Information processing device and management method

Abstract

Improve reliability and reduce maintenance effort. [Solution] The transmitter 1 comprises safety-related sections 21 and 31, and non-safety-related sections 22 and 32. The safety-related sections 21 and 31 are designed so that the overall safe failure rate of the circuit block including the first component exceeds a target value, and have multiple circuits that have a diagnostic section for checking the integrity of the second component, and process safety data using the circuits. The non-safety-related sections 22 and 32 process non-safety data independently of the safety-related sections.

Description

Technical Field

[0001] The present invention relates to an information processing apparatus and a management method.

Background Art

[0002] In a plant, factory, etc., a transmitter that measures pressure, flow rate, temperature, etc. used in operation and notifies the measurement result is arranged. And in a plant, factory, etc., since it is extremely important to ensure safety and reliability, the transmitters constituting the functional safety system comply with the functional safety standard. Here, functional safety means introducing functions for ensuring safety and ensuring the required level of safety.

[0003] In conventional transmitters, safety-related parts and non-safety-related parts are mixed. A safety-related part is a part that executes processing considered important for ensuring safety. Also, a non-safety-related part is a part that performs processing with little influence on safety. For example, in a transmitter, a 4-20 mA current is used to notify the measurement result, and the mechanism for outputting the 4-20 mA current is an example of a safety-related part. Also, the non-safety-related part is a part that provides an auxiliary function for the processing executed by the safety-related part, and for example, is a part that executes communication such as HART (registered trademark), a communication protocol for the process industry.

[0004] In such a configuration where safety-related parts and non-safety-related parts are mixed, even when a design change occurs in the non-safety-related part, in order to evaluate the influence on the safety-related part due to the design change, a confirmation of the impact analysis is performed. In some cases, even if a failure in the non-safety-related part affects the safety-related part and actually a failure occurs in the safety-related part, the failure may not be detected. If such situations increase, dangerous side failures that are difficult to detect in the safety-related part increase, which may prevent the high reliability of the product.

[0005] Furthermore, when using transmitters in the field, the PFDavg (Average Probability of Dangerous Failure on Demand) increases with the time of operation, according to safety instrumentation. Therefore, proof tests are regularly conducted to match the target Safety Integrity Level (SIL) at the site. In particular, proof tests are necessary to detect failures that are not detected by self-diagnosis and that hinder the transmission from executing its intended safety functions. By properly conducting proof tests, the failure rate can be kept within the target SIL. However, proof tests are costly to implement, increasing the maintenance burden during operation in addition to the maintenance burden during development.

[0006] Furthermore, a technique has been proposed to improve the reliability of functional safety by duplicating transmitters in parallel. Such duplication techniques are used not only in the installation of transmitters in plant instrumentation, but also in the design of higher-level system equipment for plant instrumentation and equipment in the automotive industry. [Prior art documents] [Patent Documents]

[0007] [Patent Document 1] Japanese Patent Application Publication No. 06-103485 [Overview of the project] [Problems that the invention aims to solve]

[0008] However, applying redundancy technology, which is used in the design of higher-level system equipment for plant instrumentation and equipment in the automotive industry, to the internal design of transmitters results in a significant increase in the number of components, making it difficult to apply to transmitters that require miniaturization.

[0009] One aspect of the present invention is to improve the reliability of the transmitter and reduce the maintenance effort. [Means for solving the problem]

[0010] The information processing device relating to one aspect comprises a safety-related section and a non-safety-related section. The safety-related section includes a plurality of circuits having either a diagnostic mechanism or a diagnostic unit that performs either a design such that the overall safe failure rate of a circuit block including a first component of the diagnostic mechanism exceeds a target value, or a check of the integrity of a second component of the diagnostic mechanism, and processes safety data using the plurality of circuits. The non-safety-related section processes non-safety data independently of the safety-related section. [Effects of the Invention]

[0011] According to the present invention, reliability can be improved and maintenance effort can be reduced. [Brief explanation of the drawing]

[0012] [Figure 1] This is a block diagram of the transmitter according to the first embodiment. [Figure 2] This is a diagram of a circuit that converts the voltage supplied from the power source to a first predetermined voltage. [Figure 3] This is a diagram of a circuit that converts a first predetermined voltage into a voltage for the diagnostic unit. [Figure 4] This is a circuit diagram for monitoring voltage in the diagnostic unit. [Figure 5] This flowchart shows the safety design and operation during voltage failures. [Figure 6] This figure shows an example of a circuit block with a diagnostic function for the communications unit. [Figure 7] This figure shows examples of FMEA for component failures and FMEA for functional failures. [Figure 8] This diagram shows the details of the digital section's redundancy. [Figure 9] This diagram shows the processing of output signals from sensors. [Figure 10] This diagram shows the effects of the transmitter according to the first embodiment. [Figure 11]It is a block diagram showing an example of a communication device according to the second embodiment.

Embodiments for Carrying Out the Invention

[0013] Hereinafter, embodiments of an information processing apparatus and a management method will be described while referring to the drawings. Note that the same elements are denoted by the same reference numerals, and redundant descriptions are omitted as appropriate. Also, the respective embodiments can be combined as appropriate within a range without contradiction.

[0014] (First Embodiment) (Overall Configuration) FIG. 1 is a block diagram of a transmitter according to the first embodiment. As shown in FIG. 1, the transmitter 1 has a sensor module 11, an indicator module 12, a main module 13, and a power supply 14. The transmitter 1 measures temperature, pressure, etc., and outputs the measurement results to a control device or the like. This transmitter 1 corresponds to an example of an "information processing apparatus". The power supply 14 supplies power directly or indirectly to each of the sensor module 11, the indicator module 12, and the main module 13.

[0015] Here, as routes to hardware safety level water adaptation, two routes exist as standards. One is the response based on hardware fault tolerance and the safe-side failure rate. The other is the response by implementing fault tolerance regarding a reliability level of 90% or more and a specified safety level using component reliability data based on feedback from end users. Here, attention is paid to achieving the target SIL by improving the safe-side failure rate.

[0016] The sensor module 11 acquires information on physical quantities such as the measured process pressure. Then, the sensor module 11 transmits a sensor signal indicating the acquired physical quantity to the main module 13.

[0017] The indicator module 12 is a module that displays the output results and parameter values of the main module 13. In addition, the indicator module 12 gives instructions such as parameter settings input by the user to the main module 13.

[0018] The main module 13 acquires the physical quantities obtained by the sensor module 11. Then, the main module 13 performs a predetermined calculation using the acquired physical quantities and outputs the calculation result to an external device. The details of each module will be described below.

[0019] (Configuration for each module) The indicator module 12 has an MCU 121 and an LCD (Liquid Crystal Display) panel 122. In addition, the indicator module 12 may have a switch for data input and other input mechanisms (not shown).

[0020] The MCU 121 controls the overall operation of the indicator module 12. For example, the MCU 121 receives the output results and parameter values sent from the main module 13. Then, the MCU 121 causes the LCD panel 122 to display information according to a predetermined format. In addition, the MCU 121 acquires information such as parameter settings input using the input mechanism and transmits it to the main module 13.

[0021] The LCD panel 122 displays information such as parameter settings according to the instructions of the MCU 121. In addition, the display content of the LCD panel 122 can also be set by the MCU 132 described later.

[0022] The main module 13 has a clock 130, a clock 131, an MCU 132, a field communication unit 133, an MCU 134, a DA converter 135, a diagnostic unit 136, a communication unit 137, a diagnostic unit 138, and a power supply circuit 139.

[0023] The MCU132 operates based on clock 130. The MCU132 performs processing such as digital communication with a controller (not shown) regarding non-safety data that does not affect safety.

[0024] Data that has little impact on safety is data that is not related to the calculation of process values, etc., such as "communication settings" data that indicates the settings for communication with the controller, and "display settings" data that indicates the display settings of the LCD panel 122. For example, the MCU 132 receives non-safe data that has little impact on safety, such as "communication settings" data and "display settings" data. Then, the MCU 132 executes instructions to the field communication unit 133 to change the communication settings or to the MCU 121 to change the display settings of the LCD panel 122, depending on the acquired data. The MCU 132 may also relay communication between the MCU 134 and the MCU 121. For example, if the MCU 132 relays communication between the MCU 134 and the MCU 121, it is preferable to design the interface to be safe.

[0025] The field communication unit 133 transmits non-safe data processed by the MCU 132 to a controller (not shown) via the communication unit 137, according to the transmission settings. A capacitor is provided between the field communication unit 133 and the communication unit 137. The field communication unit 133 is coupled by the capacitor and isolated from the functions that process safe data by the MCU 134, DA converter 135, and communication unit 137. This makes it less likely for the MCU 134 and DA converter 135 to be affected by failures in the circuits that process non-safe data by the MCU 132 and the field communication unit 133. Therefore, the impact of failures in the functions that handle non-safe data on functions that handle safe data such as the MCU 134 can be reduced, and the reliability of the transmitter 1 can be improved.

[0026] The MCU134 operates based on the clock 131. The MCU134 primarily performs periodic processing. In this embodiment, as an example, the periodic processing may include the process of calculating process values ​​from measurement data acquired by the sensor module 11.

[0027] For example, the MCU134 acquires measurement data from the MCU115 of the sensor module 11. The MCU134 then converts the measurement data into process values. Specifically, the MCU134 can calculate process values ​​from the values ​​of the measurement data using pre-stored "sensor constant" data. For example, the MCU134 can calculate process values ​​by multiplying the values ​​of the measurement data by sensor constants. In this embodiment, this measurement data is, as an example, safety data that is important for safety. The MCU134 then outputs the process values ​​to the DA converter 135. The MCU134 also outputs the process values ​​to the communication unit 137.

[0028] Furthermore, the MCU134 may perform non-periodic processing. Non-periodic processing is processing performed in response to requests from external controllers (not shown). Examples of non-periodic processing include processing to read data from memory and processing to write data to memory. For example, the MCU134 may read and write safety data important for safety, such as "range setting" data, "calibration" data, and "sensor constant" data, to memory (not shown).

[0029] The DA converter 135 receives process values ​​as input from the MCU 134. The DA converter 135 then converts the acquired process values ​​from analog signals to digital signals. Finally, the DA converter 135 outputs the converted digital process values ​​to the communication unit 137.

[0030] Furthermore, the DA converter 135 has a watchdog timer 140 for the MCU 134. The DA converter 135 monitors the operating status of the MCU 134 using the watchdog timer 140. However, the diagnostic function of the MCU 134 using the watchdog timer may be implemented on a separate IC instead of being integrated into the DA converter 135.

[0031] The diagnostic unit 136 performs a diagnosis of the operating status of the MCU 134. For example, the diagnostic unit 136 monitors the input and output of GPIO (General Purpose Input Output) to check the progress of processing of the MCU 134. If the diagnostic unit 136 determines that an abnormality has occurred in the progress, it detects a failure in the MCU 134. The diagnostic unit 136 outputs the diagnostic result to the communication unit 137.

[0032] In this way, the diagnostic function of the diagnostic unit 136 is separated from the function of the MCU 134. This reduces the impact of a malfunction in the MCU 134 on the MCU 134's diagnostic function, improving the reliability of the MCU 134's diagnosis and thus improving the reliability of the transmitter 1. It should be noted that the diagnostic unit 136 can also be considered as a single circuit in combination with the MCU 134 being diagnosed.

[0033] The power supply circuit 139 receives power from the power supply 14. The power supply circuit 139 then supplies power to drive the clock 130, clock 131, MCU 132, field communication unit 133, MCU 134, DA converter 135, diagnostic unit 136, and communication unit 137, etc. The power supply circuit 139 also supplies power to the power supply circuit 118 of the sensor module 11.

[0034] The diagnostic unit 138 diagnoses the state of the power supply circuit 139 and detects any abnormalities. If the diagnostic unit 138 detects an abnormality in the power supply circuit 139, it outputs an alert to the communication unit 137. The diagnostic unit 138 outputs an alert to the MCU 134 according to the type of abnormality. Note that the diagnostic unit 138 can also be considered as a single circuit in combination with the power supply circuit 139 being diagnosed.

[0035] The diagnostic unit 138 is designed to allow for verification of its integrity. The design of the diagnostic unit 138 is described below. Here, the components constituting the diagnostic unit 138 are classified into Type A components and Type B components. Type A components are single-function components such as resistors and capacitors, and are components whose failure modes can be defined and analyzed. Type B components, on the other hand, are components such as ICs, whose failure modes are complex and difficult to define and analyze.

[0036] To maintain integrity, there are two approaches: either use a design that satisfies the functional safety target SIL regardless of the failure mode, or monitor integrity and respond when a failure is detected. Therefore, for Type A components, we will use a design that satisfies the functional safety target SIL regardless of the failure mode. For Type B components, we will use the method of monitoring integrity and responding when a failure is detected.

[0037] For example, for Type A components, all failure modes are comprehensively listed. Then, regardless of the failure mode, the design ensures that the design value meets the functional safety target SIL, thereby improving reliability without direct diagnostic testing. For example, if the target SIL is SIL2, which is the standard for high reliability, for Type B components where DC=60% and SFF>90% does not exceed, a design is used where the SFF exceeds 90% at the element level of the surrounding circuit, including Type A components whose failure modes have been analyzed, in addition to the Type B component itself.

[0038] Let's explain an example of SFF calculation. For example, if the target SIL is SIL2, an SFF > 90% is required. To achieve this, a DC > 90% is needed, which results in an SFF of 95%. To achieve DC > 90%, detecting relatively easy seizure faults is insufficient; it is necessary to detect drift faults in components, which require complex diagnostics.

[0039] Here, DC (Diagnostic Coverage) is the self-diagnosis rate. Safety-related failures can be classified into safe-side failures and dangerous-side failures. Safe-side failures are those that cause the End-User Computing (EUC), etc., to enter a safe state due to a malfunction of the safety function. Dangerous-side failures are those that prevent the operation of the safety function. DC is a parameter that indicates the probability of detecting a dangerous-side failure. DC can be classified into 60%, 90%, and 99% depending on the diagnostic method. This classification is based on IEC 61508-2:2010. This classification categorizes the coverage rate at which faults can be detected using diagnostic methods, with 60% being "Low," 90% being "Medium," and 99% being "High." When DC > 60%, SFF = 80%. Similarly, when DC > 90%, SFF = 95%.

[0040] SFF is the safe failure rate, representing the proportion of a system or subsystem that will experience safe failures. SFF is expressed by the formula SFF = (λSD + λDD + λSU) / λ, where λ is the failure rate of the component. λ includes the safe failure rate λS and the critical failure rate λD. λSU is the undetectable safe failure rate, λSD is the detectable safe failure rate, λDU is the undetectable critical failure rate, and λDD is the detectable critical failure rate. DC can be expressed using λD and λDD, and represents the percentage of λD allocated to λDD.

[0041] For example, if the overall failure rate is 200, λS and λD can be divided into 100 and 100. If DC = 60%, then the 100 in λD can be divided into λDD and λDU, resulting in 60 and 40. In this case, SFF = (100 + 60) / 200 = 80%. Therefore, a Type B component with DC = 60% will not satisfy SFF > 90%. Thus, for a Type B component with DC = 60%, a design is used in which the SFF is greater than 90% at the element level of the surrounding circuit, including the Type A component whose failure mode has been analyzed in addition to the Type B component itself.

[0042] Thus, in this embodiment, the diagnostic unit 138 performs detection of seizure failures for Type B components. As a result, Type B components have a DC of 60%, which is unreliable. However, the diagnostic unit 138 also analyzes surrounding components, and the circuit block is designed so that SFF > 90%. This makes it possible to obtain sufficient reliability with relatively simple detection of seizure failures without performing complex drift detection.

[0043] For Type B components, their integrity is checked using methods such as those described below. Figure 2 shows a circuit that converts the voltage supplied from the power supply to a first predetermined voltage. Figure 3 shows a circuit that converts the first predetermined voltage to a voltage for the diagnostic unit. Figure 4 shows a circuit that monitors the voltage for the diagnostic unit.

[0044] Here, the voltage supplied from the power supply 14 to the power supply circuit 139 is denoted as voltage V1. The voltage after conversion by the power supply circuit 139 is denoted as voltage V2. The voltage for the diagnostic unit 138 is denoted as voltage V3.

[0045] Voltage V1 is converted to voltage V2 by circuit 141 shown in Figure 2. Voltage V2 is clamped by diode D1, which reduces the voltage on the high side in the event of a fault.

[0046] Furthermore, voltage V2 is converted to voltage V3 by circuit 142 shown in Figure 3. That is, circuit 142 generates voltage V3 using the clamped voltage V2. This voltage V3 is also clamped by the Zener diode D4, which clamps the high voltage in the event of a fault.

[0047] Then, voltage V3 is input to circuit 143 shown in Figure 4. The input voltage V3 is diagnosed by monitoring IC component U1, and based on the result of the monitoring IC component U1's determination, the FET switch (Field Effect Transistor) Q1 is turned on or off, and the subsequent voltage V4 is output. This monitoring IC component U1 is an example of a type B component.

[0048] In the context of the power supply block, the FET switch Q1 is used for a single function: to switch the subsequent voltage V4 on or off. Therefore, it is considered sufficient to analyze the failure mode for the target SIL, and it is used without further diagnosis. In other words, in the case of a failure where the subsequent voltage V4 turns on, only the diagnostic function is lost, and the power supply remains healthy, so it continues to operate in a normal state. On the other hand, in the case of a failure where the subsequent voltage V4 turns off, the monitoring IC component U1 is determined to be abnormal, and the system transitions to a safe state.

[0049] In functional safety, it is sufficient to maintain a safe state in the event of one fault (see IEC61508-2 7.4.2). If the power remains on due to a failure in the monitoring IC component U1, the diagnostic function for monitoring the monitoring IC component U1 is lost, but other functions are considered to be intact. That is, the diagnostic unit 138 is not operating normally, but the power supply circuit 139 is operating normally. Therefore, in this case, it is considered a single fault, and normal operation can continue without affecting the safety function. Thus, the reliability of the safety function can be judged to be high. For example, although V3 is made up of V2, it is clamped by the Zener diode D4, so even if a fault occurs that causes the voltage of V3 to become high, the upper limit voltage is limited. Since this upper limit voltage falls within the recommended operating voltage of the monitoring IC component U1 that operates using V3, the monitoring IC component U1 can continue to operate.

[0050] In contrast, in the case of a failure in the monitoring IC component U1 that results in a power-off, the power supply from the voltage being diagnosed onward is turned off. Therefore, this failure is detected by a diagnosis that checks operations other than power monitoring, and for example, the output of the communication unit 137 can transition to a safe state. Thus, the diagnostic unit 138 is designed so that even without diagnosing the monitoring IC component U1, which is a type B component, the subsequent voltage V4 is turned on or off depending on the failure that may occur due to that component, and the system can transition to a safe state in that failure mode. Because the system uses the FET switch Q1 to turn the subsequent voltage V4 on and off, the diagnostic unit 138 can maintain a safe state even if the monitoring IC component U1 has a drift output such as an intermediate potential failure.

[0051] Furthermore, the reliability of the diagnostic unit 138 itself can be improved with the following design. The power supply for the monitoring IC component U1 that diagnoses V3 is the same as that of the power supply V3 being monitored, and is not independent of the power supply being diagnosed. However, because the V3 output is clamped with a clamp voltage, the monitoring IC component U1 can operate within the recommended operating voltage range in the event of an overvoltage.

[0052] Furthermore, even at low voltages, the monitoring IC component U1 has a wider operating range than the monitored object, so the monitoring IC component U1 can detect low voltages. In addition, the monitoring IC component U1 continuously monitors V3, and even in the event of a power loss, it can detect a fault because it passes the detection threshold before going outside its operating range.

[0053] Figure 5 is a flowchart illustrating the operation of the safety design during a voltage fault. Now, referring to Figure 5, we will explain the operation flow of the safety design during a voltage fault.

[0054] In the diagnostic unit 138, a power supply failure for V3 occurs (step S1).

[0055] The operation branches depending on whether or not there is a fault causing the power supply voltage of V3 to become high (step S2).

[0056] In the event of a fault where the power supply voltage of V3 becomes too high (Step S2: Affirmative), the operation branches depending on whether the power supply voltage of V3 exceeds the maximum rating of the monitoring IC component U1 (Step S3).

[0057] If the power supply voltage of V3 is greater than or equal to the maximum rating of the monitoring IC component U1 (step S3: affirmative), the output of V3 is clamped at the upper limit of the recommended operating voltage for subsequent components, including the monitoring IC component U1 (step S4).

[0058] In this case, the fault is a single fault, and the voltage value of V3 will not exceed the maximum rating of the subsequent component, so the diagnostic unit 138 continues to operate (step S5).

[0059] On the other hand, if the voltage of the V3 power supply is less than the maximum rating of the monitoring IC component U1 (step S3: negative), the operation branches depending on whether the voltage of the V3 power supply is equal to or greater than the recommended upper limit of the monitoring IC component U1 (step S6).

[0060] If the power supply voltage of V3 is above the recommended upper limit of the monitoring IC component U1 (step S6: affirmative), the monitoring IC component U1 diagnoses V3 with a voltage within the recommended operating voltage range and detects an overvoltage fault (step S7).

[0061] In this case, the diagnostic unit 138 transitions to a safe state (step S8).

[0062] In contrast, if the voltage of the V3 power supply is below the recommended upper limit of the operating voltage for the monitoring IC component U1 (step S6: negative), the diagnostic unit 138 proceeds to step S12.

[0063] On the other hand, in the case of a fault where the power supply voltage of V3 becomes low (step S2: negative), the operation branches depending on whether the power supply voltage of V3 falls below the recommended lower limit of the operating voltage of the monitoring IC component U1 (step S9).

[0064] If the power supply voltage of V3 falls below the recommended lower limit of the operating voltage of the monitoring IC component U1 (Step S9: Affirmative), the monitoring IC component U1 diagnoses V3 at a voltage within the recommended operating voltage range and detects an undervoltage fault (Step S10).

[0065] In this case, the diagnostic unit 138 transitions to a safe state (step S11).

[0066] In contrast, if the voltage of the V3 power supply is greater than or equal to the recommended lower operating voltage limit of the monitoring IC component U1 (step S9: negative), the diagnostic unit 138 proceeds to step S12.

[0067] If the power supply voltage of V3 is below the recommended upper limit of the monitoring IC component U1's operating voltage (step S6: negated) or above the recommended lower limit of the monitoring IC component U1's operating voltage (step S9: negated), then V3 is within the recommended operating voltage range of the monitoring IC component U1 (step S12).

[0068] Therefore, the diagnostic unit 138 continues normal operation (step S13).

[0069] Furthermore, a failure in the power supply circuits 118 and 139, which are commonly used within the transmitter 1, could result in a common-cause failure where multiple functions of the transmitter 1 fail for the same reason. Since a common-cause failure directly leads to the shutdown of the transmitter 1, it is preferable to avoid it. Therefore, in the transmitter 1 according to this embodiment, the diagnostic units 117 and 138 are designed so that a failure in the power supply circuits 118 and 139 does not lead to a common-cause failure.

[0070] Furthermore, a diagnostic check for health verification may be performed on the diagnostic function of the Type B component. For example, a signal simulating a fault may be input to the diagnostic unit 138, separate from the actual signals in actual operation that are being monitored, to check the operation of the Type B component being diagnosed and detect a fault. This makes it possible to verify the health of the Type B component being diagnosed to ensure that it will function normally when needed.

[0071] For example, let's consider the case where a diagnostic check is performed to verify the health of the monitoring IC component U1. In this case, the diagnostic unit 138 is designed to be able to switch between the system power supply voltage and a fault simulation voltage as its input. When the system power supply voltage is input to the diagnostic unit 138, it operates normally. When it switches to test mode and the fault simulation voltage is input to the diagnostic unit 138, the MCU 134 or the like confirms that the output of the diagnostic unit 138 can notify a fault condition. If it is confirmed that the output of the diagnostic unit 138 can notify a fault condition, it is confirmed that the monitoring IC component U1 is healthy. After confirming the health of the monitoring IC component U1, which reacts normally when a fault occurs, the diagnostic unit 138 returns to normal operation.

[0072] Returning to Figure 1, let's continue the explanation. The communication unit 137 communicates with a controller (not shown). The communication unit 137 transmits a digital signal indicating the process value input from the DA converter 135 to the controller. The communication unit 137 also transmits an analog signal indicating the process value input from the MCU 134 to the controller. The communication unit 137 also transmits the diagnostic results of the MCU 134 input from the diagnostic unit 136 to the controller. The communication unit 137 also transmits alerts input from the diagnostic unit 138 to the controller. Furthermore, the communication unit 137 relays communication between the field communication unit 133 and the controller.

[0073] The communication unit 137 has an internal diagnostic function and performs output circuit fault detection. Furthermore, the diagnostic function of the communication unit 137 performs analysis not only on the diagnostic component but also on the surrounding components, and is designed so that the circuit block including the surrounding components satisfies SFF > 90%. This makes it possible to ensure the reliability of the communication unit 137 by performing relatively easy detection of stuck faults without performing complex drift detection on the diagnostic component of the communication unit 137.

[0074] Figure 6 shows an example of a circuit block having a diagnostic function for the communication unit. Circuit 200 in Figure 6 is a circuit that has a diagnostic function for the communication unit 137. Output circuit fault detection is performed by the diagnostic component 201 in circuit 200. This diagnostic component 201 has difficulty detecting drift and detects a stuck fault, remaining at DC=60%. Diagnostic component 201 is a type B component. Therefore, reliability is improved by designing the entire circuit block 202, including peripheral components, to satisfy SFF>90%.

[0075] Let's return to Figure 1 and continue the explanation. Here, the clock 131, MCU 134, DA converter 135, diagnostic unit 136 and communication unit 137, diagnostic unit 138 and power supply circuit 139 constitute the safety-related unit 31. The clock 130, MCU 132 and field communication unit 133 constitute the non-safety-related unit 32. In this embodiment, we have described the case where the safety-related unit 31 and the non-safety-related unit 32 operate using different clocks 130 and 131, but these clocks can be unified.

[0076] The safety-related unit 31 is a block that performs safety-critical processing using safety-critical data. Safety-critical processing performed by the safety-related unit 31 includes, for example, processing to acquire measurement results from the sensor module 11, processing to convert the measurement results from the sensor module 11 into process values, and processing to transmit safety data including process values. The safety data is, for example, data indicating process values ​​using a "4~20mA" signal.

[0077] In contrast, the non-safety related unit 32 is a block that performs processing with minimal impact on safety using non-safety data that does not affect safety. Examples of processing with minimal impact on safety performed by the non-safety related unit 32 include digital communication processing related to non-safety data such as "communication settings" data and "display settings" data performed with a controller (not shown).

[0078] In this way, the main module 13 is separated into a safety-related unit 31 that processes safety data and a non-safety-related unit 32 that processes non-safety data. This reduces the impact of failures in the non-safety-related unit 32 on the processing of the safety-related unit 31, improves the operational continuity of the safety-related unit 31, and enhances the reliability of the transmitter 1.

[0079] The sensor module 11 includes a clock 111, a diagnostic clock 112, a digital section 113 and an analog section 114 in the driver circuit, an MCU (Micro Computing Unit) 115, a sensor 116, a diagnostic section 117, and a power supply circuit 118. In addition, the sensor module 11 also includes mechanical parts such as a pressure receiving section and a sealing fluid (not shown).

[0080] In the sensor module 11, the clock 111, digital section 113 and analog section 114, MCU 115, sensor 116, diagnostic section 117, and power supply circuit 118 constitute the safety-related section 21. In addition, the diagnostic clock 112 constitutes the non-safety-related section 22.

[0081] Sensor 116 is a type of sensor, such as a differential pressure level sensor or a temperature sensor. If sensor 116 is a differential pressure level sensor, it measures the process pressure and obtains information about the process pressure.

[0082] The analog section 114 is an oscillation circuit component that drives the silicon vibration sensor according to the measurement result from the sensor 116, causing it to continue oscillating. The analog section 114 outputs the oscillating square wave signal to the digital section 113. For example, the analog section 114 outputs a signal with a waveform corresponding to the measurement result of the process pressure from the sensor 116. The analog section 114 also outputs a signal with a waveform corresponding to the measurement result of the temperature from the sensor 116.

[0083] Here, for components in the analog section 114 where drift failure is difficult to detect, a failure analysis using FMEA (Failure Mode and Effects Analysis) is performed to confirm that they are safe, thereby verifying the integrity of the diagnostic function.

[0084] Figure 7 shows examples of FMEA for component failure and FMEA for functional failure. Table 211 shows an example of FMEA for component failure. Table 212 shows an example of FMEA for functional failure.

[0085] For components in the analog section 114 where drift failure is difficult to detect, FMEA for various component failures as shown in Table 211 is performed. In addition, for components in the analog section 114 where drift failure is difficult to detect, FMEA for various functional failures as shown in Table 211 is performed.

[0086] For example, as shown in Table 211, if component A of block A, which is a predetermined circuit, is in failure mode A, it can be detected within a safe accuracy. Also, in the case of failure mode B, it can be detected within a safe accuracy based on the diagnostic results, and for some parts that cannot be detected, the diagnostic rate DC can be set to 83% under predetermined conditions. Here, predetermined conditions include, for example, when the failure mode B of component A involves a part where 6 pins are affected by the failure, and the failure of 5 pins can be detected. Also, in the case of failure mode C, FMEA for functional failure is referenced. For component B of block B, in the case of failure modes A and B, as well as other failures, the failure can be detected by the failure diagnostic function of each part, and therefore it can be detected within a safe accuracy based on the diagnostic results.

[0087] The digital section 113 is an integrated circuit component of a digital circuit that uses the clock 111 to perform frequency counting of the square wave output by the analog section 114. The digital section 113 also has diagnostic functions such as a watchdog timer for the MCU 115 that operates based on the diagnostic clock 112. However, the diagnostic function using the MCU 115's watchdog timer may be implemented in a separate IC (Integrated Circuit) instead of being integrated into the digital section 113.

[0088] Furthermore, the reliability of the digital unit 113 is improved by the duplication of its internal blocks. Figure 8 shows the details of the duplication of the digital unit. As shown in Figure 8, the digital unit 113 includes a differential pressure counter 301, a register 302, a temperature counter 303, and a communication interface 307. The digital unit 113 may also include a frequency divider and a reset signal filter, etc., which are not shown. In addition, the digital unit 113 is further duplicated by providing a diagnostic differential pressure counter 304, a diagnostic register 305, and a diagnostic temperature counter 306, with each of these blocks being duplicated.

[0089] The differential pressure meter 301 measures the frequency of the waveform corresponding to the measurement result of the process pressure output from the analog unit 114. The differential pressure meter 301 then stores the measurement result in the register 302.

[0090] The differential pressure meter 304 performs frequency measurement according to the process pressure measurement result output from the analog unit 114 and stores the measurement result in the register 305. Then, the differential pressure meter 304 compares its own measurement result with the measurement result of the differential pressure meter 301 to detect a malfunction in the differential pressure meter 301.

[0091] The temperature meter 303 performs frequency counting of the waveform corresponding to the temperature measurement result output from the analog unit 114. The differential pressure meter 301 then stores the count value in the register 302.

[0092] The temperature counter 306 performs frequency counting of the waveform corresponding to the temperature measurement result output from the analog unit 114 and stores the count value in the register 305. Then, the temperature counter 306 compares its own count value with the count value from the temperature counter 303 to detect a malfunction in the temperature counter 303.

[0093] The communication interface 307 communicates with the communication interface 51 of the MCU 115 to send and receive data. For example, the communication interface 307 sends to the communication interface 51 the measurement results of the frequency measurement of the waveform corresponding to the process pressure measurement result stored in the register 302, and the count value obtained by frequency counting of the waveform corresponding to the temperature measurement result. The communication interface 307 may also send to the communication interface 51 diagnostic results for the differential pressure meter 301 and diagnostic results for the temperature meter 303.

[0094] The MCU115 provides overall control over the operation of the sensor module 11. Furthermore, the MCU115 transmits the results of the frequency count performed by the digital unit 113 to the main module 13.

[0095] The power supply circuit 118 receives power from the power supply 14 via the main module 13. The power supply circuit 118 then supplies power to the digital section 113, the analog section 114, the MCU 115, and the sensor 116, etc., to drive them.

[0096] The diagnostic unit 117 diagnoses the state of the power supply circuit 118 and detects abnormalities. If the diagnostic unit 117 detects an abnormality in the power supply circuit 118, it issues an alert. For this diagnostic unit 117, the Type B component is designed to satisfy SFF > 90% as a whole, including peripheral circuits including Type A, similar to the diagnostic unit 138. Also, similar to the diagnostic unit 138, the Type B component is checked for integrity and corrected if a fault is detected. Furthermore, the Type B component of the diagnostic unit 117 may also undergo a integrity check. Note that the diagnostic unit 117 can also be considered as a single circuit in combination with the power supply circuit 118 being diagnosed.

[0097] In the sensor module 11, the signal is transmitted from the sensor 116 to the MCU 115 via the analog section 114 and the digital section 113. In this path, the digital section 113, the analog section 114, and the MCU 115 are each equipped with diagnostic functions.

[0098] Figure 9 shows the processing of output signals from the sensor. For example, signal processing and health check diagnostics are performed in the sensor module 11 as follows.

[0099] The sensor 116 and the analog unit 114 generate a pressure sensor signal (step S101). The sensor 116 and the analog unit 114 also generate a temperature sensor signal (step S102).

[0100] When the pressure sensor signal is abnormally oscillating, the analog unit 114 detects the abnormality using a diagnostic function that has a drift detection function and a frequency detection function, and notifies the digital unit 113 of the abnormality detection (step S103). Here, the drift detection function in the analog unit 114 detects abnormalities by the following mechanism. The drift detection function is realized by the sensor 116, the clock 111, and an amplitude diagnostic circuit for diagnosing faults in the clock 111. The amplitude diagnostic circuit for diagnosing faults in the clock 111 includes, for example, an amplitude detection circuit, an error amplifier, and an amplitude error detection circuit. The frequency of the sensor 116 and the clock 111 changes when the output amplitude changes, as shown by the equation Δf = A * B. Here, Δf is the frequency fluctuation, A is a coefficient, and B is a function of the output amplitude. In other words, abnormality detection is performed by drift detection by detecting the amplitude fluctuation.

[0101] The digital unit 113 checks for an abnormal condition, holds a signal indicating the abnormal condition, and transmits the held abnormal condition signal to the MCU 115 (step S104). The MCU 115 uses the abnormal condition signal to perform an abnormal condition diagnosis (step S105).

[0102] Furthermore, the digital unit 113 performs frequency measurement processing of the pressure sensor signal and transmits the measurement result to the MCU 115 (step S106). The MCU 115 performs differential pressure count value determination processing using the measurement result (step S107).

[0103] Furthermore, if a temperature sensor frequency abnormality occurs, the digital unit 113 performs pulse count processing and transmits the count value to the MCU 115 (step S108). The MCU 115 uses the count value to perform temperature count value determination processing (step S109).

[0104] (effect) As described above, the transmitter 1 according to this embodiment is separated into safety-related units 21 and 31, which include a function for processing safety data such as a current of 4-20mA that notifies the measurement result, and non-safety-related units 22 and 32 that process non-safety data.

[0105] Furthermore, the digital unit 113, analog unit 114, MCU 115, and diagnostic unit 117 included in the safety-related unit 21 are each equipped with a fault diagnosis function. In addition, the field communication unit 133 is coupled with a capacitor and isolated from the communication unit 137. As a result, the safety-related units 21 and 31 are less affected by the operating state of the non-safety-related units 22 and 32, improving their reliability.

[0106] Furthermore, each of the safety-related components 31, including the MCU 134, DA converter 135, diagnostic unit 136, communication unit 137, and diagnostic unit 138, is equipped with a fault diagnosis function. In particular, GPIO fault diagnosis is used for diagnosing the MCU 134, and since the fault diagnosis function is separated from the operation of the MCU 134, fault diagnosis can be performed without being affected by the operating state of the MCU 134.

[0107] In particular, for the sensor module 11, the sensor 116, analog unit 114, digital unit 113, and diagnostic unit 117 are designed to increase the safe failure rate by considering not only the individual components but also the surrounding blocks, thereby suppressing the occurrence of undetectable critical failures and ensuring high reliability. Similarly, in the main module 13, each block, including the diagnostic unit 138 and communication unit 137, is designed to increase the safe failure rate by considering not only the individual components but also the surrounding blocks, thereby suppressing the occurrence of undetectable critical failures and ensuring high reliability. This safety design, including self-diagnostic functions, allows undetectable critical failures to be treated as detectable critical failures, enabling the system to understand its own failure status. Furthermore, the digital unit 113 is made more reliable by duplicating its internal blocks.

[0108] Furthermore, the diagnostic units 117 and 138, which diagnose the power supply, are designed to prevent multiple functions from failing due to a common cause failure in the power supply commonly used inside the transmitter 1, i.e., a common cause failure. In addition, the diagnostic units 117 and 138 also verify the integrity of their respective diagnostic functions.

[0109] As a result of the enhanced reliability described above, transmitter 1 reduces the occurrence of dangerous failures that are difficult to detect throughout the entire product, and eliminates the need to perform proof tests to lower the mean probability of dangerous function failure (PFDavg) at the time of operation request. Therefore, transmitter 1 can achieve maintenance-free operation throughout its product lifecycle. In addition, the number of components can be reduced, resulting in a smaller mounting area and lower costs.

[0110] Figure 10 shows the effect of the transmitter according to the first embodiment. Graphs 401 and 402 show the probability of failure on the vertical axis and the passage of time on the horizontal axis. The unit of the horizontal axis is "years". Line 411 in graph 401 and line 412 in graph 402 are target values ​​for suppressing the probability of failure, respectively.

[0111] For example, if the fit (Failure In Time) value of a dangerous failure that is difficult to detect is 100, the target value will be exceeded within 10 years unless proof testing is performed, as shown in Graph 401. Here, fit is a unit that represents the failure rate, and is the number of failures per 10 to the power of 9 hours.

[0112] In contrast, the transmitter 1 according to this embodiment can achieve a fit value of 50 through increased reliability. In this case, the probability of failure occurring within the target value for 16 years can be suppressed without conducting proof tests. In other words, if the product life of the transmitter 1 is within 16 years, it can be used safely without conducting proof tests.

[0113] As described above, the transmitter 1, which is an information processing device, has safety-related units 21 and 31, and non-safety-related units 22 and 32 that process non-safety data independently of the safety-related units 21 and 31. The sensor module 11 is an example of a "first module," and the safety-related unit 21 is an example of a "first safety-related unit." The main module 13 is an example of a "second module," and the safety-related unit 31 is an example of a "second safety-related unit."

[0114] Furthermore, each of the components included in the safety-related section 21, such as the clock 111, digital section 113, analog section 114, and MCU 115, is an example of "multiple circuits," and each has a diagnostic mechanism for detecting its own failure. Similarly, each of the components included in the safety-related section 21, such as the clock 131, MCU 134, DA converter 135, diagnostic section 136, and communication section 137, is also an example of "multiple circuits," and each has a diagnostic mechanism for detecting its own failure. Each of the multiple circuits has either a design such that the overall safe failure rate of the circuit block, including the first component of the diagnostic mechanism, exceeds a target value, or a diagnostic section that performs a check of the integrity of the second component of the diagnostic mechanism, or both.

[0115] For example, the Type A component that makes up the diagnostic unit 138 is an example of a "first component." Also, for example, the diagnostic component 201 in the circuit 200 of Figure 6, the component in the analog unit 114 that is difficult to detect drift faults in, and the monitoring IC component U1 of the diagnostic unit 117 are examples of "second components." Furthermore, the component that combines the sensor 116, analog unit 114, digital unit 113, and MCU 115, which has a sensor signal diagnostic function in the sensor module 11, is also an example of a "second component." The diagnostic mechanism is a mechanism that includes first and second components and is a mechanism that detects faults by diagnosing each part of the safety-related units 21 and 31. More specifically, the diagnostic unit 117, the diagnostic unit 136, and the diagnostic unit 138 are examples of the diagnostic mechanism.

[0116] Furthermore, the first component may be a component whose failure modes can be defined and analyzed. The second component may be a component whose failure modes are difficult to define and analyze. The second component may also have a self-diagnosis rate that does not achieve the target value. If the target value is not achieved, the circuit block including the second component is considered as an element, and the overall safe failure rate is designed to exceed the target value by analyzing the self-diagnosis rate of the second component in addition to the analysis of the components other than the first component included in the circuit block.

[0117] Furthermore, the MCU134 is an example of a "control circuit." The diagnostic mechanism then monitors the input and output of the control circuit to diagnose faults.

[0118] Furthermore, diagnostic units 117 and 138 each monitor the operation of the power supply circuit 118 or 139 and control it to prevent simultaneous failures in some of the other circuits. Here, the clock 111, digital unit 113, analog unit 114, and MCU 115 for the power supply circuit 118 are examples of "other circuits." Similarly, the clock 131, MCU 134, DA converter 135, diagnostic unit 136, and communication unit 137 for the power supply circuit 139 are also examples of "other circuits."

[0119] Furthermore, the monitoring IC component U1 of the diagnostic unit 117 is an example of a "diagnostic component." Also, V2 shown in Figure 3 is an example of a "first power supply," and V3 is an example of a "second power supply." The diagnostic unit 117 has a diagnostic component that performs fault diagnosis of the power supply circuit 118, and generates a second power supply for the diagnostic component to perform fault diagnosis based on the first power supply input from the power supply circuit 118. If a fault occurs in which the voltage of the second power supply becomes high due to a voltage abnormality in the first power supply, and the voltage of the second power supply is above the maximum rating of the diagnostic component, the diagnostic unit 117 fixes the output voltage of the diagnostic component to the upper limit of the recommended operating voltage of the subsequent component.

[0120] Furthermore, the first safety-related unit includes a diagnostic unit 117, which is a diagnostic circuit that diagnoses faults in the analog unit 114, which is an analog processing circuit, and the digital unit 113, which is a digital processing circuit. The diagnostic unit 117 verifies the integrity of components for which drift fault detection is difficult by performing FMEA failure analysis. The digital processing circuit may also be redundant.

[0121] Furthermore, the communication unit 137 is an example of a "first communication unit," and the field communication unit 133 is an example of a "second communication unit." In other words, the non-safety related unit 32 transmits and receives non-safety data to and from an external device, the controller, via the communication unit 137, and has a field communication unit 133, which is a second communication unit, coupled with a capacitor between it and the first communication unit, the communication unit 137.

[0122] (Second Embodiment) Next, a second embodiment will be described. Figure 11 is a block diagram showing an example of a communication device according to the second embodiment.

[0123] The communication device 10 according to this embodiment includes a sensor module 11, an indicator module 12, a main module 13, and a power supply 14. The sensor module 11 and the indicator module 12 have the same functions as in the first embodiment.

[0124] The main module 13 includes a clock 130, a clock 131, an MCU 132, a field communication unit 133, an MCU 134, a diagnostic unit 136, a diagnostic unit 138, a power supply circuit 139, and a field communication circuit 150. In the following description, the operation of each part having the same function as in the first embodiment will be omitted.

[0125] The field communication circuit 150 communicates with a controller (not shown). The field communication circuit 150 may include a field communication unit 151, a watchdog clock 152, and an output unit 153.

[0126] The field communication unit 151 transmits non-safe data processed by the MCU 132 to a controller (not shown) via the communication unit 137, according to the transmission settings. The watchdog clock 152 is used to monitor the operation of the MCU 134. However, the watchdog clock 152 may also monitor the operation of the MCU 132.

[0127] The output unit 153 performs digital communication with the controller using field network communication standards such as PROFINET or FOUNDATION Fieldbus.

[0128] In the main module 13 of the communication device 10, the clock 131, field communication unit 133, MCU 134, diagnostic unit 136, diagnostic unit 138, power supply circuit 139, and field communication circuit 150 are included in the safety-related unit 31. On the other hand, the clock 130 and MCU 132 are included in the non-safety-related unit 32.

[0129] Furthermore, if field communication is output using digital functions and no 4-20mA analog output is performed, the communication function that provides the digital output of the MCU132 is included in the safety-related section 31. However, the display function of the MCU132 is included in the non-safety-related section 32. In this case, it is also possible to separate the MCU132 into a digital communication section that has digital communication functions and a display section that has display functions, and designate them as the safety-related section 31 and the non-safety-related section 32, respectively.

[0130] In particular, the output section 153 of the field communication circuit 150 is designed for high reliability, considering not only individual components but also surrounding blocks to increase the safe failure rate and suppress the occurrence of undetectable dangerous failures, in order to process safety data. The output section 153 is designed to have a SFF (Structure-Fault Validation) greater than 90% and incorporates a health verification function.

[0131] (effect) By implementing this design, high reliability can be achieved even for devices with different communication specifications. Therefore, maintenance-free operation can be achieved throughout the product lifecycle, even for devices with different communication specifications.

[0132] Furthermore, although the above explanation used transmitter 1 as an example, the technology is not limited to this and can be applied to equipment that obtains functional safety certification, such as logic solvers and actuators in higher-level process devices. Moreover, the above technology can also be applied to equipment that obtains functional safety certification in industries other than process industries, such as automobiles. For example, the health verification function of a power supply diagnostic function can be applied to logic solvers and automobiles.

[0133] Furthermore, for these other devices, by improving the safety failure rate and introducing functions for health verification that consider not only individual components but also surrounding blocks, the redundant design can be made into a single system. By designing with a single system, the number of components can be reduced, and by reducing the use of components, the failure rate can be reduced accordingly, resulting in higher reliability. It is also possible to reduce costs. Moreover, in the case of automobiles, vehicle inspections can be considered as proof tests for transmitter 1, making it possible to shorten the interval equivalent to a vehicle inspection or eliminate inspection items.

[0134] Furthermore, the processing procedures, control procedures, specific names, and various data and parameters shown in the above documents and drawings may be changed at will unless otherwise specified.

[0135] Furthermore, the components of each illustrated device are functionally conceptual and do not necessarily need to be physically configured as shown. In other words, the specific forms of distribution and integration of each device are not limited to those shown. That is, all or part of them can be functionally or physically distributed and integrated in any unit according to various loads and usage conditions.

[0136] Some examples of the combinations of technical features that will be disclosed are listed below.

[0137] (1) A safety-related unit that processes safety data using the plurality of circuits, each having either a diagnostic mechanism and a diagnostic unit that performs either a design such that the overall safe failure rate of a circuit block including a first component of the diagnostic mechanism exceeds a target value, or a design such that the soundness of a second component of the diagnostic mechanism is confirmed, and a safety-related unit that processes safety data using the plurality of circuits, A non-safety related unit that processes non-safety data independently of the aforementioned safety related unit. An information processing device characterized by having the following features. (2) The aforementioned first component is a component capable of defining and analyzing failure modes, The second component is one for which defining and analyzing failure modes is difficult. The information processing apparatus according to (1), characterized in that (3) The second component has a self-diagnosis rate that does not achieve the target value, The circuit block is designed such that the overall safe failure rate exceeds a target value, based on the self-diagnosis rate of the second component, as well as the analysis of components other than the second component included in the circuit block. The information processing apparatus according to (1) or (2), characterized in that... (4) The plurality of circuits include a control circuit for processing the safety data, The diagnostic mechanism of the control circuit monitors the input and output of the control circuit to perform fault diagnosis. An information processing device according to any one of (1) to (3), characterized by the above. (5) The aforementioned plurality of circuits include a power supply circuit that drives the other plurality of circuits, The diagnostic unit of the power supply circuit monitors the operation of the power supply circuit and controls it so that simultaneous failures do not occur in some of the other circuits. An information processing device according to any one of (1) to (4), characterized by the above. (6) The diagnostic unit of the power supply circuit is It has a diagnostic component for diagnosing faults in the power supply circuit, A second power supply is generated to drive the diagnostic component based on the first power supply input from the aforementioned power supply circuit. If a fault occurs in which the voltage of the second power supply becomes high due to a voltage anomaly in the first power supply, and the voltage of the second power supply exceeds the maximum rating of the diagnostic component, the output voltage of the diagnostic component is fixed to the upper limit of the recommended operating voltage of the subsequent component. The information processing apparatus according to (5), characterized in that (7) The aforementioned safety-related parts are A first safety-related unit included in the first module for measuring physical quantities, A second safety-related unit included in the second module, which performs processing to notify an external device of the information of the physical quantity measured by the first module, An information processing apparatus according to any one of (1) to (6), characterized by including the following. (8) The first safety-related unit includes an analog processing circuit and a diagnostic circuit for diagnosing faults in the analog processing circuit. The aforementioned diagnostic circuit performs health checks by FMEA failure analysis on components where drift failures are difficult to detect. The information processing apparatus according to (7), characterized in that (9) The information processing apparatus according to (7) or (8), characterized in that the first safety-related unit has a redundant digital processing circuit. (10) The aforementioned safety-related unit includes a first communication unit that transmits and receives the safety data with an external device. The non-safety related unit has a second communication unit coupled with the first communication unit by a capacitor, which transmits and receives the non-safety data to and from the external device via the first communication unit. An information processing device according to any one of (1) to (9), characterized by the above. (11) A method for managing an information processing device having a diagnostic mechanism, The safety-related unit that processes safety data included in the information processing device and the non-safety-related unit that processes non-safety data are separated. With respect to the diagnostic mechanism, either design the circuit block including the first component of the diagnostic mechanism so that the overall safe failure rate exceeds the target value, or perform a soundness check on the second component of the diagnostic mechanism, or both. A management method characterized by the following features. [Explanation of Symbols]

[0138] 1. Transmitter 10. Communication equipment 11 Sensor Modules 12 Indicator Modules 13 Main Module 14 Power Supply 21,31 Safety-related departments 22,32 Non-safety related departments 111 Clock 112 Diagnostic Clock 113 Digital Department 114 Analog Section 115,121,132,134 MCU 116 Sensors 117,136,138 Diagnostic Department 118,139 Power supply circuit 122 LCD panels 131 Clock 133 Field Communications Unit 135 DA converter 137 Communications Department

Claims

1. A safety-related unit that processes safety data using the plurality of circuits, each having either a diagnostic mechanism and a diagnostic unit that performs either a design such that the overall safe failure rate of a circuit block including a first component of the diagnostic mechanism exceeds a target value, or a check of the integrity of a second component of the diagnostic mechanism, and A non-safety related unit that processes non-safety data independently of the aforementioned safety related unit. An information processing device characterized by having the following features.

2. The first component is a component capable of defining and analyzing failure modes, The second component is a component for which the definition and analysis of failure modes are difficult. The information processing apparatus according to feature 1.

3. The second component has a self-diagnosis rate that does not achieve the target value, The circuit block is designed such that the overall safe failure rate exceeds a target value, based on the self-diagnosis rate of the second component, as well as the analysis of components other than the second component included in the circuit block. The information processing apparatus according to feature 1.

4. The plurality of circuits include a control circuit for processing the safety data, The diagnostic mechanism of the control circuit monitors the input and output of the control circuit to perform fault diagnosis. The information processing apparatus according to feature 1.

5. The aforementioned plurality of circuits include a power supply circuit that drives the other plurality of circuits, The diagnostic unit of the power supply circuit monitors the operation of the power supply circuit and controls it so that simultaneous failures do not occur in some of the other circuits. The information processing apparatus according to feature 1.

6. The diagnostic unit of the power supply circuit is It has a diagnostic component for diagnosing faults in the power supply circuit, A second power supply is generated to drive the diagnostic component based on the first power supply input from the aforementioned power supply circuit. If a fault occurs in which the voltage of the second power supply becomes high due to a voltage abnormality in the first power supply, and the voltage of the second power supply exceeds the maximum rating of the diagnostic component, the output voltage of the diagnostic component is fixed to the upper limit of the recommended operating voltage of the subsequent component. The information processing apparatus according to feature 5.

7. The aforementioned safety-related parts are A first safety-related unit included in the first module for measuring physical quantities, A second safety-related unit included in the second module performs processing to notify an external device of the information of the physical quantity measured by the first module. The information processing apparatus according to claim 1, characterized by including the following:

8. The first safety-related unit includes an analog processing circuit and a diagnostic circuit for diagnosing faults in the analog processing circuit. The diagnostic circuit's integrity is confirmed by FMEA failure analysis for components where drift failure is difficult to detect. The information processing apparatus according to feature 7.

9. The information processing apparatus according to claim 7, characterized in that the first safety-related unit has a redundant digital processing circuit.

10. The aforementioned safety-related unit includes a first communication unit that transmits and receives the safety data with an external device. The non-safety related unit has a second communication unit coupled with a capacitor between it and the first communication unit, which transmits and receives the non-safety data to and from the external device via the first communication unit. The information processing apparatus according to feature 1.

11. A method for managing an information processing device having a diagnostic mechanism, The safety-related unit that processes safety data included in the information processing device and the non-safety-related unit that processes non-safety data are separated. With respect to the diagnostic mechanism, either design the circuit block including the first component of the diagnostic mechanism so that the overall safe failure rate exceeds the target value, or perform a soundness check on the second component of the diagnostic mechanism, or both. A management method characterized by the following features.

Images