Information processing apparatus, control method, and recording medium

Abstract

An information processing apparatus that performs an operation process has a first processing circuit and a second processing circuit. The first processing circuit continuously performs an operation process N times. The second processing circuit continuously performs an operation process N times. N is an integer of 2 or more. The first processing circuit and the second processing circuit continue to operate in a case where at least one of results of the operation process performed N times by the first processing circuit coincides with at least one of results of the operation process performed N times by the second processing circuit. Thus, an increase in cost of hardware can be suppressed, and a temporary stop caused by a temporary failure can be suppressed.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to an information processing apparatus, a control method, and a program. BACKGROUND

[0002] In execution of an operation process of an information processing apparatus, a transient failure can occur, and thus an operation result different from an expectation is output. Such a transient failure occurs, for example, due to data garble in a register in a processor, data garble on a bus, a malfunction of a processor, and the like. When an information processing apparatus in which a transient failure can occur is applied to a system, a temporary stop of the system due to the failure can occur. In a system that supports social infrastructure, if such a temporary stop occurs, a significant impact is caused. In addition, if a temporary stop occurs in a system assembled in a production line, production efficiency is reduced.

[0003] A technique for avoiding a temporary stop of such a system has been developed. For example, Japanese Patent Application Publication No. 2019-8781 (Patent Literature 1) discloses a Triple Modular Redundant (TMR) technique in which three processing circuits are tripled. According to the TMR technique, even if a transient failure occurs in one of the three processing circuits, the failure can be corrected by the remaining two processing circuits. Thereby, a temporary stop of the system can be avoided.

[0004] PRIOR ART DOCUMENTS

[0005] PATENT LITERATURE

[0006] Patent Literature 1: Japanese Patent Application Publication No. 2019-8781 SUMMARY

[0007] PROBLEMS TO BE SOLVED BY THE INVENTION

[0008] However, in the technique described in Patent Literature 1, three identical processing circuits need to be prepared, and thus the cost required for hardware constituting the processing circuits increases.

[0009] The present disclosure was made in view of the above-described problems, and aims to provide an information processing apparatus, a control method, and a program that can suppress an increase in the cost required for hardware and can suppress a temporary stop of a system caused by a transient failure.

[0010] MEANS FOR SOLVING PROBLEMS

[0011] According to one example of the present disclosure, an information processing apparatus that performs an operation process has a first processing circuit and a second processing circuit. The first processing circuit successively performs N operation processes. The second processing circuit successively performs the N operation processes. N is an integer of 2 or more. The first processing circuit and the second processing circuit continue to operate based on at least one of first results of the N operation processes performed by the first processing circuit and at least one of second results of the N operation processes performed by the second processing circuit, respectively, in a case where the at least one of the first results and the at least one of the second results coincide with each other.

[0012] According to the present invention, the increase in the cost of hardware required can be suppressed compared to the TMR technique that requires three processing circuits.

[0013] The probability that a transient failure occurs in the execution of the operation process is generally low. Therefore, the at least one of the first results and the at least one of the second results that coincide with each other are inferred to be the results of the operation processes in which no transient failure occurred in the execution. Thus, the first processing circuit and the second processing circuit can continue to operate using the results with high reliability. In this way, even if a transient failure occurs, the operation can be continued, and the temporary stop of the system due to the transient failure can be suppressed.

[0014] In the above disclosure, the first processing circuit includes a first memory and a first processor that performs an operation process using the first memory. The second processing circuit includes a second memory and a second processor that performs an operation process using the second memory. The first processor performs N operation processes using N regions of the first memory that are different from each other, respectively. The second processor performs the N operation processes using N regions of the second memory that are different from each other, respectively.

[0015] According to the present disclosure, even if data is scrambled due to a transient failure before the start of the operation process in some of the N regions of the first memory and some of the N regions of the second memory, at least one of the first results and at least one of the second results coincide with each other. The transient failure that can occur before the start of the operation process can occur, for example, due to a soft error or the like. Therefore, the first processor and the second processor can continue to operate based on the at least one of the first results and the at least one of the second results that coincide with each other, respectively. That is, even in a case where a transient failure occurs before the start of the operation process, the first processing circuit and the second processing circuit can continue to operate.

[0016] In the above disclosure, the first processor overwrites data of a region of the N regions of the first memory used in an operation process that outputs a result different from the at least one first result with data of a region of the N regions of the first memory used in an operation process that outputs the at least one first result.

[0017] According to the present disclosure, erroneous data is repaired to correct data. As a result, erroneous data can be prevented from being handed over to a next operation task.

[0018] In the above disclosure, the first processing circuit includes a first memory and a first processor that performs an operation process using the first memory. The second processing circuit includes a second memory and a second processor that performs an operation process using the second memory. The first processor writes, when writing object data for the operation process to the first memory, two copy data obtained by copying the object data to the first memory. The second processor writes, when writing object data for the operation process to the second memory, two copy data obtained by copying the object data to the second memory. The first processor reads, before performing the operation process, the object data and the two copy data from the first memory, and performs the operation process using two or more of the read object data and the two copy data that are identical. The second processor reads, before performing the operation process, the object data and the two copy data from the second memory, and performs the operation process using two or more of the read object data and the two copy data that are identical.

[0019] According to the present disclosure, even if data is scrambled in any one of the object data and the two copy data due to a transient fault (e.g., a soft error) before the operation process is started, the operation process is performed using the remaining two data. Thus, even in the case where a transient fault occurs before the operation process is started, the operation process can be performed using correct data that is not subject to the transient fault, and the operation continues based on the result of the operation.

[0020] In the above disclosure, the first processor overwrites, in the first memory, a region in which one data is stored with one of two data in a case where the two data of the read object data and the two copy data are identical and the remaining one data is different from the two data.

[0021] The second processor overwrites the area in which one data is stored with one of the two data in the second memory, in a case where the two data among the read-out object data and the two data are identical and the remaining one data is different from the two data.

[0022] According to the present disclosure, erroneous data is repaired to correct data due to a temporary failure. As a result, erroneous data can be prevented from being handed over to the next operation task.

[0023] In the above disclosure, the first processor writes the results of the N operation processes to N areas in the first memory, respectively. The second processor writes the results of the N operation processes to N areas in the second memory, respectively. The first processor overwrites the data of the area in which the result different from the at least one first result is written with the data of the area in which the at least one first result is written among the N areas in the first memory. The second processor overwrites the data of the area in which the result different from the at least one second result is written with the data of the area in which the at least one second result is written among the N areas in the second memory.

[0024] According to the present disclosure, erroneous data is repaired to correct data. As a result, erroneous data can be prevented from being handed over to the next operation task.

[0025] According to one example of the present disclosure, an information processing apparatus that performs an operation process includes a first processing circuit and a second processing circuit. A control method of the information processing apparatus has the steps of: the first processing circuit continuously performing N operation processes; and the second processing circuit continuously performing the N operation processes. N is an integer of 2 or more. The control method further has the steps of: the first processing circuit and the second processing circuit respectively continuing to operate based on at least one first result among first results of the N operation processes performed by the first processing circuit and at least one second result among second results of the N operation processes performed by the second processing circuit, in a case where the at least one first result and the at least one second result are identical.

[0026] According to one example of the present disclosure, a program causes a computer to execute the above control method. According to these disclosures, it is also possible to suppress an increase in cost required for hardware, and to suppress a temporary stop caused by a temporary failure.

[0027] Effects of the Invention

[0028] According to the present disclosure, it is possible to suppress an increase in cost required for hardware, and to suppress a temporary stop caused by a temporary failure. BRIEF DESCRIPTION OF DRAWINGS

[0029] Figure 1is a schematic diagram showing the overall configuration of the control system of the embodiment.

[0030] Figure 2 is a diagram showing a reference example of processing using 2 processing circuits.

[0031] Figure 3 is a diagram showing an embodiment of processing using 2 processing circuits.

[0032] Figure 4 is a schematic diagram showing a hardware configuration example of a standard PLC.

[0033] Figure 5 is a schematic diagram showing a hardware configuration example of a safety PLC.

[0034] Figure 6 is a schematic diagram showing a hardware configuration example of a coupler.

[0035] Figure 7 is a schematic diagram showing a hardware configuration example of the safety IO unit of Embodiment 1.

[0036] Figure 8 is a diagram showing Embodiment 1 of processing using 2 processing circuits when no transient failure occurs.

[0037] Figure 9 is a diagram showing Embodiment 1 of processing using 2 processing circuits when a transient failure occurs.

[0038] Figure 10 is a diagram showing an example of data repair processing in Embodiment 1.

[0039] Figure 11 is a flowchart showing the processing flow in the safety IO unit.

[0040] Figure 12 is a diagram showing an example of processing in Embodiment 1 when data garble occurs in data representing an address.

[0041] Figure 13 is a schematic diagram showing a hardware configuration example of the safety IO unit of Embodiment 2.

[0042] Figure 14 is a diagram showing write processing of writing data to the main memory.

[0043] Figure 15 is a diagram showing read processing of reading data from the main memory.

[0044] Figure 16 is a diagram showing the regions of the main memory of Embodiment 2.

[0045] Figure 17is a view showing a specific example 2 of processing using 2 processing circuits when data garbled is generated.

[0046] Figure 18 is a view showing a specific example 2 of processing using 2 processing circuits when data garbled is generated. Figure 17 is a view showing an example of repair processing of data "X".

[0047] Figure 19 is a view showing a specific example 2 of processing using 2 processing circuits when a temporary failure is generated.

[0048] Figure 20 is a view showing a specific example 2 of processing using 2 processing circuits when data garbled is generated. Figure 19 is a view showing an example of repair processing of data "Z". DETAILED DESCRIPTION

[0049] Embodiments of the present application are described in detail with reference to the accompanying drawings. In addition, the same or corresponding portions in the drawings are denoted by the same reference numerals and description thereof is not repeated.

[0050] §1 Application Example

[0051] In various fields such as aerospace systems, automobiles, medical equipment, communication equipment, industrial equipment, and the like, it is desired to suppress temporary stop of a system caused by a temporary failure of an information processing device. The present application can be applied to systems in such various fields. Hereinafter, as an application example of the present application, a control system assembled in the FA (Factory Automation) field is described, but the application example of the present application is not limited to the control system.

[0052] Figure 1 is a view showing the overall structure of the control system of the embodiment. Figure 1 The control system 1 exemplified includes a standard PLC (Programmable Logic Controller) 100, a safety PLC 200, one or more couplers 300, and one or more safety IO units 400 as main components.

[0053] The standard PLC 100 executes standard control over an arbitrary control object in accordance with a standard control program created in advance. "Standard control" is a general term for processing for controlling a control object in accordance with a predetermined required specification. The control object is, for example, a servo motor, a robot, or the like.

[0054] The safety PLC 200 independently executes safety control over an arbitrary control object from the standard PLC 100. Figure 1The illustrated safety PLC 200 is connected with the standard PLC 100 via a local bus. "Safety control" is a general term for processing for preventing a person's safety from being threatened by a device or a machine, etc. "Safety control" is designed, for example, to satisfy the requirements for implementing a safety function prescribed in IEC 61508, etc.

[0055] The coupler 300 mediates data exchange between the standard PLC 100 and the safety IO unit 400. The coupler 300 is electrically connected with the standard PLC 100 via a field network 2. The field network 2 is a communication medium for realizing data transmission for FA (Factory Automation). In the field network 2, frame transmission can be performed at a predetermined cycle, thereby guaranteeing data arrival time for each node within the network. As an example of a protocol for guaranteeing such data arrival time, in the control system 1 of the present embodiment, the field network 2 employs EtherCAT (registered trademark).

[0056] The coupler 300 transmits data received from the standard PLC 100 to the safety IO unit 400, and when data is received from the safety IO unit 400, performs preparation for saving the received data into a frame arriving next.

[0057] The safety IO unit 400 is connected with the safety PLC 200 or the coupler 300 via a local bus. Also, an arbitrary safety device (not shown) is connected to the safety IO unit 400. The safety device includes a light curtain, an emergency stop button, a safety door switch, etc.

[0058] The safety IO unit 400 receives an input signal from the safety device, and provides the input signal to the safety PLC 200. Alternatively, the safety IO unit 400 receives an input signal from the safety device, and provides the input signal to the standard PLC 100 via the coupler 300. The input signal provided to the standard PLC 100 is provided to the safety PLC 200.

[0059] Also, the safety IO unit 400 outputs an output signal to the safety device according to an instruction from the safety PLC 200. Alternatively, the safety IO unit 400 outputs an output signal to the safety device according to an instruction from the safety PLC 200 via the coupler 300 and the standard PLC 100.

[0060] The safety IO unit 400 performs an arithmetic task related to receiving an input signal from the safety device, providing the input signal, outputting an output signal to the safety device, etc., at each predetermined cycle (hereinafter referred to as "safety task cycle").

[0061] The safety PLC 200 performs safety control in accordance with an input signal supplied from the safety IO unit 400. For example, when an input signal indicating intrusion of a person is supplied from a safety device that is a light curtain, the safety PLC 200 cuts off power supply to the control objects of the standard PLC 100, and temporarily stops the control system 1. Alternatively, when an input signal indicating that a button is pressed is supplied from a safety device that is an emergency stop button, the safety PLC 200 cuts off power supply to the control objects of the standard PLC 100, and temporarily stops the control system 1.

[0062] In this way, the safety IO unit 400 is directly related to safety control for preventing a person from being threatened. Therefore, the safety PLC 200 is designed to temporarily stop the control system 1 even when a failure or an abnormality occurs in the safety IO unit 400.

[0063] If a transient failure occurs in the execution of an arithmetic task of a processing circuit included in the safety IO unit 400, and the safety IO unit 400 continues to operate in a state where the failure is not corrected, the safety PLC 200 cannot normally perform safety control. Therefore, the safety IO unit 400 has a function of detecting that a transient failure has occurred in the execution of an arithmetic task. However, if the safety IO unit 400 outputs a failure signal when it is detected that a transient failure has occurred, the control system 1 is stopped. The control system 1 can be assembled into a production line that operates for 24 hours x 365 days. In such a production line, if the control system 1 is temporarily stopped, a great damage can occur.

[0064] Therefore, the safety IO unit 400 as the information processing apparatus of the present embodiment has two processing circuits so that normal operation continues even if a transient failure occurs in one of the processing circuits. Hereinafter, one of the two processing circuits is referred to as an A-channel circuit, and the other is referred to as a B-channel circuit.

[0065] By tripling the processing circuits using the TMR technology described in Patent Document 1, normal operation can continue using the remaining two processing circuits even if a transient failure occurs in one of the three processing circuits. However, when the TMR technology is used, the cost required for hardware constituting the processing circuits increases. Therefore, the safety IO unit 400 of the present embodiment has two processing circuits (A-channel circuit and B-channel circuit). Thus, the cost required for hardware is reduced compared to a case where the safety IO unit is designed using the TMR technology.

[0066] Figure 2 is a diagram showing a reference example of processing using two processing circuits. In Figure 2In the illustrated reference example, the A-channel circuit and the B-channel circuit perform computational tasks in parallel during each security task cycle.

[0067] Transient failures are likely to occur by chance with a low probability. Therefore, it is rare for transient failures to occur in both the A-channel and B-channel circuits during the same safe mission cycle.

[0068] If no transient fault occurs in either channel A or channel B, the results of the computation task are consistent. Conversely, if a transient fault occurs in at least one of channel A or channel B, the results of the computation task become inconsistent. Therefore, by comparing the results of the computation task in channel A and channel B, it is possible to detect whether a transient fault has occurred. In other words, a transient fault can be detected based on the inconsistency between the results of the computation task in channel A and channel B.

[0069] However, in Figure 2 In the illustrated reference example, it is impossible to determine whether a transient fault occurred in channel A or channel B. Therefore, based on the inconsistency between the results of the two computational tasks, the safety I / O unit determines that normal operation cannot continue and only outputs a fault signal. As a result, through the safety control of the safety PLC 200, control system 1 is stopped. Therefore, after executing... Figure 2 In the case of the illustrated reference example, when a transient fault occurs in one of the processing circuits, the control system 1 temporarily stops.

[0070] In order to continue normal operation even if a processing circuit experiences a brief malfunction, the safety I / O unit 400 of this embodiment performs the following processing.

[0071] Figure 3 This diagram illustrates an embodiment of a process that uses two processing circuits. (As shown) Figure 3 As shown, the A-channel circuit continuously executes the same computation tasks T1 and T2 during the safety task cycle. The B-channel circuit continuously executes the same computation tasks T3 and T4 during the safety task cycle. Furthermore, the computation tasks T1 and T2 executed by the A-channel circuit are the same as those executed by the B-channel circuit. That is, the safety I / O unit 400 executes the same computation tasks T1 to T4 during the safety task cycle. Then, in each safety task cycle, the safety I / O unit 400 compares the results of computation tasks T1 to T4 and detects whether a transient fault has occurred based on the comparison results.

[0072] In a case where no transient failure occurs in the operation tasks T1 to T4, the results of the operation tasks T1 to T4 are the same. Therefore, the safety IO unit 400 determines that no transient failure has occurred in any of the operation tasks T1 to T4 based on the fact that the results of the operation tasks T1 to T4 are the same, and the operation can be continued based on any one of the operation results.

[0073] The result of an operation task in which a transient failure occurs during execution is generally different from the result of an operation task in which no transient failure occurs during execution. In addition, in a case where a transient failure occurs, the result of the operation task is generally different depending on the content of the transient failure. In one safety task cycle, a case where the same content of transient failure occurs in both the A-channel circuit and the B-channel circuit is very rare.

[0074] Therefore, in the safety IO unit 400 of the present embodiment, the A-channel circuit and the B-channel circuit continue the operation based on the result in which at least one of the results (first results) of the operation tasks T1 and T2 coincides with at least one of the results (second results) of the operation tasks T3 and T4. That is, the A-channel circuit continues the operation based on at least one of the results of the operation tasks T1 and T2. The B-channel circuit continues the operation based on at least one of the results of the operation tasks T3 and T4. Thus, it is possible to suppress an increase in the cost of hardware required and to suppress a temporary stop of the system caused by a transient failure.

[0075] §2 Specific Example 1

[0076] <Hardware structure of standard PLC>

[0077] Figure 4 is a schematic diagram showing an example of the hardware structure of a standard PLC. Figure 4 The illustrated standard PLC 100 includes a processor 102, a main memory 104, a storage 110, a field network controller 108, and a local bus controller 116. These components are connected via a processor bus 118.

[0078] The processor 102 mainly corresponds to an operation processing section that performs a control operation involved in standard control, and is configured by a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), or the like. Specifically, the processor 102 reads out a program (as an example, a system program 1102 and a standard control program 1104) saved in the storage 110, and expands the execution in the main memory 104, thereby realizing a control operation corresponding to a control object and various processes described later.

[0079] The main memory 104 is constituted by, for example, a volatile memory such as a DRAM (Dynamic Random Access Memory) or an SRAM (Static Random Access Memory). The storage 110 is constituted by, for example, a non-volatile storage device such as an SSD (Solid State Drive) or an HDD (Hard Disk Drive).

[0080] The system program 1102 for realizing basic functions, a standard control program 1104 created in accordance with a control object, and setting information 1106 for specifying processing in the standard PLC 100 are held in the storage 110.

[0081] The field network controller 108 exchanges data between the standard PLC 100 and any device (for example, the coupler 300) via the field network 2.

[0082] The local bus controller 116 exchanges data between any unit (for example, the safety PLC 200) connected to the standard PLC 100 via the local bus.

[0083] <Hardware structure of safety PLC>

[0084] Figure 5 is a schematic diagram showing an example of a hardware structure of a safety PLC. Figure 5 The safety PLC 200 shown as an example includes a processor 202, a main memory 204, a storage 210, and a local bus controller 216. These components are connected via a processor bus 218.

[0085] The processor 202 mainly corresponds to an arithmetic processing section that performs control arithmetic involved in safety control, and is constituted by a CPU or a GPU or the like.

[0086] The main memory 204 is constituted by, for example, a volatile memory such as a DRAM or an SRAM. The storage 210 is constituted by, for example, a non-volatile storage device such as an SSD or an HDD or the like.

[0087] The system program 2102 for realizing basic functions, a safety program 2104 created in correspondence with a required safety function, and setting information 2106 for specifying processing in the safety PLC 200 are held in the storage 210.

[0088] The local bus controller 216 exchanges data between a safety IO unit 400 connected to the safety PLC 200 via the local bus.

[0089] <Hardware structure of coupler>

[0090] Figure 6 is a schematic diagram showing a hardware configuration example of the coupler. Figure 6 The coupler 300 illustrated includes a processor 302, a main memory 304, a storage 310, a field network controller 308, and a local bus controller 316. These components are connected via a processor bus 318.

[0091] The processor 302 mainly corresponds to an arithmetic processing section that executes control operations for causing the coupler 300 to act, and is constituted by a CPU or a GPU, or the like.

[0092] The main memory 304 is constituted by, for example, a volatile memory such as a DRAM or an SRAM. The storage 310 is constituted by, for example, a non-volatile storage device such as an SSD or an HDD, or the like.

[0093] In the storage 310, a system program 3102 for realizing basic functions and setting information 3106 for specifying processing in the coupler 300 are held.

[0094] The field network controller 308 exchanges data between the coupler 300 and an arbitrary device (for example, the standard PLC 100) via the field network 2.

[0095] The local bus controller 316 exchanges data between the coupler 300 and the safety IO unit 400 connected thereto via the local bus.

[0096] <Hardware configuration of safety IO unit>

[0097] Figure 7 is a schematic diagram showing a hardware configuration example of the safety IO unit of the embodiment 1. Figure 7 The safety IO unit 400 illustrated includes two processing circuits, a storage 410, a local bus controller 420, and safety IO modules 430. These components are connected via a processor bus 440.

[0098] The A-channel circuit 40A, which is one of the two processing circuits, is constituted by a processor 401 and a main memory 403. The B-channel circuit 40B, which is the other of the two processing circuits, is constituted by a processor 404 and a main memory 406.

[0099] The processors 401, 404 correspond to arithmetic processing sections that execute control operations required for input and output of signals and management functions for realizing safety control, and are constituted by a CPU or an MPU (Micro Processing Unit), or the like. The processors 401, 404 are respectively built-in with registers 402, 405. The registers 402, 405 temporarily hold operation results of the processors 401, 404, or hold addresses at the time of reading and writing the main memories 403, 406.

[0100] The main memories 403, 406 are constituted by, for example, volatile memories such as DRAM or SRAM. The SRAM uses a flip-flop as a structure of a storage section, and has an advantage that it can operate at a higher speed than the DRAM because it does not need a refresh operation. Therefore, it is preferable to use the SRAM as the main memories 403, 406. Hereinafter, it is assumed that the main memories 403, 406 are the SRAM, and the description will be made.

[0101] The storage 410 is constituted by, for example, a non-volatile storage device such as an SSD or an HDD. The storage 410 stores therein an IO program 41A1, 41A2, 41B1, 41B2 for realizing an IO function, and a check repair program 42A, 42B. The IO program 41A1, 41A2 and the check repair program 42A are executed in the A channel circuit 40A. The IO program 41B1, 41B2 and the check repair program 42B are executed in the B channel circuit 40B.

[0102] The local bus controller 420 exchanges data between the devices connected to the safety IO unit 400 (for example, the safety PLC 200, the coupler 300) via the local bus.

[0103] The safety IO module 430 is electrically connected to the safety device, and receives an input of a detection result or the like of the safety device, or outputs a signal to the safety device.

[0104] In addition, in the example of Figure 7 In the example of

[0105] <About a transient fault>

[0106] The transient fault can be caused, for example, by a data garble in the registers 402, 405 in the processors 401, 404, a data garble on the processor bus 440, a malfunction of the processors 401, 404, or the like.

[0107] In recent years, with high integration and miniaturization of semiconductor devices, soft errors caused by α particles, cosmic rays, and neutrons have been rapidly increasing. The transient fault can also be caused by a data garble due to the soft error. In the DRAM having a stack type structure, the soft error resistance is high. On the other hand, in the SRAM having a flip-flop structure, the soft error resistance is reduced due to the miniaturization. Therefore, in the case where the main memories 403, 406 constituted by the SRAM are used, the soft error can occur in the main memories 403, 406.

[0108] If a transient fault, such as a soft error, occurs in the main memory 403 or 406 before the computation (computation task) begins, the processors 401 and 404 will use the data from the state that caused the transient fault to perform the computation, resulting in a result different from the expected result. Therefore, the operation of the safety I / O module 430 becomes abnormal.

[0109] Not limited to the case of a brief failure occurring during the execution of the operation, even if a brief failure occurs in the main memory 403 or 406 before the start of the operation, the safety I / O unit 400 of Example 1 will continue to perform the following process in a normal manner.

[0110] <Specific Example 1 of Processing in the Secure I / O Unit>

[0111] Reference Figure 8 to Figure 10 A specific example of processing using two processing circuits will be explained. Figure 8 This is a diagram of a specific example 1 showing a process using two processing circuits when no transient fault occurs. Figure 9 This is a diagram illustrating a specific example 1 of a process that uses two processing circuits when a transient fault occurs. Figure 10 This is a diagram illustrating an example of the data repair process in Specific Example 1.

[0112] like Figure 8 and Figure 9 As shown, processor 401 of channel A circuit 40A continuously executes the same computation tasks T1 and T2 during the secure task cycle. Processor 404 of channel B circuit 40B continuously executes the same computation tasks T3 and T4 during the secure task cycle. Furthermore, the computation tasks T1 and T2 executed by processor 401 are the same as those executed by processor 404. That is, secure I / O unit 400 executes the same computation tasks T1 to T4 during the secure task cycle. However, secure I / O unit 400 uses four different memory regions to execute computation tasks T1 to T4 respectively.

[0113] Specifically, in the main memory 403 constituting the A-channel circuit 40A, region 403a is set for use in the first operation task T1 and region 403b is set for use in the second operation task T2. Similarly, in the main memory 406 constituting the B-channel circuit 40B, region 406a is set for use in the first operation task T3 and region 406b is set for use in the second operation task T4.

[0114] The processor 401 constituting the A-channel circuit 40A writes data used in the arithmetic task Tl to a region 403a of the main memory 403 constituting the A-channel circuit 40A before executing the arithmetic task Tl. In Figure 8 Also Figure 9 In the illustrated embodiment, the processor 401 writes the data "X" and "Y" to the region 403a before execution of the arithmetic task Tl. Similarly, the processor 401 writes the data "X" and "Y" used in the arithmetic task T2 to a region 403b of the main memory 403 before executing the arithmetic task T2.

[0115] The processor 404 constituting the B-channel circuit 40B writes the data "X" and "Y" used in the arithmetic task T3 to a region 406a of the main memory 406 constituting the B-channel circuit 40B before executing the arithmetic task T3, similarly to the processor 401. Similarly, the processor 404 writes the data "X" and "Y" used in the arithmetic task T4 to a region 406b of the main memory 406 before executing the arithmetic task T4.

[0116] Further, the timing of writing the data "X" and "Y" to the regions 403a, 403b, 406a, 406b is defined by the IO programs 41Al, 41A2, 41Bl, 41B2, respectively. The timing can be, for example, the last safety task cycle or the start of the safety IO unit 400. In addition, the addresses within the regions 403a, 403b, 406a, 406b where the data "X" and "Y" are written are defined by the IO programs 41Al, 41A2, 41Bl, 41B2, respectively.

[0117] The processor 401 starts the arithmetic task Tl in synchronization with the start timing of the safety task cycle. In Figure 8 and Figure 9 In the illustrated embodiment, the processor 401 reads the data "X" and "Y" from the region 403a of the main memory 403 and executes an operation using the data "X" and "Y". Then, the processor 401 writes the data "Z" as the operation result to the region 403a of the main memory 403.

[0118] The processor 401 starts the arithmetic task T2 after the arithmetic task Tl ends. The arithmetic task T2 differs from the arithmetic task Tl only in that the region 403b is used instead of the region 403a in the main memory 403. That is, the processor 401 reads the data "X" and "Y" from the region 403b and executes an operation using the data "X" and "Y". Then, the processor 401 writes the data "Z" as the operation result to the region 403b.

[0119] Similarly, processor 404 starts computation task T3 synchronously with the start timing of the security task cycle. Computation task T3 differs from computation task T1 only in that it uses region 406a of main memory 406 instead of region 403a within main memory 403. That is, processor 404 reads data "X" and "Y" from region 406a of main memory 406 and performs operations using data "X" and "Y". Then, processor 404 writes the data "Z" as the result of the operations into region 406a of main memory 406.

[0120] Processor 404 begins computation task T4 after computation task T3 concludes. Computation task T4 differs from computation task T3 only in that it uses region 406b instead of region 406a within main memory 406. Specifically, processor 401 reads data "X" and "Y" from region 406b and performs operations using data "X" and "Y". Then, processor 404 writes the result data "Z" into region 406b.

[0121] Operation tasks T1 through T4 are executed according to I / O programs 41A1, 41A2, 41B1, and 41B2, respectively. That is, the addresses within regions 403a, 403b, 406a, and 406b, which are the destinations for reading data "X" and "Y," are defined by I / O programs 41A1, 41A2, 41B1, and 41B2, respectively. I / O programs 41A1, 41A2, 41B1, and 41B2 define the same operations for data "X" and "Y." The addresses within regions 403a, 403b, 406a, and 406b, which are the destinations for writing data "Z," are defined by I / O programs 41A1, 41A2, 41B1, and 41B2, respectively. Thus, I / O programs 41A1, 41A2, 41B1, and 41B2 define the same operations only for the memory regions that are the destinations for the read and write objects.

[0122] If no transient fault occurs in either channel A circuit 40A or channel B circuit 40B, such as Figure 8 As shown, the results (data "Z") of computation tasks T1 through T4 are all identical. However, if a brief failure occurs before or during the execution of computation task T4, such as... Figure 9 As shown, the result (data "Z'") of computation task T4 is different from the results (data "Z") of computation tasks T1 to T3. Figure 9 In the example, before the start of computation task T4, data garbled characters caused by soft errors are generated in region 406b, and the data “X” is garbled as the data “X’”.

[0123] Accordingly, the processors 401, 404 compare the results of the arithmetic tasks T1 to T4 after 2 arithmetic tasks. According to the case where the results of the arithmetic tasks T1 to T4 all coincide, the processors 401, 404 determine that no transient failure including data corruption has occurred, and continue the operation based on the results of the arithmetic tasks T1 to T4.

[0124] According to the case where at least one of the results of the arithmetic tasks T1, T2 coincides with at least one of the results of the arithmetic tasks T3, T4, the processors 401, 404 determine that the result (hereinafter, also referred to as "common result") coincides is the result of the arithmetic task in which no transient failure has occurred. Then, the processors 401, 404 continue the operation based on the result. In Figure 9 In the example shown, the results of the arithmetic tasks T1, T2 coincide with the result of the arithmetic task T3. Accordingly, the processor 401 continues the operation based on the results of the arithmetic tasks T1, T2, and the processor 404 continues the operation based on the result of the arithmetic task T3.

[0125] Further, the processors 401, 404 overwrite the data of the storage area used in the arithmetic task in which the above-described common result is calculated to the storage area used in the arithmetic task in which a result different from the above-described common result is calculated. In Figure 10 In the example shown, the processor 404 overwrites the data of the area 406a used in the arithmetic task T3 in which the result coinciding with the arithmetic tasks T1, T2 is output to the area 406b used in the arithmetic task T4 in which a result different from the result of the arithmetic task T3 is output. Thereby, the erroneous data of the storage area in which the transient failure has occurred is repaired to the correct data of the storage area in which no transient failure has occurred. As a result, it is possible to avoid the erroneous data being handed over to the next arithmetic task.

[0126] The comparison processing of the processors 401, 404 of the arithmetic tasks T1 to T4 is defined by the comparison repair programs 42A, 42B, respectively. In addition, the repair processing of the areas 403a, 403b performed by the processor 401 is defined by the comparison repair program 42A. Similarly, the repair processing of the areas 406a, 406b performed by the processor 404 is defined by the comparison repair program 42B.

[0127] <Process flow in secure IO unit>

[0128] Figure 11 is a flowchart showing a process flow in the secure IO unit. First, the processors 401, 404 determine whether or not the timing of the start of the beat has arrived (step S1). In the case where the timing of the start of the beat has not arrived (NO in step S1), the process returns to step S1 again.

[0129] When the timing of the start of the beat is reached (YES in step S1), the parallel processing of steps S2, S3 and steps S4, S5 is executed. In step S2, the processor 401 of the A channel circuit 40A executes the first operation task Tl using the region 403a of the main memory 403. When the execution of the operation task Tl is completed, in step S3, the processor 401 executes the second operation task T2 using the region 403b of the main memory 403. In step S4, the processor 404 of the B channel circuit 40B executes the first operation task T3 using the region 406a of the main memory 406. When the execution of the operation task T3 is completed, in step S4, the processor 404 executes the second operation task T4 using the region 406b of the main memory 406.

[0130] When steps S3, S5 are completed, in step S6, the processors 401, 404 collate the results of the operation tasks Tl to T4.

[0131] In a case where the results of the operation tasks Tl to T4 all coincide (YES in step S7), the processors 401, 404 judge that the operation tasks Tl to T4 all normally end, and continue the operation based on the results of the operation tasks Tl to T4 (step S10). After step S10, the processing ends.

[0132] In a case where the results of the operation tasks Tl to T4 do not all coincide (NO in step S7), the processors 401, 404 judge whether at least one of the results of the operation tasks Tl, T2 coincides with at least one of the results of the operation tasks T3, T4 (step S8).

[0133] In a case where YES in step S8, the data of the storage region used in the operation task in which the results do not coincide is repaired (step S9). After the data is repaired, the processing is shifted to step S10.

[0134] For example, in a case where the result of the operation task Tl differs from the results of the other three operation tasks, the processor 401 overwrites the data of the region 403b on the region 403a in the main memory 403. In a case where the result of the operation task T2 differs from the results of the other three operation tasks, the processor 401 overwrites the data of the region 403a on the region 403b in the main memory 403. In a case where the result of the operation task T3 differs from the results of the other three operation tasks, the processor 404 overwrites the data of the region 406b on the region 406a in the main memory 406. In a case where the result of the operation task T4 differs from the results of the other three operation tasks, the processor 404 overwrites the data of the region 406a on the region 406b in the main memory 406.

[0135] If the results of computation tasks T1 and T3 are consistent, but the results of computation tasks T2 and T4 are inconsistent with those of computation tasks T1 and T3, processor 401 overwrites region 403b with the data from region 403a in main memory 403. Then, processor 404 overwrites region 406b with the data from region 406a in main memory 406. If the results of computation tasks T1 and T4 are consistent, but the results of computation tasks T2 and T3 are inconsistent with those of computation tasks T1 and T4, processor 401 overwrites region 403b with the data from region 403a in main memory 403. Then, processor 404 overwrites region 406a with the data from region 406b in main memory 406. If the results of computation tasks T2 and T3 are consistent, but the results of computation tasks T1 and T4 are inconsistent with those of computation tasks T2 and T3, processor 401 overwrites region 403a with the data from region 403b in main memory 403. Subsequently, processor 404 overwrites region 406b with the data from region 406a in main memory 406. If the results of computation tasks T2 and T4 are consistent, but the results of computation tasks T1 and T3 are inconsistent with those of computation tasks T2 and T4, processor 401 overwrites region 403a with the data from region 403b in main memory 403. Then, processor 404 overwrites region 406a with the data from region 406b in main memory 406.

[0136] If the result in step S8 is "No", processors 401 and 404 output an error signal, causing operation to stop (step S11). After step S11, the process ends.

[0137] <Function / Effect>

[0138] As described above, according to Specific Example 1, Channel A circuit 40A includes main memory 403 and processor 401 that uses main memory 403 to perform computational tasks. Channel B circuit 40B includes main memory 406 and processor 404 that uses main memory 406 to perform computational tasks. Processor 401 uses two different regions 403a and 403b of main memory 403 to perform computational tasks T1 and T2, respectively. Processor 404 uses two different regions 406a and 406b of main memory 406 to perform computational tasks T3 and T4, respectively.

[0139] According to the above structure, the processor 401 performs two operation tasks Tl, T2 using different regions 403a, 403b of the main memory 403, respectively. Similarly, the processor 404 performs two operation tasks T3, T4 using different regions 406a, 406b of the main memory 406, respectively. Thus, even if data corruption caused by a soft error or the like occurs in one of the regions 403a, 403b and / or one of the regions 406a, 406b, the result of the operation task using the other of the regions 403a, 403b (common result) coincides with the result of the operation task using the other of the regions 406a, 406b (common result). Therefore, the processors 401, 404 can continue to operate based on the common result. That is, even if a transient failure occurs in the main memory 403 before the operation tasks start, the A-channel circuit 40A and the B-channel circuit 40B can continue to operate.

[0140] The processor 401 overwrites the data of the region of the main memory 403 used in the operation task that outputs the common result described above with the data of the region of the main memory 403 used in the operation task that outputs a result different from the common result described above. Similarly, the processor 404 overwrites the data of the region of the main memory 406 used in the operation task that outputs the common result described above with the data of the region of the main memory 406 used in the operation task that outputs a result different from the common result described above.

[0141] According to the above structure, erroneous data is repaired to correct data. As a result, erroneous data can be prevented from being passed to the next operation task.

[0142] §3 Specific Example 2

[0143] The data stored in the main memory includes data representing a value and data representing an address in the main memory. In the case where a transient failure (e.g., data corruption caused by a soft error) occurs in a region storing data representing a value, the value is corrupted from the original state. Even in this case, the processor can continue to operate. On the other hand, in the case where a transient failure occurs in a region storing data representing an address, the address is corrupted from the original state. There can be a case where the address after corruption does not exist in the main memory. In this case, the processor determines that an exception (anomaly) has occurred, and stops the processing.

[0144] Figure 12 Fig. 6 is a diagram showing an example of the processing of Specific Example 1 when data corruption occurs in data representing an address. In the example shown in Fig. 6, the data of the region 403a of the main memory 403 is corrupted from the original state. In this case, the address after corruption does not exist in the main memory 403. Therefore, the processor 401 determines that an exception has occurred, and stops the processing. Figure 12In the example shown, the data representing the address stored in the region 403a of the main memory 403 constituting the A-channel circuit 40A is scrambled in a manner to represent an address that does not exist in the main memory 403. Therefore, in a case where the data read out from the region 403a represents an address that does not exist in the main memory 403 when the processor 401 executes the operation task Tl, the processing is forcibly ended. Therefore, the results of the operation tasks Tl, T2 cannot be obtained. As a result, the collation processing of the operation tasks Tl to T4 cannot be executed, and the operation of the safe IO unit 400 cannot be continued.

[0145] The safe IO unit 400 of the embodiment 2 is designed to be able to continue the operation even in a case where a temporary failure occurs in the region in which the data representing the address is stored.

[0146] <Hardware structure in safe IO unit>

[0147] Figure 13 is a diagram showing an example of the hardware structure of the safe IO unit of the embodiment 2. Figure 13 The safe IO unit 400 exemplified is different from the safe IO unit 400 exemplified in the embodiment 1 only in that the storage 410 stores the read-write program 43. Figure 7 The safe IO unit 400 exemplified is different from the safe IO unit 400 exemplified in the embodiment 1 only in that the storage 410 stores the read-write program 43.

[0148] The processor 401 writes and reads the data of the main memory 403 in accordance with the read-write program 43. Similarly, the processor 404 writes and reads the data of the main memory 406 in accordance with the read-write program 43.

[0149] <Writing and reading of data to main memory>

[0150] Figure 14 is a diagram showing the write processing of writing the data to the main memory. As Figure 14 shown, the processors 401, 404, when writing the object data as the write target to the main memories 403, 406, respectively, copy the object data twice, and also write the two copied data to the main memories 403, 406, respectively. In this way, in the main memories 403, 406, the object data and the two copied data are written simultaneously, respectively. Thus, in the main memories 403, 406, the data is triplicated, respectively.

[0151] Immediately after the writing, the object data and the two copied data are the same. However, for example, if a soft error occurs due to the influence of cosmic rays or neutron rays, the data is scrambled in any of the object data and the two copied data.

[0152] Figure 15 is a diagram showing the read processing of reading the data from the main memory. As Figure 15As shown, when processors 401 and 404 read object data from main memory 403 and 406 respectively, they also read two copies of the object data. Processors 401 and 404 then compare the read object data and the two copies with each other.

[0153] If the read object data and the two copied data are completely consistent, processors 401 and 404 determine that no data garbled characters have been generated in any data of the object data and the two copied data, and thus use the object data to perform the operation task.

[0154] When processors 401 and 404 find that two of the read object data and two copied data are consistent, while the remaining data is inconsistent, they determine that no data corruption occurred in the two consistent data, but data corruption occurred in the remaining data. Then, processors 401 and 404 respectively overwrite the area storing the remaining data with one of the two consistent data. Thus, the data corruption is repaired. Then, processors 401 and 404 use one of the two consistent data to perform the computation task.

[0155] Through the above processing, even if data garbled occurs in any data of the object data and the two copied data, the data with garbled characters is repaired during the read process, and the operation continues.

[0156] <Example of processing in the secure I / O unit>

[0157] Reference Figure 16 to Figure 20 Example 2 illustrates a specific process that uses two processing circuits. Figure 16 This is a diagram representing the main memory region in specific example 2. For example... Figure 16 As shown, main memory 403 includes regions 403c, 403d, and 403e. Main memory 406 includes regions 406c, 406d, and 406e.

[0158] Regions 403c and 406c are regions where only data is read during computation tasks. Region 403c is used in both the first computation task T1 and the second computation task T2 of processor 401. Region 406c is used in both the first computation task T3 and the second computation task T4 of processor 404.

[0159] Regions 403d, 403e, 406d, 406e are regions in which data is written in the operation tasks. Region 403d is used in the first operation task Tl of the processor 401. Region 403e is used in the second operation task T2 of the processor 401. Region 406d is used in the first operation task T3 of the processor 404. Region 406e is used in the second operation task T4 of the processor 404.

[0160] Figure 17 is a diagram showing a specific example 2 of processing using two processing circuits when data corruption occurs. Figure 18 is a diagram showing Figure 17 an example of repair processing of the data "X" shown in

[0161] As shown in Figure 17 the processor 401 of the A channel circuit 40A continuously executes the same operation tasks Tl, T2 in the safe task period. The processor 401 executes the operation tasks Tl, T2 using the data "X" and "Y" stored in the region 403c of the main memory 403. The processor 401 writes the results (data "Z") of the operation tasks Tl, T2 to the regions 403d, 403e, respectively. Similarly, the processor 404 of the B channel circuit 40B continuously executes the same operation tasks T3, T4 in the safe task period. The processor 404 executes the operation tasks T3, T4 using the data "X" and "Y" stored in the region 406c of the main memory 406. The processor 404 writes the results (data "Z") of the operation tasks T3, T4 to the regions 406d, 406e, respectively.

[0162] As described above, the data written to the main memories 403, 406 is triplicated. Therefore, the data "X" and the two copy data "X_Copyl", "X_Copy2" are written to the regions 403c, 406c. Figure 17 In the example shown in

[0163] The processor 404 reads the object data and the two copy data from the region 406c of the main memory 406 before executing each of the operation tasks T3, T4, and collates the three data. In Figure 17 In the example shown in

[0164] Similarly, before executing each computational task T1 and T2, processor 401 reads the object data and two copies of data from region 403c of main memory 403, and compares these three data. Because the data "X" is garbled into data "X'", the data "X'" is inconsistent with the two copies "X_Copy1" and "X_Copy2". On the other hand, the two copies "X_Copy1" and "X_Copy2" are consistent. Therefore, as... Figure 18 As shown, processor 401 overwrites data "X'" with one of two identical copies, "X_Copy1" and "X_Copy2". Thus, data "X'" is restored to data "X" before computation task T1. Consequently, processor 401 can use the restored data "X" (or the copies "X_Copy1" and "X_Copy2") to execute computation tasks T1 and T2. That is, as... Figure 17 As shown, even if the data "X" represents an address, the processor 401 will not judge it as an exception (abnormality) and can continue to process tasks T1 and T2.

[0165] Then, the correct data is used to execute computation tasks T1 to T4, so the results of computation tasks T1 to T4 are consistent. Therefore, processors 401 and 404 continue the operation based on the results of computation tasks T1 to T4.

[0166] Figure 19 This is a diagram of example 2, which illustrates a process using two processing circuits when a brief malfunction occurs during the execution of a computational task. Figure 20 It means Figure 19 The figure shown is an example of the repair process for the data "Z".

[0167] like Figure 19 As shown, a brief fault occurs during the execution of computation task T3 by processor 404, and a computation result (data "Z'") that differs from the results (data "Z") of other computation tasks is written to region 406d. However, since the results of computation tasks T1, T2, and T4 are consistent, processors 401 and 404 determine that computation tasks T1, T2, and T4 are executed normally, and continue the operation based on the results of computation tasks T1, T2, and T4. In this way, even if a brief fault occurs during the execution of a computation task, the operation of the safety I / O unit 400 can continue, avoiding a temporary halt to the control system 1.

[0168] Furthermore, such as Figure 20 As shown, processor 404 overwrites the data written to region 406e, which contains the result of normally executed computation task T4, with the data written to region 406d, which contains the result of computation task T3. Thus, the erroneous data "Z'" is corrected to the correct data "Z".

[0169] <Function / Effect>

[0170] As described above, according to Specific Example 2, when processor 401 writes the object data used by computation tasks T1 and T2 to main memory 403, it also writes the two copies of the data obtained by copying the object data to main memory 403. Similarly, when processor 404 writes the object data used by computation tasks T3 and T4 to main memory 406, it also writes the two copies of the data obtained by copying the object data to main memory 406.

[0171] Furthermore, before executing each computation task T1 and T2, processor 401 reads the object data and two copies of the data from main memory 403. Similarly, before executing each computation task T3 and T4, processor 404 reads the object data and two copies of the data from main memory 406. Processors 401 and 404, respectively, use the matching data (two or more pieces of the read object data and two copies of the data) to execute the computation tasks.

[0172] According to the above structure, even if data corruption occurs in the object data and any one of the two copied data in the main memories 403 and 406, the remaining two data are used to perform the computation task. Therefore, even in the event of data corruption due to a temporary fault, the correct data that has not been corrupted can be used to perform the computation task, and the operation can continue based on the result of that computation task.

[0173] Processors 401 and 404, respectively, overwrite the area containing the remaining data with one of the two copied data if the two copied data are identical and the remaining data is different from the two copied data.

[0174] Based on the above structure, the garbled data is repaired to be correct. As a result, erroneous data can be prevented from being passed on to the next computation task.

[0175] Processor 401 writes the results of computation tasks T1 and T2 to two distinct regions 403d and 403e of main memory 403, respectively. Similarly, processor 404 writes the results of computation tasks T3 and T4 to two distinct regions 406d and 406e of main memory 406, respectively. Then, processors 401 and 404 continue their operations based on the consistent result (common result) if at least one of the results of computation tasks T1 and T2 is consistent with at least one of the results of computation tasks T3 and T4.

[0176] The processor 401 overwrites the data of the area of the main memory 403 in which the result of the operation task is written, with the data of the area of the main memory 403 in which the result of the common result is written. Similarly, the processor 404 overwrites the data of the area of the main memory 406 in which the result different from the common result is written, with the data of the area of the main memory 406 in which the result of the common result is written.

[0177] According to the above-described configuration, the erroneous data is repaired to the correct data. As a result, it is possible to avoid the erroneous data from being handed over to the next operation task.

[0178] §4 Modification

[0179] <Modification 1>

[0180] In the above-described embodiments 1 and 2, the processor 401 and the processor 404 respectively continuously execute the operation task twice in each safety task period. However, the processor 401 and the processor 404 can respectively continuously execute the operation task N times in each safety task period. N is an integer of 2 or more.

[0181] Further, in the modification of the embodiment 1, the processor 401 respectively executes the operation task N times using N areas of the main memory 403 which are different from each other. Similarly, the processor 404 respectively executes the operation task N times using N areas of the main memory 406 which are different from each other.

[0182] In addition, in the modification of the embodiment 2, the processor 401 respectively writes the results of the operation task N times to N areas of the main memory 403 which are different from each other. Similarly, the processor 404 respectively writes the results of the operation task N times to N areas of the main memory 406 which are different from each other.

[0183] The processor 401 and the processor 404 determine whether or not the following condition A is satisfied.

[0184] Condition A: At least one of the results of the operation processing (first result) performed by the processor 401 coincides with at least one of the results of the operation processing (second result) performed by the processor 404.

[0185] Then, the processor 401 and the processor 404 respectively continue the operation based on the at least one of the first result and the at least one of the second result in accordance with the above-described condition A.

[0186] Further, the processor 401 and the processor 404 can determine whether or not the following condition B is satisfied in addition to the above-described condition A.

[0187] Condition B: the results of the operation tasks of 2N times or more are identical to the above-mentioned at least one first result (or the above-mentioned at least one second result) up to a reference number of times. The reference number is, for example, an integer of 3 or more.

[0188] Further, the processors 401, 404 can also continue to act based on the above-mentioned at least one first result and at least one second result, respectively, in accordance with the above-mentioned conditions A and B being satisfied.

[0189] The reference number can also be set to a number exceeding N. For example, when N = 2, the processors 401, 404 can continue to act based on 3 or more of the results of the operation tasks of 4 times in accordance with the case where 3 or more of the results of the operation tasks of 4 times are identical. For example, when N = 3, the processors 401, 404 can continue to act based on 4 or more of the results of the operation tasks of 6 times in accordance with the case where 4 or more of the results of the operation tasks of 6 times are identical. Thus, even if a temporary failure occurs in less than half of the operation tasks of 2N times, the processors 401, 404 can continue to act.

[0190] <Modified Example 2>

[0191] In the above description, the safety IO unit 400 has two processing circuits (the A channel circuit 40A and the B channel circuit 40B). However, at least one of the standard PLC 100, the safety PLC 200, and the coupler 300 can have two processing circuits that perform the same processing as the above-mentioned A channel circuit 40A and B channel circuit 40B. Thus, at least one of the standard PLC 100, the safety PLC 200, and the coupler 300 can continue to act even if a temporary failure occurs. As a result, the frequency of stopping the control system 1 is suppressed.

[0192] Further, in the case of being combined with Modified Example 1, different reference numbers can be set for each device in accordance with the characteristics required by the device. For example, the reliability of the results of the operation tasks required in the control PLC 100 is lower than the reliability of the results of the operation tasks required in the safety IO unit 400. Therefore, the reference number set in the control PLC 100 can be less than the reference number set in the safety IO unit 400.

[0193] §5 Appendix

[0194] As described above, the present embodiment includes the following disclosure.

[0195] (Structure 1)

[0196] An information processing device (400) that performs operation processing, the information processing device (400) having:

[0197] a first processing circuit (40A); and

[0198] a second processing circuit (40B),

[0199] the first processing circuit (40A) successively executes the operation processing N times,

[0200] the second processing circuit (40B) successively executes the operation processing N times,

[0201] N is an integer of 2 or more,

[0202] the first processing circuit (40A) and the second processing circuit (40B) continue to operate based on at least one of first results of the operation processing executed N times by the first processing circuit (40A) and at least one of second results of the operation processing executed N times by the second processing circuit (40B) in a case where the at least one of the first results and the at least one of the second results coincide with each other.

[0203] (structure 2)

[0204] in the information processing apparatus (400) described in structure 1,

[0205] the first processing circuit (40A) includes a first memory (403) and a first processor (401) that executes the operation processing using the first memory (403),

[0206] the second processing circuit (40B) includes a second memory (406) and a second processor (404) that executes the operation processing using the second memory (406),

[0207] the first processor (401) executes the operation processing N times using N regions (403a, 403b) of the first memory (403) that are different from each other,

[0208] the second processor (404) executes the operation processing N times using N regions (406a, 406b) of the second memory (406) that are different from each other.

[0209] (structure 3)

[0210] in the information processing apparatus (400) described in structure 2,

[0211] The first processor (401) covers data of a region of the N regions (403a, 403b) of the first memory (403) used in the operation processing in which the at least one first result is output, with data of a region used in the operation processing in which a result different from the at least one first result is output,

[0212] The second processor (404) covers data of a region of the N regions (406a, 406b) of the second memory (406) used in the operation processing in which the at least one second result is output, with data of a region used in the operation processing in which a result different from the at least one second result is output.

[0213] (structure 4)

[0214] In the information processing apparatus (400) described in structure 1,

[0215] The first processing circuit (40A) includes a first memory (403) and a first processor (401) that performs the operation processing using the first memory (403),

[0216] The second processing circuit (40B) includes a second memory (406) and a second processor (404) that performs the operation processing using the second memory (406),

[0217] The first processor (401) writes two pieces of copy data obtained by copying object data for the operation processing to the first memory (403) when writing the object data to the first memory (403),

[0218] The second processor (404) writes two pieces of copy data obtained by copying object data for the operation processing to the second memory (406) when writing the object data to the second memory (406),

[0219] The first processor (401) reads out the object data and the two pieces of copy data from the first memory (403) before performing the operation processing, and performs the operation processing using two or more of the read object data and the two pieces of copy data in a case where the two or more are identical,

[0220] The second processor (404) reads out the object data and the two copy data from the second memory (406) before performing the operation processing, and performs the operation processing using two or more of the read object data and the two copy data in a case where the two or more are consistent.

[0221] (structure 5)

[0222] In the information processing apparatus (400) described in structure 4,

[0223] The first processor (401) overwrites, in the first memory (403), a region in which the one data is stored with one of the two data in a case where two of the read object data and the two copy data are consistent and the remaining one data is different from the two data.

[0224] The second processor (404) overwrites, in the second memory (406), a region in which the one data is stored with one of the two data in a case where two of the read object data and the two copy data are consistent and the remaining one data is different from the two data.

[0225] (structure 6)

[0226] In the information processing apparatus (400) described in structure 4 or 5,

[0227] The first processor (401) writes results of the operation processing N times to N regions (403d, 403e) of the first memory (403) that are different from each other,

[0228] The second processor (404) writes results of the operation processing N times to N regions (406d, 406e) of the second memory (406) that are different from each other,

[0229] The first processor (401) overwrites, in the first memory (403), data of a region in which a result different from the at least one first result is written with data of a region in which the at least one first result is written among the N regions (403d, 403e) of the first memory (403),

[0230] The second processor (404) overwrites, in the second memory (406), data of a region in which a result different from the at least one second result is written with data of a region in which the at least one second result is written among the N regions (406d, 406e) of the second memory (406).

[0231] (structure 7)

[0232] A control method of an information processing apparatus (400) that executes an arithmetic process, wherein

[0233] The information processing apparatus (400) includes:

[0234] a first processing circuit (40A); and

[0235] a second processing circuit (40B),

[0236] The control method has the following steps:

[0237] The first processing circuit (40A) successively executes the arithmetic process N times; and

[0238] The second processing circuit (40B) successively executes the arithmetic process N times,

[0239] N is an integer of 2 or more, and the control method further has the following step: the first processing circuit (40A) and the second processing circuit (40B) continue to act based on at least one of the first results of the arithmetic process executed N times by the first processing circuit (40A) and at least one of the second results of the arithmetic process executed N times by the second processing circuit (40B) in accordance with the at least one of the first results and the at least one of the second results, respectively

[0240] (Configuration 8)

[0241] A program, wherein the program causes a computer to execute the control method described in Configuration 7.

[0242] Embodiments of the present application have been described, but it should be considered that the embodiments disclosed this time are illustrative in all respects and are not restrictive. The scope of the present application is indicated by the claims, and it is intended to include all modifications equivalent within the scope of the claims and within the scope of the present application.

[0243] Label Explanation

[0244] 1: control system; 2: field network; 40A: A channel circuit; 40B: B channel circuit; 41A1, 41A2, 41B1, 41B2: IO program; 42A, 42B: contrast repair program; 43: read and write program; 100: standard PLC; 102, 202, 302, 401, 404: processor; 104, 204, 304, 403, 406: main memory; 108, 308: field network controller; 110, 210, 310, 410: storage; 116, 216, 316, 420: local bus controller; 118, 218, 318, 440: processor bus; 200: safety PLC; 300: coupler; 400: safety IO unit; 402, 405: register; 403a-403e, 406a-406e: area; 430: safety IO module; 1102, 2102, 3102: system program; 1104: standard control program; 1106, 2106, 3106: setting information; 2104: safety program; T1-T4: arithmetic task.

Claims

1. An information processing device that performs arithmetic processing, wherein, The information processing device has: The first processing circuit; and Second processing circuit, The first processing circuit performs the above operation N times consecutively. The second processing circuit performs the aforementioned calculation N times consecutively. N is an integer greater than or equal to 2. The first processing circuit and the second processing circuit continue to operate based on at least one first result and at least one second result, respectively, if the first result of the N operations performed by the first processing circuit is consistent with the second result of the N operations performed by the second processing circuit.

2. The information processing apparatus according to claim 1, wherein, The first processing circuit includes a first memory and a first processor that uses the first memory to perform the computational processing. The second processing circuit includes a second memory and a second processor that uses the second memory to perform the computational processing. The first processor uses N distinct regions of the first memory to perform the aforementioned operation N times. The second processor uses N distinct regions of the second memory to perform the aforementioned operation N times.

3. The information processing apparatus according to claim 2, wherein, The first processor uses data from the N regions of the first memory—the regions used in the arithmetic processes that output the at least one first result—to overwrite the data from the regions used in the arithmetic processes that output a result different from the at least one first result. The second processor uses data from the regions of the N regions of the second memory that were used in the arithmetic process that outputs at least one second result to overwrite data from the regions used in the arithmetic process that outputs a result different from the at least one second result.

4. The information processing apparatus according to claim 1, wherein, The first processing circuit includes a first memory and a first processor that uses the first memory to perform the computational processing. The second processing circuit includes a second memory and a second processor that uses the second memory to perform the computational processing. When the first processor writes the object data used for the computation to the first memory, it also writes two copies of the object data, obtained by copying the object data, to the first memory. When the second processor writes the object data used for the computation to the second memory, it also writes two copies of the object data, obtained by copying the object data, to the second memory. Before performing the computation, the first processor reads the object data and the two copied data from the first memory. If two or more of the read object data and the two copied data are consistent, the processor uses the consistent two or more data to perform the computation. Before performing the arithmetic processing, the second processor reads the object data and the two copied data from the second memory. If two or more of the read object data and the two copied data are consistent, the processor uses the consistent two or more data to perform the arithmetic processing.

5. The information processing apparatus according to claim 4, wherein, The first processor, based on the condition that two of the read object data and the two copied data are identical, and the remaining data is different from the two copied data, overwrites the area in the first memory containing the remaining data with one of the two copied data. The second processor, based on the condition that two of the read object data and the two copied data are consistent, and the remaining data is different from the two data, overwrites the area in the second memory where the remaining data is stored with one of the two data.

6. The information processing apparatus according to claim 4 or 5, wherein, The first processor writes the results of the N operations into N distinct regions of the first memory. The second processor writes the results of the N operations into N distinct regions of the second memory. The first processor uses data from the regions of the N regions of the first memory where the at least one first result has been written, to overwrite the data in the regions where a result different from the at least one first result has been written. The second processor uses data from the regions of the N regions of the second memory that have been written with the at least one second result to overwrite data from regions that have been written with a result different from the at least one second result.

7. A control method for an information processing device that performs computational processing, wherein, The information processing device includes: The first processing circuit; and Second processing circuit, The control method comprises the following steps: The first processing circuit continuously performs the aforementioned computational processing N times; and The second processing circuit performs the aforementioned calculation N times consecutively. N is an integer greater than or equal to 2. The control method further includes the following steps: the first processing circuit and the second processing circuit continue to operate based on at least one first result and at least one second result, respectively, when at least one first result from the Nth operation performed by the first processing circuit is consistent with at least one second result from the Nth operation performed by the second processing circuit.

8. A recording medium that non-volatilely stores a computer-readable program, wherein, The computer-readable program causes the computer to perform the control method of claim 7.

Images