S8100, which is the processing performed by the arithmetic unit 7100 and the arithmetic unit 7200, and step S8200, which is the processing performed by the output control device 7300, are executed in parallel.

[0097] In step S8201, the output determination unit 7301 outputs the timestamp (output calculation result timestamp) included in the output calculation result determined in step S5202 to the calculation units 7102 and 7202.

[0098] The arithmetic device 7100 and the arithmetic device 7200 execute the process of step S8100 in parallel. The operation of the arithmetic device 7100 in step S8100 will be described below, but this description is equally applicable to the operation of the arithmetic device 7200 in step S8100.

[0099] In step S8103, the calculation unit 7102 performs calculations based on the input data as in the above embodiment, but if the timestamp of the input data that is the subject of the calculation currently being performed at the time the output calculation result timestamp is obtained from the output determination unit 7301 is the same as or older than the output calculation result timestamp, the calculation currently being performed is interrupted.

[0100] In step S8105, the calculation unit 7102 determines whether the calculation being executed has been interrupted. If the calculation being executed has been interrupted, the process proceeds to step S2101; if the calculation being executed has not been interrupted, the process proceeds to step S5104.

[0101] The processing when an operation is interrupted will be described using the timing chart of Fig. 9. Although different reference numerals are used from those in Fig. 4, the same explanation as in Fig. 4 will be omitted.

[0102] Reference numeral 9120 indicates, by an arrow, the timing at which the timestamp included in the output calculation result determined by the output determination unit 7301 is output to the calculation units 7102 and 7202. Arrow 9121 indicates the timing at which t0, the timestamp of the output calculation result 9111, is output to the calculation units 7102 and 7202. At timing 9121, the calculation unit 7102 in the calculation device 7100 is performing calculation 9032 on input data having a timestamp of t2. Since this timestamp t2 is newer than the timestamp t0 output from the output determination unit 7301, the calculation 9032 is not interrupted. On the other hand, at timing 9121, the calculation unit 7202 in the calculation device 7200 is still performing calculation 9071 on input data having a timestamp of t0. Since this timestamp t0 is the same as the timestamp t0 output from the output determination unit 7301, the calculation 9071 is interrupted. After the operation 9071 is suspended, the operation device 7200 obtains input data having a timestamp of t3 at timing 9062 and performs the operation 9072.

[0103] At timing 9122, output determination unit 7301 outputs timestamp t3 of output calculation result 9112 to calculation unit 7102 and calculation unit 7202. At timing 9122, calculation unit 7102 in calculation device 7100 is still performing calculation 9032 on input data having timestamp t2, and since this timestamp t2 is older than timestamp t3 output from output determination unit 7301, calculation 9032 is interrupted.

[0104] Here, the calculation result of calculation 9072, which was started after the calculation of calculation unit 7202 in calculation device 7200 was interrupted at timing 9121, is selected as the output calculation result at output timing 9102. If calculation 9071 had not been interrupted at timing 9121, there is a possibility that calculation 9072 would not have been completed by the time of output timing 9102, and by interrupting the calculation, it becomes possible to output the calculation result for the most recent input data to the outside.

[0105] [Fourth embodiment] In this embodiment, a redundant system is described in which the output calculation result is determined based on the reliability of the calculation result when processing continues without any abnormality occurring in either of the two calculation devices. The following describes the differences from the third embodiment.

[0106] An example of the functional configuration of a redundancy system 10000 according to this embodiment will be described with reference to the block diagram of Fig. 10. As shown in Fig. 10, the redundancy system 10000 according to this embodiment includes a calculation device 10100, a calculation device 10200, a recovery unit 4005, an abnormality notification unit 4004, an abnormality determination unit 4003, a storage device 10002, a setting input unit 10001, and an output control device 10300.

[0107] The calculation unit 10102 performs calculations in the same manner as the calculation unit 1102, and outputs the results of the calculations (calculation results) to the transmission unit 10104 and the determination unit 10105. The calculation unit 10202 performs calculations in the same manner as the calculation unit 1202, and outputs the results of the calculations (calculation results) to the transmission unit 10204 and the determination unit 10205.

[0108] The determination unit 10105 determines the reliability based on the calculation result obtained from the calculation unit 10102. The determination unit 10205 determines the reliability based on the calculation result obtained from the calculation unit 10202.

[0109] The transmitting unit 10104 generates a “calculation result with timestamp and reliability” by adding the timestamp obtained from the obtaining unit 7103 and the reliability obtained from the determining unit 10105 to the calculation result obtained from the calculation unit 10102. Then, the transmitting unit 10104 stores the generated “calculation result with timestamp and reliability” in the storage device 10002 and outputs it to the abnormality determining unit 4003.

[0110] The transmitting unit 10204 generates a “calculation result with timestamp and reliability” by adding the timestamp obtained from the obtaining unit 7203 and the reliability obtained from the determining unit 10205 to the calculation result obtained from the calculation unit 10202. Then, the transmitting unit 10204 stores the generated “calculation result with timestamp and reliability” in the storage device 10002 and outputs it to the abnormality determining unit 4003.

[0111] The setting input unit 10001 acquires the output timing, the hang determination period, and the reliability threshold.

[0112] The output determination unit 10301 acquires the timestamp and reliability included in the "calculation result with timestamp and reliability" stored in the storage device 10002. Then, the output determination unit 10301 determines the "calculation result with timestamp and reliability" to be output based on the acquired timestamp and reliability and the output timing and reliability threshold acquired by the setting input unit 10001. Then, the output determination unit 10301 acquires the determined "calculation result with timestamp and reliability" from the storage device 10002.

[0113] The output unit 1302 outputs the "calculation result with timestamp and reliability" acquired by the output determination unit 10301 from the storage device 10002 to the outside of the redundant system 10000 as an output calculation result.

[0114] In addition, the output unit 1302 may obtain the calculation result from the ``calculation result with timestamp and reliability'' obtained by the output determination unit 10301 from the storage device 10002, and output the obtained calculation result to the outside of the redundancy system 10000 as the output calculation result.

[0115] Furthermore, when the output determination unit 10301 determines the "calculation result with timestamp and reliability" to be output, it may obtain the determined "calculation result with timestamp and reliability" from the storage device 10002, and obtain the calculation result from the obtained "calculation result with timestamp and reliability".

[0116] Furthermore, when the output determination unit 10301 determines the "calculation result with timestamp and reliability" to be output, the output determination unit 10301 may acquire the calculation result included in the determined "calculation result with timestamp and reliability" from the storage device 10002. In this case, the output unit 1302 may output the calculation result acquired by the output determination unit 10301 to the outside of the redundant system 10000 as the output calculation result.

[0117] Next, the operation of the redundant system 10000 according to this embodiment will be described with reference to the flowchart of Fig. 11. The following description will be given taking the timing chart of Fig. 12 as an example.

[0118] In step S11000, the setting input unit 10001 acquires a reliability threshold. The following describes, as an example, a case in which the reliability threshold is set to 80. The method for setting the reliability threshold is not limited to a specific setting method, and possible methods include editing a parameter file or setting via a Web UI. Such setting may be performed in the redundant system 10000, or in a device or system other than the redundant system 10000.

[0119] After step S2001, step S11100, which is the processing performed by the arithmetic unit 10100 and the arithmetic unit 10200, and step S11200, which is the processing performed by the output control device 10300, are executed in parallel.

[0120] The arithmetic device 10100 and the arithmetic device 10200 execute the process of step S11100 in parallel. The operation of the arithmetic device 10100 in step S11100 will be described below, but this description is equally applicable to the operation of the arithmetic device 10200 in step S11100. From here on, the flow of the process will be described with reference to the timing chart in FIG.

[0121] Reference numeral 12020 indicates the timing at which the arithmetic device 10100 receives input data, and the arithmetic device 10100 receives the input data with the most recent timestamp at that timing.

[0122] Reference numeral 12030 represents, as one rectangular block, the time span during which the calculation device 10100 executes calculations and determines reliability. For example, rectangular block 3031 represents the time span during which calculations are executed and reliability is determined for input data input at timing 3021. Furthermore, rectangular block 3032 represents the time span during which calculations are executed and reliability is determined for input data input at timing 3022.

[0123] Reference numeral 12040 indicates, with an arrow, the timing at which the "calculation result with timestamp and reliability" generated by the calculation device 10100 is output to the storage device 10002. For example, the "calculation result with timestamp and reliability 12051" corresponding to the rectangular block 3031 is output to the storage device 10002 at timing 3041. Also, for example, the "calculation result with timestamp and reliability 12052" corresponding to the rectangular block 3032 is output to the storage device 10002 at timing 3042.

[0124] Reference number 12050 represents the "calculation result with timestamp and reliability" output to the storage device 10002 at each timing indicated by reference number 12040. The timestamp and reliability written in a rectangular block represent the timestamp and reliability included in the "calculation result with timestamp and reliability" corresponding to that rectangular block. For example, the timestamp included in the "calculation result with timestamp and reliability 12051" is t0 and the reliability is 90. Also, for example, the timestamp included in the "calculation result with timestamp and reliability 12052" is t2 and the reliability is 80.

[0125] Reference numeral 12060 indicates the timing at which the arithmetic device 10200 receives input data, and reference numeral 12070 indicates, as one rectangular block, the time span during which the arithmetic device 10200 executes an operation and determines its reliability. Reference numeral 12080 indicates, with an arrow, the timing at which the "operation result with timestamp and reliability" generated by the arithmetic device 10200 is output to the storage device 10002. Reference numeral 12090 indicates the "operation result with timestamp and reliability" output to the storage device 10002 at the respective timings indicated by reference numeral 12080. Here, the arithmetic device 10100 and the arithmetic device 10200 are not synchronized with each other, and each performs processing on a best-effort basis, as in the first embodiment.

[0126] Reference number 3100 indicates the output timing acquired by the setting input unit 10001. Reference number 12110 indicates the output calculation result determined by the output determination unit 10301 as the output calculation result to be output at the output timing indicated by reference number 3100. For example, as the output calculation result 12111 to be output at output timing 3101, "calculation result with timestamp and reliability 12051" including the timestamp of t0 and reliability 90 generated by the calculation device 10100 is determined. Also, for example, as the output calculation result 12112 to be output at output timing 3102, "calculation result with timestamp and reliability 12092" including the timestamp of t3 and reliability 90 generated by the calculation device 10200 is determined.

[0127] The timing at which input data is generated, the timing at which the calculation device starts / ends, and the timing at which the calculation results are output do not necessarily need to be synchronized or have a 1:1 relationship. Also, since the calculation devices 10100 and 10200 do not operate in synchronization, the input data to be calculated by the two calculation devices and the timing at which the calculation starts / ends are different.

[0128] In step S11103, the calculation unit 10102 performs calculation within the time width indicated by the rectangular block 3031 based on the input data acquired by the input unit 1101 in step S2101.

[0129] In step S11106, the determination unit 10105 determines the reliability within the time width indicated by the rectangular block 3031 based on the result of the calculation in step S11103 (calculation result).

[0130] The method for determining the reliability based on the calculation result can be various methods and is not limited to a specific method. An example of the method for determining the reliability based on the calculation method will be described below.

[0131] For example, when the redundant system 10000 is applied to a traffic monitoring system, the input data is, for example, a captured image of an intersection taken by a camera, and the calculation based on the input data is, for example, a process of detecting objects such as vehicles and pedestrians from the captured image. In this case, the result of the calculation (calculation result) is, for example, structured data containing information such as the position and movement speed of the object in the captured image. When multiple objects are detected from the captured image of the intersection, information on the accuracy of the detection result for each object (hereinafter referred to as the recognition rate) and the distance to the object (hereinafter referred to as the distance accuracy) is also added to the calculation result. In this case, the determination unit 10105 may determine the overall recognition rate (for example, the average value of the recognition rates of all objects) as the reliability from the recognition rates for each object.

[0132] However, the method of determining the reliability is not limited to the method of determining the overall recognition rate from the recognition rate for each object as the reliability. For example, the reliability may be determined as the overall distance accuracy (average value of the distance accuracy of all objects) from the distance calculation for each object, or the reliability may be determined from the difference between the recognition rate or distance accuracy for each object in the previous calculation result and the recognition rate or distance accuracy for each object in the current calculation result. Furthermore, the reliability may be determined from the difference between the recognition rate or distance accuracy for each object in the calculation result within a certain period from the present to the past, or the reliability may be determined based on the manufacturing date and time of the calculation unit 10102 or the version of the calculation program.

[0133] Possible destinations for the calculation results include, for example, autonomously driving vehicles. The autonomously driving vehicle that receives the calculation results controls its autonomous driving based on the calculation results, so it is important for driving to receive highly reliable calculation results based on the most recent input data (= intersection conditions) possible.

[0134] In step S8105, the calculation unit 10102 determines whether the calculation being executed has been interrupted. If the calculation being executed has been interrupted, processing proceeds to step S2101; if the calculation being executed has not been interrupted, processing proceeds to step S11104.

[0135] In step S11104, the transmitting unit 10104 generates a “calculation result with timestamp and reliability 12051” by adding the timestamp obtained from the obtaining unit 7103 and the reliability obtained from the determining unit 10105 to the calculation result obtained from the calculation unit 10102. Then, at timing 3041, the transmitting unit 10104 stores the generated “calculation result with timestamp and reliability 12051” in the storage device 10002 and outputs it to the abnormality determining unit 4003. Thereafter, the processing proceeds to step S2101, and the input unit 1101 obtains input data with the timestamp of t2 at timing 3022.

[0136] In parallel with the processing by the calculation device 10100, the calculation device 10200 also performs similar processing, and at timing 3081, it outputs a "calculation result with timestamp and reliability 12091" including the timestamp of t0 and the reliability of 90 to the storage device 1002 and the abnormality determination unit 4003. Thereafter, the processing proceeds to step S2101, and the input unit 1201 acquires input data with the timestamp of t3 at timing 3062.

[0137] Next, the processing in step S11200 will be described. First, in step S2201, the output control device 10300 waits until the output timing arrives. When the current time reaches the output timing, the processing proceeds to step S11204.

[0138] In step S11204, the output determination unit 10301 identifies, as a first candidate, the "calculation result with timestamp and reliability" that includes the timestamp closest to the output timing among the "calculation results with timestamp and reliability" stored in the storage device 10002. If the reliability included in the first candidate is equal to or greater than the reliability threshold, the output determination unit 10301 determines the first candidate as the "calculation result with timestamp and reliability" to be output. On the other hand, if the reliability included in the first candidate is less than the threshold, the output determination unit 10301 identifies, as a second candidate, the "calculation result with timestamp and reliability" that includes the timestamp second closest to the output timing among the "calculation results with timestamp and reliability" stored in the storage device 10002. If the reliability included in the second candidate is equal to or greater than the reliability threshold, the output determination unit 10301 determines the second candidate as the "calculation result with timestamp and reliability" to be output. On the other hand, if the reliability included in the second candidate is less than the reliability threshold, and if the reliability included in the first candidate is greater than the reliability included in the second candidate, the output determination unit 10301 determines the first candidate as the "calculation result with timestamp and reliability" to be output, and if the reliability included in the first candidate is less than the reliability included in the second candidate, the output determination unit 10301 determines the second candidate as the "calculation result with timestamp and reliability" to be output. Note that the method by which the output determination unit 10301 determines the "calculation result with timestamp and reliability" to be output is not limited to a specific method.

[0139] Then, the output determination unit 10301 acquires from the storage device 10002 the "calculation result with timestamp and reliability" determined as the "calculation result with timestamp and reliability" to be output.

[0140] When the output timing is output timing 3101, the output determination unit 10301 identifies, as a first candidate, the "calculation result with timestamp and reliability 12051" which includes the timestamp closest to the output timing 3101 among the "calculation results with timestamp and reliability" stored in the storage device 10002. The reliability included in the first candidate is 90, which is greater than or equal to the reliability threshold of 80, so the output determination unit 10301 determines this first candidate as the "calculation result with timestamp and reliability 12111" to be output at output timing 3101.

[0141] When the output timing is output timing 3104, the output determination unit 10301 specifies, as a first candidate, "computation result with timestamp and reliability 12094" which includes the timestamp closest to the output timing 3104 in the "computation results with timestamp and reliability" stored in the storage device 10002. Since the reliability included in the first candidate is 60, which is less than the reliability threshold of 80, the output determination unit 10301 specifies, as a second candidate, "computation result with timestamp and reliability 12053" which includes the timestamp second closest to the output timing 3104 in the "computation results with timestamp and reliability" stored in the storage device 10002. Since the reliability included in the second candidate is 80, which is greater than or equal to the reliability threshold of 80, the output determination unit 10301 determines the second candidate as "computation result with timestamp and reliability 12114" to be output at the output timing 3104.

[0142] When the output timing is timing 3106, the output determination unit 10301 identifies, as a first candidate, the "computation result with timestamp and reliability 12055" which includes the timestamp closest to the output timing 3106 in the "computation results with timestamp and reliability" stored in the storage device 10002. Since the reliability included in the first candidate is 30, which is less than the reliability threshold of 80, the output determination unit 10301 identifies, as a second candidate, the "computation result with timestamp and reliability 12096" which includes the timestamp second closest to the output timing 3106 in the "computation results with timestamp and reliability" stored in the storage device 10002. Since the reliability included in the second candidate is 70, which is less than the reliability threshold of 80, in this case, the output determination unit 10301 determines the second candidate with higher reliability as the "computation result with timestamp and reliability 12116" to be output at the output timing 3106.

[0143] Similarly, the arithmetic unit 10100, the arithmetic unit 10200, and the output control unit 10300 perform processing in parallel. In this way, at each output timing, it is possible to output to the outside the calculation results calculated based on input data having the latest timestamp that is equal to or greater than the reliability threshold, regardless of the arithmetic unit.

[0144] Possible reasons for the reliability falling below the reliability threshold include a momentary accident, such as raindrops or fallen leaves on the camera lens surface or overexposure due to lighting, that reduces the recognition rate and causes the reliability of the calculation result to fall below the reliability threshold. Since this could affect the operation of the autonomous vehicle receiving such a calculation result, it is better not to output it even if the output timing is approaching, and it is better to output the calculation result with the highest reliability since the previous output timing. In this way, at each output timing, regardless of the calculation device, it is possible to externally output a calculation result that is calculated based on input data with a timestamp within the output timing interval, which has the highest reliability but is below the reliability threshold. Additionally, the calculation results can be output at regular intervals.

[0145] [Fifth embodiment] In this embodiment, a redundant system when an abnormality occurs in one of the two arithmetic units will be described. In this embodiment, the "abnormality" is either "the arithmetic unit hangs" or "the arithmetic unit is operating but the reliability of the calculation results continues for a period of time (hereinafter referred to as reliability unachieved abnormality)", but the type of abnormality is not limited to a specific type, and the present invention can also be applied to, for example, cases where an abnormality other than these types occurs. Below, the differences from the fourth embodiment will be described.

[0146] An example of the functional configuration of a redundancy system 13000 according to this embodiment will be described with reference to the block diagram of Fig. 13. As shown in Fig. 13, the redundancy system 13000 according to this embodiment includes a calculation device 13100, a calculation device 13200, a recovery unit 4005, an abnormality notification unit 4004, an abnormality determination unit 13003, a storage device 10002, a setting input unit 13001, and an output control device 13300.

[0147] The arithmetic unit 13100 and the arithmetic unit 13200 generate “arithmetic results with timestamps and reliability levels”, store the generated “arithmetic results with timestamps and reliability levels” in the storage device 10002 , and transmit them to the abnormality determination unit 13003 .

[0148] The abnormality judgment unit 13003 judges that the calculation device is abnormal if it does not receive a "calculation result with timestamp and reliability" from the calculation device within the hang judgment period, or if the reliability included in the "calculation result with timestamp and reliability" obtained from the calculation device is less than a threshold value (hereinafter referred to as the reliability abnormality value) for a specified period (hereinafter referred to as the reliability abnormality period).

[0149] Such a method of determining an abnormality using reliability is one example, and other methods are also applicable. For example, the abnormality determination unit 13003 may determine that the calculation device is abnormal if the number of times that the reliability included in the "calculation result with timestamp and reliability" acquired from the calculation device becomes less than the reliability abnormal value within the reliability abnormal period is equal to or greater than a threshold.

[0150] If the abnormality determination unit 13003 determines that the arithmetic device is abnormal, it generates abnormality information including information indicating which arithmetic device is abnormal, as in the second embodiment, and outputs the generated abnormality information.

[0151] The setting input unit 13001 acquires the output timing, the hang determination period, the reliability threshold, as well as the reliability abnormal value and the reliability abnormal period. As in the above embodiment, the method for setting the information acquired by the setting input unit 130001 is not limited to a specific setting method.

[0152] When the abnormality notification unit 4004 acquires abnormality information from the abnormality determination unit 13003 , it outputs the acquired abnormality information to the outside of the redundant system 13000 .

[0153] When the recovery unit 4005 acquires anomaly information from the anomaly determination unit 13003, it performs processing to recover the arithmetic device corresponding to the identification information included in the acquired anomaly information (the arithmetic device determined to be abnormal), as in the above embodiment. In this embodiment, the recovery unit restarts the arithmetic device by instructing the arithmetic device to perform recovery, but other recovery methods, such as updating the firmware in the arithmetic device, may also be used. Furthermore, processing may be performed to change the recovery method depending on the content of the anomaly information. Furthermore, when the recovery unit 4005 instructs the arithmetic device to perform recovery, it notifies the output determination unit 13301 of the fact that the instruction has been made.

[0154] The output determination unit 13301 operates in the same manner as the output determination unit 1301 described above, but when it acquires abnormality information from the abnormality judgment unit 13003, it does not select the "calculation result with timestamp and reliability" of the calculation unit corresponding to the identification information contained in the abnormality information as the "calculation result with timestamp and reliability" to be output until it acquires a notification from the recovery unit 4005 indicating that a recovery instruction has been issued to the calculation unit corresponding to the identification information contained in the abnormality information.

[0155] Next, the operation of the redundant system 13000 according to this embodiment will be described with reference to the flowchart in Fig. 14. The following description will be given taking the timing chart in Fig. 15 as an example.

[0156] In step S14000, the setting input unit 13001 acquires a reliability threshold, a reliability abnormality value, and a reliability abnormality period. As an example, a case where the reliability abnormality value is set to 30 and the reliability abnormality period is set to 3.0T will be described below. T1, T, and 3.0T are similarly illustrated in the timing chart of FIG. 15.

[0157] After step S2001, step S14100, which is the processing performed by the arithmetic devices 13100 and 13200, and step S14200, which is the processing performed by the output control device 13300, are executed in parallel. The arithmetic devices 13100 and 13200 execute the processing of step S14100 in parallel.

[0158] On the other hand, after the processing of step S2001, the abnormality determination unit 13003 determines whether or not an abnormality has occurred in the arithmetic device in step S14003, in parallel with the processing of the arithmetic devices 13100, 13200 and the output control device 13300. The processing of step S14003 will now be described using the timing chart of Fig. 15. Although different reference numbers are used from those in Fig. 4, descriptions of the same contents as those shown in the figure will be omitted.

[0159] 15 will be explained, but explanations of the same parts as in the fourth embodiment will be omitted. Also, the abnormality determination unit 13003 performs determination processing for both hang-up and reliability unachieved abnormality, but the determination related to hang-up is the same as in the second embodiment, so explanations will be omitted.

[0160] Reference number 15100 indicates processing by the abnormality determination unit 13003 to determine whether or not there is a hang and whether or not there is a reliability unachieved abnormality. Here, Fig. 15 shows processing to determine whether or not there is a reliability unachieved abnormality for the arithmetic device 13100, and does not show processing to determine whether or not there is a reliability unachieved abnormality for the arithmetic device 13200, but the processing content is the same. In this embodiment, as described above, if the reliability included in the "calculation result with timestamp and reliability" acquired from the arithmetic device is less than the reliability abnormality value over the reliability abnormality period, the arithmetic device is determined to have a reliability unachieved abnormality.

[0161] For example, in the abnormality determination process 15101, clocking begins when the reliability included in the "calculation result with timestamp and reliability" acquired from the calculation device falls below the reliability abnormality value. Then, it is determined whether the reliability included in the "calculation result with timestamp and reliability" acquired from the calculation device is equal to or greater than the reliability abnormality value until the clocked time exceeds 3.0T, which is the reliability abnormality period. In this example, the reliability included in the "calculation result with timestamp and reliability 12051" acquired from the calculation device 13100 is 90, which is equal to or greater than the reliability abnormality value of 30, so clocking does not begin. The above-described reliability-based reliability unachievement abnormality determination process is represented by a single line such as reference numeral 15101, and represents the process of step S14003. Note that reference numeral 15101 is represented by a line because no clocking is performed, but the period during which clocking is performed is represented by a single rectangular block.

[0162] Here, suppose that the arithmetic device 13100 fails to correctly calculate the calculation result during the processing indicated by rectangular block 3032 for some reason. In this case, the arithmetic device 13100 still receives input data and performs the processing indicated by rectangular block 3032 as usual, but the reliability included in the "calculation result with timestamp and reliability 15052" is 10, which is less than the reliability abnormal value of 30, so the clock starts. Thereafter, the arithmetic device 13100 still receives the next input data and performs the processing indicated by rectangular block 3033 as usual, but the reliability included in the "calculation result with timestamp and reliability 15053" is 20, which is less than the reliability abnormal value of 30, so the clock continues. Thereafter, the arithmetic device 13100 still receives the next input data and performs the processing indicated by rectangular block 12034 as usual, but the reliability included in the "calculation result with timestamp and reliability 12034" is 10, which is less than the reliability abnormal value of 30, so the clock continues. Thereafter, it is determined that a reliability unachieved abnormality has occurred at timing 15111 when the measured time has passed 3.0T, which is the reliability abnormality period. The measurement process of the reliability abnormality period here is indicated by a rectangular block 15102.

[0163] If it is determined in step S14003 that the arithmetic device is abnormal, then in step S5004 the recovery unit 4005 recovers the arithmetic device determined to be abnormal, and in step S5005 the abnormality notification unit 4004 outputs abnormality information, which are executed in parallel.

[0164] The processing content of step S5004 will be described again with reference to the timing chart of Fig. 15. If the abnormality determination unit 13003 determines at timing 15111 that the reliability of the arithmetic device 13100 is not achieved, abnormality information is output.

[0165] The recovery unit 4005 acquires the abnormality information at timing 15111 and starts recovery processing to recover the arithmetic device 13100 identified by the identification information included in the abnormality information (the arithmetic device determined to have an abnormality due to unachieved reliability). Here, the recovery processing instructs the arithmetic device 13100 to restart. Reference numeral 15121 indicates the processing of the recovery unit 4005 with a rectangular block and represents the processing of step S5004. Reference numeral 6130 indicates with an arrow the timing at which the arithmetic device 13100 is instructed to restart. The recovery processing for timing 15111 is indicated by rectangular block 15121, and the timing at which the arithmetic device 13100 is actually instructed to restart as recovery processing is timing 15131. Therefore, the arithmetic device 13100 starts restarting at timing 15131, and the state during restarting is indicated by rectangular block 15036. After the arithmetic device 13100 has restarted, the processing of step S14100 is repeated again. Although not shown in the timing chart, at timing 15111, the abnormality notification unit 4004 starts processing to notify the outside of abnormality information.

[0166] When the processing of steps S5004 and S5005 is completed, the process proceeds to step S14003, where the processing for determining whether or not there is an abnormality is performed again. In the timing chart of Fig. 15, the calculation device 13100 starts acquiring input data again at timing 15027, and outputs "calculation result with timestamp and reliability 15057" at timing 15047. Therefore, from timing 15047, the abnormality determination unit 13003 starts processing (rectangular block 15103) to determine whether or not there is an abnormality.

[0167] Here, a supplementary explanation will be given regarding the processing of steps S11202 and S11204 by the output determination unit 13301. In the timing chart of Fig. 15, from timing 15111 when an abnormality is detected to timing 15131 when a recovery instruction is issued, the calculation result of the calculation device 13100 is not selected as an output target. Furthermore, in this embodiment, a reliability unachieved abnormality of the calculation device is determined as an abnormality, but when a calculation device has a reliability unachieved abnormality, the reliability of the "calculation result with timestamp and reliability" is less than the reliability abnormality value in the first place. Therefore, the "calculation result with timestamp and reliability" of the calculation device that has a reliability unachieved abnormality is not determined as an output calculation result.

[0168] As described above, even if the arithmetic device 13100 operates as if it is experiencing a reliability unachieved abnormality and the calculation result is incorrect, or even if it is in a state where calculation cannot be performed during restart like the rectangular block 15036, it is possible to output the calculation result calculated by the arithmetic device 13200. Furthermore, it is possible to continue to output the latest calculation result to an external output destination at regular intervals.

[0169] [Sixth embodiment] The functional units in the arithmetic devices and output control devices shown in Figures 1, 4, 7, 10, and 13 may be implemented in hardware or software (computer programs). In the latter case, a computer device capable of executing such computer programs is applicable to the arithmetic devices and output control devices described above.

[0170] An example of the hardware configuration of a computer device applicable to the above-mentioned arithmetic device and output control device will be described using the block diagram of Fig. 16. Note that the hardware configuration of a computer device applicable to the above-mentioned arithmetic device and output control device is not limited to the configuration shown in Fig. 16, and can be changed / modified as appropriate.

[0171] The CPU 1601 executes various processes using computer programs and data stored in the RAM 1602. As a result, the CPU 1601 controls the operation of the entire computer device, and also executes or controls various processes described above as processes performed by the arithmetic unit and output control unit.

[0172] The RAM 1602 has an area for storing computer programs and data loaded from the ROM 1603 or the storage device 1606, and an area for storing computer programs and data received from the outside via the I / F 1607. The RAM 1602 also has a work area used by the CPU 1601 when executing various processes. In this way, the RAM 1602 can provide various areas as needed.

[0173] The ROM 1603 stores setting data for the computer device, computer programs and data relating to the startup of the computer device, computer programs and data relating to the basic operation of the computer device, and the like.

[0174] The operation unit 1604 is a user interface such as a keyboard, mouse, and touch panel screen, and allows the user to input various information and instructions to the computer device by operating it.

[0175] The display device 1605 has a liquid crystal screen or a touch panel screen, and can display the processing results of the CPU 1601 as images, text, etc. The display device 1605 may also be a projection device such as a projector that projects images and text.

[0176] The storage device 1606 is a large-capacity information storage device such as a hard disk drive. The storage device 1606 stores an OS, computer programs and data for causing the CPU 1601 to execute or control the various processes described above as processes performed by the arithmetic unit and the output control device. The storage device 1606 may be used as the storage device.

[0177] The I / F 1607 is a communication interface for performing data communication with an external device. The CPU 1601, RAM 1602, ROM 1603, operation unit 1604, display device 1605, storage device 1606, and I / F 1607 are all connected to a system bus 1608.

[0178] 16 may be applied to the recovery unit, abnormality determination unit, abnormality notification unit, setting input unit, etc. Two or more of these functional units may be installed as software in one computer.

[0179] The numerical values, processing timing, processing order, processing subject, data (information) configuration / acquisition method / sending destination / sending source / storage location, etc. used in each of the above embodiments are given as examples to provide a concrete explanation, and are not intended to be limited to these examples.

[0180] In addition, some or all of the above-described embodiments may be used in appropriate combination, and some or all of the above-described embodiments may be selectively used.

[0181] (Other embodiments) The present invention can also be realized by supplying a program that realizes one or more functions of the above-described embodiments to a system or device via a network or a storage medium, and having one or more processors in the computer of the system or device read and execute the program.The present invention can also be realized by a circuit (e.g., ASIC) that realizes one or more functions.

[0182] The invention of this specification includes the following system and system control method. (Item 1) A system having a plurality of arithmetic units and an output control unit, The computing device An acquisition means for acquiring input data; a storage control means for storing the calculation results based on the input data in a storage device; Equipped with The output control device includes: a determination means for determining which of the calculation results stored in the storage device to output based on a preset output timing and a timestamp of input data corresponding to the calculation result stored in the storage device; output means for outputting the calculation result determined by the determination means as an output calculation result; A system comprising: (Item 2) The system further comprises a determination means for determining an abnormality in the arithmetic device, The determining means does not determine the calculation result by the abnormal calculation device as the calculation result to be output until it receives a notification that recovery has been instructed for the abnormal calculation device. 2. The system according to item 1, characterized in that (Item 3) Furthermore, the system A means for notifying an external party of an abnormality; A means of recovering from abnormalities 3. The system according to item 2, comprising: (Item 4) 4. The system according to item 2 or 3, wherein the recovery includes restarting the computing device that is determined to be abnormal. (Item 5) 4. The system according to item 2 or 3, wherein the recovery includes updating firmware of the computing device that is determined to be abnormal. (Item 6) 6. The system according to any one of items 2 to 5, wherein the abnormality includes the fact that the computing device has hung. (Item 7) 7. The system according to any one of items 2 to 6, wherein the abnormality includes the reliability of the calculation result of the calculation device being below a threshold for a specified period of time. (Item 8) The system described in any one of items 2 to 6, characterized in that the abnormality includes the number of times that the reliability of the calculation result of the calculation device falls below a threshold within a specified period being equal to or greater than a threshold. (Item 9) the output control device outputs a timestamp corresponding to the output calculation result to the calculation device; The arithmetic unit suspends the currently running operation if the timestamp of the input data that is the target of the currently running operation is the same as or older than the timestamp output from the output control unit. 9. The system according to any one of items 1 to 8, characterized in that (Item 10) The system described in any one of items 1 to 9, characterized in that the determination means determines, from among the calculation results stored in the storage device, the calculation result to be output that corresponds to input data with a most recent timestamp relative to a preset output timing. (Item 11) the storage control means stores, in a storage device, operation data including an operation result based on the input data and a timestamp of the input data; the determining means determines the calculation data to be used for output from the calculation data stored in the storage device based on a preset output timing and a timestamp included in the calculation data stored in the storage device; The output means outputs the calculation data determined by the determination means or the calculation result included in the calculation data as an output calculation result. 11. The system according to any one of items 1 to 10, (Item 12) The system described in any one of items 1 to 9, characterized in that the determination means determines the calculation result to be output from among the calculation results stored in the storage device based on a preset output timing, a timestamp of input data corresponding to the calculation result stored in the storage device, and the reliability of the calculation result. (Item 13) The system described in item 12 is characterized in that the determination means determines the calculation result corresponding to the timestamp closest to the output timing as the first candidate, and if the reliability of the first candidate is equal to or greater than a threshold, determines the first candidate as the calculation result to be output. (Item 14) The system described in item 13 is characterized in that, if the reliability of the first candidate is less than a threshold, the determination means determines the calculation result corresponding to the timestamp next closest to the output timing as the second candidate, and if the reliability of the second candidate is equal to or greater than the threshold, determines the second candidate as the calculation result to be output. (Item 15) Item 15. The system according to item 14, characterized in that if the reliability of the second candidate is less than a threshold, the determination means determines the candidate with the higher reliability between the first candidate and the second candidate as the calculation result to be output. (Item 16) the storage control means stores, in a storage device, operation data including an operation result based on the input data, a timestamp of the input data, and a reliability of the operation result; the determining means determines the calculation data to be used for output from the calculation data stored in the storage device based on a preset output timing and a timestamp and reliability included in the calculation data stored in the storage device; The output means outputs the calculation data determined by the determination means or the calculation result included in the calculation data as an output calculation result. 16. The system according to any one of items 12 to 15, (Item 17) 17. The system according to any one of items 12 to 16, wherein the calculation device determines the reliability based on a recognition rate of an object in a captured image as the input data. (Item 18) 17. The system according to any one of items 12 to 16, wherein the calculation device determines the reliability based on a distance to an object in a captured image as the input data. (Item 19) 17. The system according to any one of items 12 to 16, wherein the calculation device determines the reliability from the difference between the previous calculation result and the current calculation result. (Item 20) 17. The system according to any one of items 12 to 16, wherein the computing device determines the reliability based on the manufacturing date and time of the computing device or the version of the computing program. (Item 21) 21. The system according to any one of items 1 to 20, wherein the input data is a captured image, the calculation result is a detection result of an object from the captured image, and the output means outputs the detection result to an autonomous vehicle. (Item 22) A control method for a system having a plurality of arithmetic units and an output control unit, comprising: The computing device acquiring input data and storing the results of calculations based on the input data in a storage device; The output control device includes: A calculation result to be output from among the calculation results stored in the storage device is determined based on a preset output timing and a timestamp of input data corresponding to the calculation result stored in the storage device, and the determined calculation result is output as an output calculation result. A method for controlling a system.

[0183] The invention is not limited to the above-described embodiments, and various changes and modifications can be made without departing from the spirit and scope of the invention. Accordingly, the following claims are appended to apprise the public of the scope of the invention. [Explanation of symbols]

[0184] 1000: Redundant system 1001: Setting input unit 1002: Storage device 1100: Arithmetic unit 1101: Input unit 1102: Arithmetic unit 1103: Acquisition unit 1104: Transmission unit 1200: Arithmetic unit 1201: Input unit 1202: Arithmetic unit 1203: Acquisition unit 1204: Transmission unit 1300: Output control device 1301: Output determination unit 1302: Output unit

Claims

1. A system having a plurality of arithmetic units and an output control unit, The computing device An acquisition means for acquiring input data; a storage control means for storing the calculation results based on the input data in a storage device; Equipped with The output control device includes: a determination means for determining which of the calculation results stored in the storage device to output is based on a preset output timing and a timestamp of input data corresponding to the calculation result stored in the storage device; output means for outputting the calculation result determined by the determination means as an output calculation result; A system comprising:

2. The system further comprises a determination means for determining an abnormality in the arithmetic device, The determining means does not determine the calculation result by the abnormal calculation device as the calculation result to be output until it receives a notification that recovery has been instructed for the abnormal calculation device.

2. The system of claim 1.

3. Furthermore, the system A means for notifying an external party of an abnormality; A means of recovering from abnormalities The system of claim 2, comprising:

4. 3. The system according to claim 2, wherein the recovery includes restarting the computing device that is determined to be abnormal.

5. 3. The system according to claim 2, wherein the recovery includes updating firmware of the computing device that is determined to be abnormal.

6. 3. The system of claim 2, wherein the abnormality includes the computing device hanging.

7. The system of claim 2 , wherein the abnormality includes a reliability of the calculation result of the calculation device being below a threshold for a specified period of time.

8. The system according to claim 2 , wherein the abnormality includes a condition in which the reliability of the calculation result of the calculation device falls below a threshold value a number of times within a specified period of time equal to or exceeds a threshold value.

9. the output control device outputs a timestamp corresponding to the output calculation result to the calculation device; The arithmetic unit suspends the currently running operation if the timestamp of the input data that is the target of the currently running operation is the same as or older than the timestamp output from the output control unit.

2. The system of claim 1.

10. The system described in claim 1, characterized in that the determination means determines, as the calculation result to be output, the calculation result corresponding to the input data with the most recent timestamp relative to a predetermined output timing, from among the calculation results stored in the storage device.

11. the storage control means stores, in a storage device, operation data including an operation result based on the input data and a timestamp of the input data; the determining means determines the calculation data to be used for output from the calculation data stored in the storage device based on a preset output timing and a timestamp included in the calculation data stored in the storage device; The output means outputs the calculation data determined by the determination means or the calculation result included in the calculation data as an output calculation result.

2. The system of claim 1.

12. The system according to claim 1, characterized in that the determination means determines which of the calculation results stored in the storage device to output based on a predetermined output timing, a timestamp of input data corresponding to the calculation result stored in the storage device, and the reliability of the calculation result.

13. The system described in claim 12, characterized in that the determination means determines the calculation result corresponding to the timestamp closest to the output timing as the first candidate, and if the reliability of the first candidate is greater than or equal to a threshold, determines the first candidate as the calculation result to be output.

14. The system described in claim 13, characterized in that if the reliability of the first candidate is less than a threshold, the determination means determines the calculation result corresponding to the timestamp next closest to the output timing as the second candidate, and if the reliability of the second candidate is greater than or equal to the threshold, determines the second candidate as the calculation result to be output.

15. The system according to claim 14, characterized in that, if the reliability of the second candidate is less than a threshold, the determination means determines the candidate with the higher reliability between the first candidate and the second candidate as the calculation result to be output.

16. the storage control means stores, in a storage device, operation data including an operation result based on the input data, a timestamp of the input data, and a reliability of the operation result; the determining means determines the calculation data to be used for output from the calculation data stored in the storage device based on a preset output timing and a timestamp and reliability included in the calculation data stored in the storage device; The output means outputs the calculation data determined by the determination means or the calculation result included in the calculation data as an output calculation result.

13. The system of claim 12.

17. The system according to claim 12 , wherein the calculation device determines the reliability based on a recognition rate of an object in a captured image as the input data.

18. The system according to claim 12 , wherein the calculation device determines the reliability based on a distance to an object in a captured image as the input data.

19. 13. The system according to claim 12, wherein the calculation device determines the reliability based on a difference between a previous calculation result and a current calculation result.

20. The system according to claim 12, wherein the computing device determines the reliability based on the manufacturing date and time of the computing device or the version of the computing program.

21. The system according to claim 1, wherein the input data is a captured image, the calculation result is a detection result of an object from the captured image, and the output means outputs the detection result to an autonomous vehicle.

22. A control method for a system having a plurality of arithmetic units and an output control unit, comprising: The computing device acquiring input data and storing the results of calculations based on the input data in a storage device; The output control device includes: A calculation result to be output from among the calculation results stored in the storage device is determined based on a preset output timing and a timestamp of input data corresponding to the calculation result stored in the storage device, and the determined calculation result is output as an output calculation result. A method for controlling a system.

Images