Processor module, control method, and control program

Abstract

To suppress an increase in the number of parts that accompanies processor multiprocessing.SOLUTION: A processor module 10 according to an embodiment includes: a processor 111; a processor 112 that performs the same operations as the processor 111; a main memory 121 into which first data obtained by the operations of the processor 111 is written; a main memory 122 into which second data obtained by the operations of the processor 112 is written; and a main memory 141 into which check bits of the first data or the second data are written when the first data and the second data are the same.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present invention relates to a processor module, a control method, and a control program.

Background Art

[0002] Conventionally, in order to enhance the security of a system, a technique of multiplexing a computer's processor has been known. For example, a device in which a processor is duplicated to detect an error in an operation is known (see, for example, Patent Document 1).

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] However, the conventional technology has a problem in that it may not be able to suppress an increase in the number of components associated with multiplexing of the processor.

[0005] For example, in the conventional technology, when a system is configured with two processors, the number of components such as memory is at least doubled compared to the case where the system is configured with one processor.

[0006] In one aspect, an object is to suppress an increase in the number of components associated with multiplexing of the processor.

Means for Solving the Problems

[0007] A processor module relating to one aspect is characterized by comprising: a first processor; a second processor that performs the same operations as the first processor; a first memory on which first data obtained by the operations of the first processor is written; a second memory on which second data obtained by the operations of the second processor is written; and a third memory on which a check bit of the first data or a check bit of the second data is written when the first data and the second data are the same.

[0008] A control method relating to one aspect is characterized in that a controller that controls a processor module having a first processor, a second processor that performs the same calculations as the first processor, a first memory on which first data obtained by the calculations of the first processor is written, a second memory on which second data obtained by the calculations of the second processor is written, and a third memory calculates the check bit of the first data and the check bit of the second data, and if the check bit of the first data and the check bit of the second data match, writes the check bit of the first data or the check bit of the second data to the third memory.

[0009] The control program relating to one aspect is characterized in that it causes a controller that controls a processor module having a first processor, a second processor that performs the same calculations as the first processor, a first memory where first data obtained by the calculations of the first processor is written, a second memory where second data obtained by the calculations of the second processor is written, and a third memory, to calculate the check bit of the first data and the check bit of the second data, and if the check bit of the first data and the check bit of the second data match, to execute a process of writing the check bit of the first data or the check bit of the second data to the third memory. [Effects of the Invention]

[0010] According to one embodiment, it is possible to suppress the increase in the number of components that occurs with the redundancy of processors. [Brief explanation of the drawing]

[0011] [Figure 1] This figure shows an example configuration of a processor module according to the first embodiment. [Figure 2] This figure shows an example configuration of an interface controller according to the first embodiment. [Figure 3] This figure shows an example configuration of an interface controller according to the first embodiment. [Figure 4] This is a diagram showing an example configuration of a collation device according to the first embodiment. [Figure 5] This is a flowchart showing the flow of the writing process for the processor module according to the first embodiment. [Figure 6] This flowchart shows the flow of the read operation of the processor module according to the first embodiment. [Figure 7] This figure shows an example configuration of a processor module according to the second embodiment. [Figure 8] This figure shows an example configuration of a processor module according to the third embodiment. [Figure 9] This is a flowchart showing the flow of the writing process for the processor module according to the third embodiment. [Figure 10] This is a flowchart showing the flow of the read operation of the processor module according to the third embodiment. [Figure 11] This diagram shows the configuration of a conventional processor module. [Modes for carrying out the invention]

[0012] Embodiments of the processor module, control method, and control program disclosed in the present application will be described in detail below based on the drawings. Note that the invention of the present application is not limited by the embodiments described here. Also, the same elements are denoted by the same reference numerals, and overlapping descriptions are omitted as appropriate. Further, the embodiments can be combined as appropriate within a non - conflicting range.

[0013] The processor module in the embodiment is an example of a computer. The processor module is used, for example, in a distributed control system (DCS) and a safety instrument system (SIS) provided in a plant.

[0014] The plant is, for example, an oil plant, a petrochemical plant, a chemical plant, or a gas plant. By operating the plant, products such as LNG (liquefied natural gas), resins (plastics, nylon, etc.), and chemical products can be obtained.

[0015] Also, the plant has factory facilities, machine facilities, production facilities, power generation facilities, storage facilities, facilities at the wellhead for extracting oil, natural gas, etc. Further, equipment for generating products is provided in the plant.

[0016] The processor module may perform calculations using data obtained from field devices provided in the plant. The field devices acquire information regarding the state of the plant. For example, the field devices are temperature sensors, pH sensors, speed sensors, acceleration sensors, pressure sensors, gas concentration sensors, devices for detecting the opening degree of valves, devices for detecting the state (on or off) of switches, etc.

[0017] For example, the processor module calculates the operation amount of the plant's equipment (for example, the change amount of the valve opening degree) based on the data obtained from the field devices.

[0018] In this regard, obtaining functional safety standards is required, especially for SIS (System Integrity System). The functional safety standard IEC 61508 sets the Probability of Failure on Demand (PFD) according to the Safety Integrity Level (SIL).

[0019] To achieve a high level of SIL (System Integrity Level), the PFD (Processing Function Disclosure) must be low. To achieve this, the anomaly detection rate of the processor module must be high. Conventionally, a processor module configuration with duplicate processors and main memory has been known to improve the anomaly detection rate.

[0020] [Conventional processor modules] Figure 11 illustrates the configuration of a conventional processor module with a duplicated processor and main memory. Figure 11 is a diagram showing the configuration of a conventional processor module.

[0021] As shown in Figure 11, the conventional processor module 10a includes a processor 111a, a processor 112a, main memory 121a, main memory 122a, main memory 123a, main memory 124a, and an FPGA (Field Programmable Gate Array) 130a. The FPGA 130a includes an interface controller 131a, an interface controller 132a, and a collation unit 133a. Note that the FPGA may be replaced with other devices such as an ASIC (Application Specific Integrated Circuit).

[0022] As shown in Figure 11, the processor module 10a has two processors. For example, each processor is a CPU (Central Processing Unit). Each processor is connected to main memory for data and main memory for error detection codes (EDC) via a dedicated interface controller. For example, the main memory is DDR4 SDRAM.

[0023] In the diagram, solid lines, dashed lines, and dotted lines represent data lines, data strobe lines, and address lines, respectively. The numbers shown on the lines represent the bus width of each line. The bus width of the data line is 32 bits. Note that the address line may also be a control line.

[0024] The processor module 10a has main memory for data, as well as main memory for EDC to hold check bits. This improves the utilization rate of the processor module 10a.

[0025] For example, since the data line between FPGA130a and the main memory is 32 bits, FPGA130a can perform 1-bit error detection, 1-bit error correction, and 2-bit error detection by adding 8 bits to the check bit.

[0026] (Writing process) This section describes the write access to main memory, i.e., the data writing process, performed by the processor module 10a.

[0027] First, processor 111a writes data to main memory 121a. Then, processor 112a writes data to main memory 122a.

[0028] At this time, the interface controller 131a calculates a check bit corresponding to the data that the processor 111a writes to the main memory 121a, and writes the check bit obtained from the calculation to the main memory 123a.

[0029] Furthermore, the interface controller 132a calculates a check bit corresponding to the data that the processor 112a writes to the main memory 122a, and writes the check bit obtained from the calculation to the main memory 124a.

[0030] (Reading process) This section describes the read access to main memory, i.e., the data reading (read) process performed by the processor module 10a.

[0031] First, processor 111a reads data from main memory 121a. Then, processor 112a reads data from main memory 122a.

[0032] The aligner 133a compares the data read from main memory 121a with the data read from main memory 122a and determines whether they match.

[0033] If the data read from main memory 121a does not match the data read from main memory 122a, interface controllers 131a and 132a detect the occurrence of an anomaly.

[0034] If an anomaly is detected, and the error in either the data read from main memory 121a or the data read from main memory 122a is 1 bit, the interface controller 131a or interface controller 132a corrects the error using a check bit read from main memory 123a or main memory 124a. As a result, even if an anomaly is detected, the processor module 10a can continue to operate.

[0035] For example, if there is a 1-bit error in the data read from the main memory 121a, the interface controller 131a corrects the error using a check bit read from the main memory 123a.

[0036] Furthermore, for example, if there is a 1-bit error in the data read from the main memory 122a, the interface controller 132a corrects the error using a check bit read from the main memory 124a.

[0037] The data lines (solid lines) and the data strobe lines (dashed lines) necessary for reading the data lines are individually connected from the FPGA130a to the main memory for data and the main memory for EDC, respectively.

[0038] In the example shown in Figure 11, the data lines and data strobe lines are individually connected to main memory 121a, main memory 122a, main memory 123a, and main memory 124a, respectively.

[0039] On the other hand, a common address line (dotted line) is connected to the main memory for data and the main memory for EDC. This is because the FPGA130a accesses the main memory for data and the main memory for EDC at the same time and at the same address.

[0040] As shown in Figure 11, conventional redundant processor modules require two main memory modules not only for the processor and data, but also two memory modules for EDC (Electronic Data Delivery), thus increasing the number of components.

[0041] According to the following embodiment, a dual-redundant processor module can be obtained that has fewer main memory units for EDC compared to a conventional dual-redundant processor module.

[0042] [First Embodiment] [Configuration of the first embodiment] The configuration of the processor module of the first embodiment will be explained using Figure 1. Figure 1 is a diagram showing an example of the configuration of the processor module according to the first embodiment.

[0043] As shown in Figure 1, the processor module 10 of the first embodiment includes a processor 111, a processor 112, a main memory 121, a main memory 122, a main memory 141, and an FPGA 130. The FPGA 130 includes an interface controller 131, an interface controller 132, and a collation unit 133.

[0044] FPGA130 is an example of a controller that controls a processor module. FPGA130 may be replaced with other devices such as ASICs.

[0045] As shown in Figure 1, the processor module 10 has two processors. For example, each processor is a CPU. Each processor is connected to main memory for data and main memory for EDC via a dedicated interface controller. For example, the main memory is DDR4 SDRAM.

[0046] Processor 111 is an example of a first processor. Processor 112 is an example of a second processor. Processor 112 performs the same operations as processor 111.

[0047] In the diagram, solid lines, dashed lines, and dotted lines represent data lines, data strobe lines, and address lines, respectively. The numbers shown on the lines represent the bus width of each line. Note that address lines may also be control lines.

[0048] The processor module 10 has main memory 121 and 122 for data, as well as main memory 141 for EDC to hold check bits. This improves the operating rate of the processor module 10. For example, even if an abnormality occurs, the processor module 10 can continue to operate by error correction using check bits.

[0049] Main memory 121 is an example of the first memory. Main memory 122 is an example of the second main memory. Data obtained by the calculations of processor 111 is written to main memory 121. Data obtained by the calculations of processor 112 is written to main memory 122.

[0050] Main memory 141 is an example of a third memory. Main memory 141 is connected to interface controllers 131 and 132. When the data obtained by the calculation of processor 111 and the data obtained by the calculation of processor 112 are the same, the check bit of the data obtained by the calculation of processor 111 or the check bit of the data obtained by the calculation of processor 112 (both being the same check bit) is written to main memory 141.

[0051] The bus width of the data line between the interface controller 131 and the main memory 121 is 32 bits. The bus width of the data strobe line between the interface controller 131 and the main memory 121 is 8 bits. The bus width of the address line between the interface controller 131 and the main memory 121 is 35 bits.

[0052] Furthermore, the bus width of the data line between the interface controller 132 and the main memory 122 is 32 bits. The bus width of the data strobe line between the interface controller 132 and the main memory 122 is 8 bits. The bus width of the address line between the interface controller 132 and the main memory 122 is 35 bits.

[0053] Furthermore, the bus width of the data lines between interface controllers 131 and 132 and main memory 141 is 8 bits. The bus width of the data strobe lines between interface controllers 131 and 132 and main memory 141 is 2 bits. The bus width of the address lines between interface controllers 131 and 132 and main memory 141 is 35 bits.

[0054] For example, since the data line between the interface controller 131 and the main memory 121 is 32 bits, the interface controller 131 can perform 1-bit error detection, 1-bit error correction, and 2-bit error detection by adding 8 bits of check bits. The interface controller 131 also writes the check bits to the main memory 141.

[0055] As shown in Figure 11, the conventional processor module 10a has two main memory slots for the EDC. In contrast, the processor module 10 of the first embodiment shown in Figure 1 has one main memory slot 141 for the EDC. Thus, the number of components in the processor module 10 of the first embodiment is fewer than that of the conventional processor module 10a.

[0056] The processor module 10 may also be equipped with an interface for sending and receiving data with external devices.

[0057] Here, interface controller 131, interface controller 132, and collation unit 133 may be provided on the controller (FPGA 130) as separate circuits that perform data input / output and calculations. Alternatively, interface controller 131, interface controller 132, and collation unit 133 may be implemented as programs that run on the controller.

[0058] The configuration of the interface controller 131 will be explained using Figure 2. Figure 2 is a diagram showing an example of the configuration of the interface controller according to the first embodiment.

[0059] As shown in Figure 2, the interface controller 131 includes an input / output unit 1311, a memory read unit 1312, a memory write unit 1313, a check bit calculation unit 1314, an error detection unit 1315, and an error correction unit 1316.

[0060] The input / output unit 1311 is an interface for inputting and outputting data. The memory read unit 1312 reads data from memory. The memory write unit 1313 writes data to memory.

[0061] The check bit calculation unit 1314 calculates the check bits for the data. The error detection unit 1315 uses the check bits to detect errors in the data. The error correction unit 1316 uses the check bits to correct the errors in the data.

[0062] The configuration of the interface controller 132 will be explained using Figure 3. Figure 3 is a diagram showing an example of the configuration of the interface controller according to the first embodiment.

[0063] As shown in Figure 3, the interface controller 132 includes an input / output unit 1321, a memory read unit 1322, a memory write unit 1323, a check bit calculation unit 1324, an error detection unit 1325, and an error correction unit 1326.

[0064] The functions of each processing unit in the interface controller 132 are equivalent to the functions of each processing unit in the interface controller 131.

[0065] The configuration of the verifier will be explained using Figure 4. Figure 4 is a diagram showing an example of the configuration of the verifier according to the first embodiment.

[0066] As shown in Figure 4, the aligner 133 has an input / output unit 1331 and a determination unit 1332.

[0067] The input / output unit 1331 is an interface for inputting and outputting data. The determination unit 1332 determines whether two sets of data match. For example, the determination unit 1332 determines whether the data input from interface controller 131 matches the data input from interface controller 132.

[0068] [Processing flow of the first embodiment] (Writing process) Figure 5 illustrates the write access to main memory, i.e., the data writing process, performed by the processor module 10. Figure 5 is a flowchart showing the flow of the write process of the processor module according to the first embodiment.

[0069] First, each processor writes data to the main memory for data (step S111). Specifically, processor 111 writes the data obtained from the calculation to main memory 121. Also, processor 112 writes the data obtained from the calculation to main memory 122.

[0070] Next, each interface controller calculates the check bit for the data (step S112). Specifically, interface controller 131 calculates the check bit for the data that processor 111 will write. Interface controller 132 also calculates the check bit for the data that processor 112 will write.

[0071] Next, the aligner 133 compares the check bits of the data (step S113). That is, the aligner 133 determines whether the check bits calculated by the interface controller 131 and the check bits calculated by the interface controller 132 match.

[0072] Processor 111 and processor 112 perform the same calculations. Therefore, unless an error occurs, the data written by processor 111 and the data written by processor 112 are the same. In that case, the check bits of the data written by processor 111 and the check bits of the data written by processor 112 are equal.

[0073] If the data check bits match (step S114, Yes), the interface controller writes the data check bits to the main memory for EDC (step S115). That is, interface controller 131 or interface controller 132 writes the calculated check bits to the main memory 141.

[0074] If the data check bits do not match (step S114, No), the processor module 10 terminates the write process. At this time, the processor module 10 may cancel the data written by processors 111 and 112. The processor module 10 may also notify other devices that the data written by processors 111 and 112 does not match.

[0075] (Reading process) Using Figure 6, we will explain the read access to main memory, i.e., the data reading (read) process, performed by the processor module 10 of the first embodiment. Figure 6 is a flowchart showing the flow of the read process of the processor module according to the first embodiment.

[0076] First, each processor reads data from the main memory (step S121). Specifically, processor 111 reads data from main memory 121, and processor 112 reads data from main memory 122.

[0077] Next, the collier 133 compares the data (step S122). That is, the collier 133 determines whether the data read from main memory 121 matches the data read from main memory 122.

[0078] If the data does not match (step S123, No), interface controller 131 or interface controller 132 detects the occurrence of an anomaly (step S124). That is, interface controller 131 or interface controller 132 detects the anomaly and performs the following processing. Here, it is assumed that interface controller 131 detects the anomaly.

[0079] The interface controller 131 reads the data check bits from the main memory 141 for EDC (step S125), and uses the read check bits to correct errors in the data (step S126).

[0080] On the other hand, if the data matches (step S123, Yes), the processor module 10 terminates the read operation.

[0081] Furthermore, if the processor module 10 detects an abnormality and cannot resolve the abnormality by error correction, it may notify other devices that an abnormality has occurred and stop its operation. Subsequently, the processing performed by the processor module 10 may be taken over by another device having equivalent functionality to the processor module 10.

[0082] [Effects of the first embodiment] According to the first embodiment, it is possible to provide a processor module with a reduced number of components while maintaining the same anomaly detection rate and operating rate as conventional processor modules. As a result, the increase in the number of components associated with the redundancy of the processor, including the processor module, is suppressed.

[0083] [Second Embodiment] A second embodiment will be described, which further reduces the signals input and output by the interface controller compared to the first embodiment. In the description of the second embodiment, explanations of parts common to the first embodiment will be omitted as appropriate. For example, the configurations of interface controller 131, interface controller 132, and collation unit 133 in the second embodiment are as shown in Figures 2, 3, and 4, respectively.

[0084] [Configuration of the second embodiment] The configuration of the processor module of the second embodiment will be explained using Figure 7. Figure 7 is a diagram showing an example of the configuration of the processor module according to the second embodiment.

[0085] As shown in Figure 7, the processor module 10 of the second embodiment has a different method of connecting the main memory for EDC compared to the first embodiment. Main memory 123 is an example of a third memory.

[0086] As shown in Figure 7, the main memory 123 for EDC is connected to the interface controller 131. On the other hand, the main memory 123 for EDC is not connected to the interface controller 132. Thus, the main memory 123 is connected to only the interface controller 131 of the two interface controllers 131 and 132.

[0087] The bus width of the address lines between the interface controller 131 and the main memory 121 and main memory 123 is 35 bits. The interface controller 131 also writes a check bit to the main memory 123.

[0088] [Processing flow of the second embodiment] The processing flow of the second embodiment is the same as that of the first embodiment. However, among the multiple interface controllers, the interface controller to which the main memory for EDC is connected (for example, interface controller 131 in Figure 7) performs the writing of check bits during the write process, and the detection of the occurrence of an anomaly and the reading of check bits during the read process.

[0089] [Effects of the second embodiment] According to the second embodiment, the number of signals for the interface controller can be further reduced compared to the first embodiment. Furthermore, according to the second embodiment, at least the address lines connecting the interface controller to the main memory for data and the main memory for EDC can be made common.

[0090] [Third Embodiment] A third embodiment, which further improves the ability to detect anomalies compared to the second embodiment, will now be described. In the description of the third embodiment, explanations of parts common to the first or second embodiment will be omitted as appropriate. For example, the configurations of interface controller 131, interface controller 132, and collation unit 133 in the third embodiment are as shown in Figures 2, 3, and 4, respectively.

[0091] [Configuration of the third embodiment] The configuration of the processor module of the third embodiment will be explained using Figure 8. Figure 8 is a diagram showing an example of the configuration of the processor module according to the third embodiment.

[0092] As shown in Figure 8, the processor module 10 of the third embodiment has a different bus width for the data lines and data strobe lines connected to the memory for EDC compared to the second embodiment.

[0093] As shown in Figure 7, the bus widths of the data lines and data strobe lines between the interface controller 131 and the main memory 123 in the second embodiment are 8 bits and 2 bits, respectively.

[0094] On the other hand, as shown in Figure 8, the bus widths of the data lines and data strobe lines between the interface controller 131 and the main memory 123 in the third embodiment are 16 bits and 4 bits, respectively.

[0095] In the third embodiment, the size of the bus width is used to further write a check bit to the address of the main memory 121, where the data obtained by the calculations of the processor 111 is written.

[0096] As a result, according to the third embodiment, it is possible to detect when an abnormality occurs in the address line of the data main memory (main memory 121 in Figure 8) corresponding to the interface controller connected to the main memory for EDC, and when reading from the data main memory, when the data at the incorrectly accessed destination differs from the correct data by only one bit.

[0097] [Processing flow of the third embodiment] (Writing process) Using Figure 9, we will explain the write access to main memory, i.e., the data writing (write) process, performed by the processor module 10 of the third embodiment. Figure 9 is a flowchart showing the flow of the write process of the processor module according to the third embodiment.

[0098] First, each processor writes data to the main memory for data (step S311). Specifically, processor 111 writes the data obtained from the calculation to main memory 121. Also, processor 112 writes the data obtained from the calculation to main memory 122.

[0099] Next, each interface controller calculates the check bit for the data (step S312). Specifically, interface controller 131 calculates the check bit for the data that processor 111 will write. Interface controller 132 also calculates the check bit for the data that processor 112 will write.

[0100] Furthermore, each interface controller calculates the address check bit (step S313). Specifically, interface controller 131 calculates the check bit for the address of main memory 121 to which processor 111 writes data. Interface controller 132 also calculates the check bit for the address of main memory 122 to which processor 112 writes data.

[0101] Next, the aligner 133 compares the check bits of the data (step S314). That is, the aligner 133 determines whether the check bits of the data calculated by the interface controller 131 match the check bits of the data calculated by the interface controller 132.

[0102] Furthermore, the aligner 133 compares the check bits of the addresses (step S315). That is, the aligner 133 determines whether the check bits of the addresses calculated by the interface controller 131 match the check bits of the addresses calculated by the interface controller 132.

[0103] If both the data check bit and the address check bit match (step S316, Yes), the interface controller writes both the data check bit and the address check bit to the main memory for EDC (step S317). That is, the interface controller 131 writes the calculated check bits to the main memory 123.

[0104] If at least one of the data check bits and the address check bits do not match (step S316, No), the processor module 10 terminates the write operation. At this time, the processor module 10 may cancel the data written by processors 111 and 112. The processor module 10 may also notify other devices that the data written by processors 111 and 112 do not match.

[0105] (Reading process) Using Figure 10, we will explain the read access to main memory, i.e., the data reading (read) process, performed by the processor module 10 of the third embodiment. Figure 10 is a flowchart showing the flow of the read process of the processor module according to the third embodiment.

[0106] First, each processor reads data from the main memory (step S321). Specifically, processor 111 reads data from main memory 121, and processor 112 reads data from main memory 122.

[0107] Here, the interface controller 131 reads the address check bit from the main memory 123 for EDC (step S322). Then, the interface controller 131 uses the address check bit to verify that the address read by processors 111 and 112 is correct (step S323).

[0108] If the address is correct (step S324, Yes), the collier 133 compares the read data (step S326). That is, the collier 133 determines whether the data read from main memory 121 matches the data read from main memory 122.

[0109] If the data does not match, the interface controller 131 detects the occurrence of an anomaly (step S327). The interface controller 131 then reads the data check bits from the main memory 123 for EDC (step S328) and uses the read check bits to correct the data error (step S329).

[0110] If the data matches in step S326, the processor module 10 terminates the read operation without performing error correction. If the address is incorrect (step S324, No), the interface controller 131 detects the occurrence of an anomaly (step S325) and terminates the process.

[0111] [Effects of the third embodiment] According to the third embodiment, since the address check bit can be stored in the main memory for EDC, the abnormalities described above can be detected, and the abnormality detection rate is improved. An error occurred in the address line of the main memory for data (main memory 121 in Figure 8) corresponding to the interface controller connected to the main memory for EDC. • When reading data from main memory, the data at the wrong access point differs from the correct data by just one bit.

[0112] [system] Unless otherwise specified, the processing procedures, control procedures, specific names, and various data and parameters shown in the above documents and drawings may be changed at will.

[0113] Furthermore, the components of each illustrated device are functionally conceptual and do not necessarily need to be physically configured as shown. In other words, the specific forms of distribution and integration of each device are not limited to those shown. That is, all or part of them can be functionally or physically distributed and integrated in any unit according to various loads, usage conditions, etc.

[0114] Furthermore, the processor modules of each embodiment may be applied not only to SIS but also to other FA (Factory Automation) equipment such as DCS.

[0115] Furthermore, each processing function performed by FPGA130 may be implemented, in whole or in part, by a CPU and a program executed by the CPU for analysis, or by wired logic hardware. Interface controller 131, interface controller 132, and aligner 133 may each be implemented by different circuits on the FPGA.

[0116] Furthermore, FPGA130 operates the processes that perform each function by loading programs that perform the same processing as interface controller 131, interface controller 132, and collation unit 133 into memory.

[0117] Furthermore, the FPGA130 can also achieve the same functionality as the embodiment described above by reading the above program from the recording medium using a media reader and executing the read program.

[0118] Furthermore, this program can be distributed via networks such as the Internet. Additionally, this program can be recorded on computer-readable storage media such as hard disks, flexible disks (FDs), CD-ROMs, MOs (Magneto-Optical disks), and DVDs (Digital Versatile Discs), and executed by reading the program from these media using a computer. [Explanation of Symbols]

[0119] 10 Processor Modules 111, 112 processors 121, 122, 123, 141 Main memory 131, 132 Interface Controllers 133 Verifier 1311, 1321, 1331 input / output section 1312, 1322 Memory read section 1313, 1323 Memory writing section 1314, 1324 Check bit calculation unit 1315, 1325 Error detection unit 1316, 1326 Error correction section 1332 Judgment section

Claims

1. The first processor, A second processor that performs the same calculations as the first processor, A first memory on which the first data obtained by the calculation of the first processor is written, A second memory on which the second data obtained by the calculation of the second processor is written, If the first data and the second data are the same, a third memory is used to write the check bit of the first data or the check bit of the second data. A first interface controller that calculates the check bit of the first data, A second interface controller for calculating the check bit of the second data, It has, The third memory is connected to only the first interface controller among the first and second interface controllers, and of the check bits of the first data and the check bits of the second data, only the check bit of the first data is written, and the check bit of the address of the first memory to which the first data is written is written. A processor module characterized by the following features.

2. The first processor, A second processor that performs the same calculations as the first processor, A first memory on which the first data obtained by the calculation of the first processor is written, A second memory on which the second data obtained by the calculation of the second processor is written, If the first data and the second data are the same, a third memory is used to write the check bit of the first data or the check bit of the second data. A first interface controller that calculates the check bit of the first data, A second interface controller for calculating the check bit of the second data, A controller that controls a processor module having the following: The third memory is connected to only the first interface controller among the first and second interface controllers, and writes only the check bit of the first data among the check bits of the first data and the check bit of the second data, and writes the check bit of the address of the first memory to which the first data is written. A control method characterized by the following:

3. The first processor, A second processor that performs the same calculations as the first processor, A first memory on which the first data obtained by the calculation of the first processor is written, A second memory on which the second data obtained by the calculation of the second processor is written, If the first data and the second data are the same, a third memory is used to write the check bit of the first data or the check bit of the second data. A first interface controller that calculates the check bit of the first data, A second interface controller for calculating the check bit of the second data, A controller that controls a processor module having the following: The third memory is connected to only the first interface controller among the first and second interface controllers, and writes only the check bit of the first data among the check bits of the first data and the check bit of the second data, and writes the check bit of the address of the first memory to which the first data is written. A control program characterized by causing a process to be executed.

Images