Process control system, control method, and control program

Abstract

It detects soft errors and avoids adverse effects caused by corrupted data. [Solution] The process control system 100 has CPU modules 1 and 2. Both CPU modules 1 and 2 include a memory and a processor connected to the memory. The processor executes control processing that performs multiple processes in sequence, compares the result of the current process with the result of the current process of the other CPU module 1 or 2, compares its own comparison result with the comparison result of the other CPU module 1 or 2, detects a soft error based on its own comparison result and the comparison result, and if a soft error is detected, executes processing to obtain the result of the process and continue the control processing.

Description

Technical Field

[0001] The present invention relates to a process control system, a control method, and a control program.

Background Art

[0002] In a process control system, when control processing outputs an incorrect result due to a soft error, it is impossible to guarantee safe operation. Even if it does not cause system stoppage or significant incorrect output, incorrect data may be carried over to the next cycle, which may lead to a decrease in production quality and a deterioration in yield. Therefore, in order to avoid adverse effects on the system, it is preferable to reliably detect soft errors and repair incorrect data. As a countermeasure against incorrect results of control processing due to soft errors in a logic circuit section, countermeasures against soft errors using a dual CPU (Central Processing Unit) module or a triple CPU module have been proposed.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Patent Document 2

Summary of the Invention

Problems to be Solved by the Invention

[0004] However, in a dual CPU module, there are problems that it is impossible to identify the CPU in which a soft error has occurred and that it is impossible to identify incorrect information due to the occurrence of a soft error. Further, when a triple configuration is adopted, there is a risk of an increase in the number of components, an increase in mounting man-hours, and an increase in the risk of program quality due to an increase in processing. That is, it is difficult to improve the reliability of a process control system with conventional countermeasures against soft errors.

[0005] One aspect of the present invention is to improve the reliability of a process control system by avoiding adverse effects caused by invalid data when a soft error occurs. [Means for solving the problem]

[0006] The process control system relating to one aspect has two information processing devices. Each information processing device comprises a memory and a processor connected to the memory. The processor is Repeat each process in a series of steps at regular intervals. A control process is executed that performs multiple processes in sequence, the result of the current process is compared with the result of the current process of the other information processing device, and the comparison result of the current process is compared with the comparison result of the other information processing device. If the self-matching result is inconsistent and the comparison result is the same, during the control process If a soft error is detected, In the control process, the result of the previous procedure in the current cycle is obtained and the current procedure is re-executed. Execute the process. [Effects of the Invention]

[0007] According to the present invention, the reliability of the process control system can be improved by avoiding adverse effects caused by invalid data when a soft error occurs. [Brief explanation of the drawing]

[0008] [Figure 1] This is a hardware configuration diagram of the process control system according to the first embodiment. [Figure 2] This is a block diagram of the process control system according to the first embodiment. [Figure 3] This diagram shows the criteria for determining the occurrence of a soft error. [Figure 4] This figure shows an example of a processing result storage table. [Figure 5] This is a flowchart of the soft error repair process performed by the CPU module according to the first embodiment. [Figure 6] This is a flowchart of the operation of the redundant operation switching unit. [Figure 7] This is a flowchart of the operation of the redundant operation recovery unit. [Figure 8]It is a block diagram of a process control system according to the second embodiment. [Figure 9] It is a diagram showing an example of information on how a device is used. [Figure 10] It is a diagram showing an example of soft error occurrence log information. [Figure 11] It is a flowchart of soft error recovery processing by a CPU module according to the second embodiment. [Figure 12] It is a block diagram of a process control system according to the third embodiment. [Figure 13] It is a diagram showing an example of an intermediate result storage table. [Figure 14] It is a flowchart of soft error recovery processing by a CPU module according to the third embodiment. [Figure 15] It is a flowchart of soft error recovery processing by a CPU module according to the fourth embodiment.

Modes for Carrying Out the Invention

[0009] Hereinafter, embodiments of a process control system, a control method, and a control program will be described with reference to the drawings. In addition, the same elements are denoted by the same reference numerals, and overlapping descriptions are omitted as appropriate. Also, the respective embodiments can be combined as appropriate within a non - conflicting range.

[0010] (Definition of Terms) (Process Control System) The process control system is a system as follows. The process control system has a controller collect various state quantities (e.g., pressure, temperature, flow rate, etc.) of an industrial process from sensors (thermometers, flow meters, etc.). Then, the process control system executes control logic created by a user and operates an actuator (valve, etc.) based on the result, thereby automatically operating a plant or a factory. In the process control system, mainly continuous control by fixed - cycle processing is performed.

[0011] (Fixed - Cycle Control) In a process control system, periodic control refers to the controller executing process control at a fixed period. Generally, periodic control is executed at a period from 10 milliseconds to several seconds.

[0012] (Soft error) A soft error is a phenomenon in which external energy particles accidentally collide with data elements such as the logic circuit on the CPU module or the memory circuit, and one or two bits of the data being held are inverted depending on the strength of the impact of the collision. The data with the bit inverted is incorrect and may cause the CPU module to malfunction. Since it is caused by fine and various types of energy particles flying in from the universe and colliding with data elements, soft errors rarely occur. Also, the occurrence location, the bit position of the bit error, and the occurrence interval time are various. Therefore, since the same phenomenon does not continue to occur with soft errors, they are treated as transient errors.

[0013] (Dual configuration of CPU modules) By providing two identical CPU modules, even if a hardware component of one CPU module has a single failure, the process control system can avoid the adverse effects of the failure as a whole and continue to operate by switching to the other CPU module. The two CPU modules play the roles of an active side and a standby side. The active-side CPU module operates all processes. On the other hand, the standby-side CPU module is the switchover destination when the active-side CPU module fails. The preparation of the standby-side CPU module differs depending on a switchover request such as a short-term switchover.

[0014] (An example of an issue in a process control system) In a process control system, an unexpected stop of the periodic control process is not allowed at all because not only does the production efficiency decrease, but also the in-process products have to be remade. Also, even if the control process does not stop, if the control process outputs an incorrect value due to a soft error, the safe operation of the process control system is not guaranteed.

[0015] On the other hand, soft errors occur very infrequently and are transient, so they do not necessarily cause system shutdowns or significant output errors. However, even in such cases, the incorrect data may be carried over to the next cycle, potentially leading to a decrease in production quality and yield in the process control system. Therefore, since both cases have a negative impact on the system, it is preferable for the process control system to reliably detect soft errors and correct the incorrect data.

[0016] The CPU module comprises a logic circuit section and a memory circuit section. The logic circuit section consists of digital electronic circuit components and performs data processing such as logical operations. The memory circuit section writes and stores data, and retrieves stored data. The memory circuit section also includes functions to counter bit errors caused by soft errors, etc.

[0017] Unlike the memory circuit section, the logic circuit section cannot detect soft errors. Conventional soft error countermeasures assume that the hardware components of the CPU module themselves can detect soft errors, making it difficult to implement soft error countermeasures in the logic circuit section. Therefore, if a soft error occurs in the logic circuit section, conventional soft error countermeasures may result in the control process outputting incorrect results. For example, incorrect output of valve opening and closing could cause enormous damage to the plant.

[0018] One solution to this problem is to use a dual CPU module to mitigate soft errors. By comparing the processing results of the two CPU modules, if the results differ, it can be determined that a soft error has occurred in one of the CPU modules. In other words, this mechanism can detect soft errors occurring not only in the logic circuit section but also in various components on the hardware module.

[0019] However, this solution approach presents two technical problems. First, it is impossible to identify the CPU module in which the soft error occurred. Since it is not possible to determine which CPU module experienced the soft error, it is difficult to decide which CPU module to operate. Second, it is impossible to identify the incorrect information resulting from the soft error. Since it is not possible to identify which process caused the soft error and which data is incorrect, there is a risk of using incorrect data. Therefore, a process control system to solve these problems is described below.

[0020] (First Embodiment) (Hardware configuration) Figure 1 is a hardware configuration diagram of a process control system according to the first embodiment. The process control system 100 according to this embodiment has a redundant active CPU module 1 and a standby CPU module 2. The process control system 100 is an example of an "information processing system". CPU modules 1 and 2 are an example of an "information processing device". In other words, the information processing system has two information processing devices in a redundant configuration.

[0021] CPU module 1 has a logic circuit section 11 and a memory circuit section 12. The logic circuit section 11 and the memory circuit section 12 are hardware modules. The logic circuit section 11 and the memory circuit section 12 are interconnected and can transmit and receive data. CPU module 2 has a logic circuit section 21 and a memory circuit section 22. The logic circuit section 21 and the memory circuit section 22 are hardware modules. The logic circuit section 21 and the memory circuit section 22 are interconnected and can transmit and receive data. Thus, both CPU modules 1 and 2, which are information processing devices, have memory and a processor connected to the memory.

[0022] Note that CPU module 1 and CPU module 2 are modules with the same configuration, logic circuit section 11 and logic circuit section 21 are the same circuit, and memory circuit section 12 and memory circuit section 22 are the same circuit. Therefore, here we will explain the operation of logic circuit section 11 and memory circuit section 12 as examples.

[0023] The logic circuit unit 11 is a processor. The logic circuit unit 11 includes, for example, flip-flops (circuits that hold data) and combinational logic circuits (circuits that combine AND, OR, etc.). The logic circuit unit 11 may also be logically implemented within an FPGA (Field Programmable Gate Array). Arithmetic operations and other complex calculations are realized by combining logical operations performed by the logic circuits.

[0024] The memory circuit section 12 is, for example, RAM (Random Access Memory) including SRAM (Static Random Access Memory), a cache, or CRAM (Configuration RAM) within an FPGA. The memory circuit section 12 is classified into two types based on differences in bit error countermeasures: a memory circuit section 12 with automatic error repair and a memory circuit section 12 with error detection.

[0025] The memory circuit section 12 with automatic error repair provides automatic data repair for bit errors, including soft errors. The memory circuit section 12 with automatic error repair is, for example, an ECC (Error Checking and Correcting) memory or ECC cache with added ECC functionality. The memory circuit section 12 with automatic error repair can continue control processing even if a bit error occurs. The memory circuit section 12 with automatic error repair detects and automatically repairs bit errors during reading.

[0026] The memory circuit section 12 with error detection includes a bit error detection unit that detects bit errors. For example, the memory circuit section 12 with error detection is a memory with parity bits or a cache with parity bits. When a bit error is detected, the memory circuit section 12 with error detection continues control processing by switching between CPU module 1 and CPU module 2, similar to a hardware failure. The memory circuit section 12 with error detection also detects bit errors during reading.

[0027] (Functional Configuration) Figure 2 is a block diagram of the process control system according to the first embodiment. Next, the functional configuration and details of the process control system 100 will be described with reference to Figure 2. The process control system 100 has the following parts, which are realized by having a hardware module execute a program. The following parts are software modules.

[0028] CPU module 1 includes a control unit 110, a redundancy processing unit 120, and a storage unit 130. CPU module 2 includes a control unit 210, a redundancy processing unit 220, and a storage unit 230. The storage unit 130 is implemented by a memory circuit unit 12, and the storage unit 230 is implemented by a memory circuit unit 22.

[0029] The redundancy processing units 120 and 220 perform redundancy processing for CPU modules 1 and 2 using a hot standby method. The standby CPU module 2 synchronizes with the active CPU module 1 at each control cycle and performs the same operations in parallel. However, the standby CPU module 2 acquires the same input data as the active CPU module 1 and performs the same control processing, but does not perform output processing. The redundancy processing unit 120 has a redundancy operation switching unit 121 and a redundancy operation recovery unit 122. The redundancy processing unit 220 has a redundancy operation switching unit 221 and a redundancy operation recovery unit 222.

[0030] The redundant operation switching units 121 and 221 switch the standby CPU module 2 to the active side if a hardware abnormality such as a bit error occurs in the active CPU module 1. The CPU module 2 that has been switched to the active side then operates in single-mode.

[0031] On the other hand, if a hardware malfunction occurs in the standby CPU module 2, the redundancy operation switching units 121 and 221 change the active CPU module 1 to single operation to continue processing.

[0032] The redundancy operation switching unit 121, if a hardware abnormality such as a bit error occurs in the active CPU module 1, switches to the standby CPU module 2 and then restarts the active CPU module 1. The redundancy operation switching unit 221, if a hardware abnormality such as a bit error occurs in the standby CPU module 2, restarts the standby CPU module 2 while continuing to operate the active CPU module 1.

[0033] Since the redundant operation recovery unit 122 and the redundant operation recovery unit 222 have the same function, the redundant operation recovery unit 122 will be used as an example in this explanation. The redundant operation recovery unit 122 is called after the CPU module 1 is restarted. If the redundant operation recovery unit 122 does not detect a hardware abnormality in the CPU module 1, it determines that it is a soft error and works in cooperation with the redundant operation recovery unit 222 to restore single operation to redundant operation.

[0034] The control unit 110 has an input unit 101, a control processing unit 102, and an output unit 103. The control unit 210 has an input unit 201, a control processing unit 202, and an output unit 203.

[0035] Input units 101 and 201 collect input data necessary for process control. This input data includes, for example, sensor temperature and pressure.

[0036] Output units 103 and 203 output values ​​necessary for process control. Output units 103 and 203 transmit output data to actuators such as valves to perform valve opening and closing operations. However, in a redundant configuration, output unit 203 of the standby CPU module 2 before switching and output unit 103 of the former active CPU module 1 after switching do not output data.

[0037] The control processing unit 102 includes a processing result verification unit 111, a processing result repair unit 112, and a processing result storage table 113. The control processing unit 202 includes a processing result verification unit 211, a processing result repair unit 212, and a processing result storage table 213.

[0038] Control processing unit 102 and control processing unit 202 have the same function and perform the same processing. That is, the processing result verification unit 111, the processing result repair unit 112, and the processing result storage table 113 have the same function as the processing result verification unit 211, the processing result repair unit 212, and the processing result storage table 213, respectively. Therefore, the following explanation will use the control processing unit 102, as well as the processing result verification unit 111, the processing result repair unit 112, and the processing result storage table 113 as examples.

[0039] The control processing unit 102 receives data collected by the input unit 101, inputs it to the control logic, and executes control processing. In this embodiment, the control processing unit 102 executes periodic processing, which is repeated at a fixed interval. This periodic processing is control processing. The control processing unit 102 passes the processing result data obtained from the control processing to the output unit 103 at each period.

[0040] Periodic processing includes, for example, continuous control, which is a type of control that constantly monitors process variables and adjusts the output to approach a set target value. Continuous control is considered periodic processing because the adjustment to the target value is performed periodically. Specifically, examples of continuous control include PID (Proportional Integral Derivative) control, continuous material input and temperature control in chemical plants, and continuous water flow control in water treatment plants. In continuous control, for example, the control processing unit 102 continuously adjusts the output according to the difference (deviation) from the target value, such as temperature or pressure.

[0041] The processing result verification unit 111, the processing result repair unit 112, and the processing result storage table 113 are independent of the control processing performed by the control unit 110. Furthermore, the processing result verification unit 111, the processing result repair unit 112, and the processing result storage table 113 detect soft errors that occur in periodic processing performed at fixed intervals by the control unit 110 and repair the processing results. However, since soft errors rarely occur consecutively in a short period, the detection of soft errors in processing performed by the processing result verification unit 111 or the processing result repair unit 112 after a soft error occurs is excluded.

[0042] In the following, the process of detecting a soft error and repairing the processing result will be referred to as the "soft error repair process." The detection of a soft error will be referred to as "soft error detection." Among the control cycles of the periodic processing that is the target of soft error detection, the control cycle that is the most recent and executes the processing that is the target of soft error detection at that time will be referred to as the "current cycle." The cycle immediately preceding a particular cycle will be referred to as the "previous cycle," and the cycle immediately following a particular cycle will be referred to as the "next cycle." Furthermore, among the processes executed by the control unit 110, control processes other than those performed by the processing result verification unit 111 or the processing result repair unit 112 will simply be referred to as "control processes."

[0043] The following soft error detection is based on the following conditions: A match in the comparison results is achieved only if no soft errors occur in either CPU module 1 or 2. Therefore, if the comparison results do not match, it is assumed that a soft error has occurred in either CPU module 1 or 2.

[0044] Furthermore, the frequency of occurrence is based on the following assumptions: Since soft errors occur very rarely, even if a soft error occurs, it will occur in either CPU module 1 or 2, and will only occur once within the same control cycle. Therefore, a second soft error will not occur within the same control cycle in which the first soft error occurred.

[0045] The processing result verification unit 111 is called before the start of periodic processing to initialize the processing result storage table 113. In addition, the processing result verification unit 111 compares the control processing results from the control unit 110 with the control processing results from the control unit 210 in order to detect soft errors during periodic control processing. Specifically, the processing result verification unit 111 performs the following processing.

[0046] The processing result comparison unit 111 exchanges the processing results of the control processing unit 102 of CPU module 1 and the processing results of the control processing unit 202 of CPU module 2 with the processing result comparison unit 211 of CPU module 2. Next, the processing result comparison unit 111 compares the processing results of the control processing unit 102 of CPU module 1 and the processing results of the control processing unit 202 of CPU module 2.

[0047] Next, the processing result verification unit 111 and the processing result verification unit 211 of the CPU module 2 exchange the verification results they each performed. Then, the processing result verification unit 111 compares its own verification result with the verification result obtained by the processing result verification unit 211.

[0048] Here, we will explain the difference between matching processing results and comparing matching results. Processing results are the results of periodic processing, which is a fixed-period control process. For example, processing results are the output values ​​performed at the end of the control cycle. Processing results are obtained by the control processing of the control processing unit 102 of CPU module 1 and the control processing unit 202 of CPU module 2, respectively.

[0049] The verification of the control processing results involves comparing the results of the control processing between CPU module 1 and CPU module 2. Therefore, a match in the verification results indicates that the processing results of the control processing are equal between CPU module 1 and CPU module 2, and that no soft errors occurred during the control processing. For example, the verification of processing results is the process of determining whether the processing result of control processing unit 102 matches the processing result of control processing unit 202.

[0050] The comparison result is information indicating whether the processing result of the control processing unit 102 and the processing result of the control processing unit 202 match or do not match. The comparison result is obtained by the processing result comparison unit 111 of CPU module 1 and the processing result comparison unit 211 of CPU module 2, respectively. The comparison of the comparison results is performed by comparing the comparison results of CPU module 1 and CPU module 2 with those of the processing result comparison unit 111. Matching of the comparison results indicates that the comparison results are equal between CPU module 1 and CPU module 2, and that no soft errors occurred during the comparison.

[0051] Figure 3 shows the criteria for determining the occurrence of a soft error. The processing result verification unit 111 determines whether or not a soft error has occurred, as shown in Figure 3, based on the results of verifying the processing results of the control process and comparing the verification results. Figure 3 shows the comparison and verification conditions in CPU modules 1 and 2, as well as the conditions for the occurrence of a soft error, along with examples of judgments for each condition. In addition, each condition is classified into judgments #1 to #4 according to the judgment examples. The process by which the processing result verification unit 111 determines the occurrence of a soft error will be explained according to Figure 3.

[0052] (Determination #1) If the processing results of the control processes performed by CPU module 1 and CPU module 2 match, and the matching result of the processing result matching unit 111 matches the matching result of the processing result matching unit 211, the processing result matching unit 111 determines that no soft errors occurred in the current cycle's control processing. In this case, since the processing result is correct, the processing result matching unit 111 allows the control unit 110 to continue its control processing as is. The processing result matching unit 111 saves the processing result of the current cycle to the processing result storage table 113.

[0053] (Decision #4) If the processing results of the control processes performed by CPU module 1 and CPU module 2 match, and the matching result of the processing result matching unit 111 does not match the matching result of the processing result matching unit 211, it is considered that a soft error occurred in either CPU module 1 or CPU module 2 during the comparison of the matching results, and the control processing by the control processing unit 102 was performed normally. Therefore, if the processing results of the control processes performed by CPU module 1 and CPU module 2 match, and the matching result of the processing result matching unit 111 does not match the matching result of the processing result matching unit 211, the processing result matching unit 111 determines that no soft error occurred in the control processing of the current cycle. In this case, since the processing result of the control processing is correct, the processing result matching unit 111 continues the control processing of the control unit 110 as is. The processing result matching unit 111 saves the processing result of the current cycle to the processing result storage table 113.

[0054] (Decision #2) In contrast, if the comparison of the processing results of the control processes performed by CPU module 1 and CPU module 2 is inconsistent, and the comparison result of the processing result comparison unit 111 matches the comparison result of the processing result comparison unit 211, it is considered that a soft error occurred in the control process of the current cycle in either CPU module 1 or CPU module 2, and no further soft errors have occurred in either since. Therefore, if the comparison of the processing results of the control processes performed by CPU module 1 and CPU module 2 is inconsistent, and the comparison result of the processing result comparison unit 111 matches the comparison result of the processing result comparison unit 211, the processing result comparison unit 111 determines that a soft error occurred in the control process of the current cycle. In other words, the processing result comparison unit 111 detects a soft error in the control process of the current cycle. The processing result comparison unit 111 then requests the processing result repair unit 112 to repair the processing result.

[0055] For example, consider a case where the control unit 110 experiences a soft error during control processing, outputting 40% for the valve opening / closing degree instead of the expected 60%. In this case, both the processing result verification units 111 and 211 determine that their processing results are inconsistent, and since both processing results are inconsistent, they determine that the verification result is a match. The processing result verification unit 111 then requests the processing result repair unit 112 to repair the processing result, and the processing result verification unit 211 requests the processing result repair unit 212 to repair the processing result.

[0056] (Decision #3) If the results of the control processes performed by CPU module 1 and CPU module 2 do not match, and the results of the processing result comparison unit 111 and the processing result comparison unit 211 do not match, it is considered that a soft error occurred in either CPU module 1 or CPU module 2 during the comparison of processing results, and the control processing by the control processing unit 102 was performed normally. Therefore, if the results of the control processes performed by CPU module 1 and CPU module 2 do not match, and the results of the processing result comparison unit 111 and the processing result comparison unit 211 do not match, the processing result comparison unit 111 determines that no soft error occurred in the current cycle's control processing. In this case, since the processing result of the control process is correct, the processing result comparison unit 111 allows the control unit 110 to continue its control processing as is. The processing result comparison unit 111 saves the processing result of the current cycle to the processing result storage table 113.

[0057] For example, let's consider a case where both control units 110 and 210 output a correct valve opening / closing degree of 60%, but a soft error occurs in the processing result verification unit 111. In this case, the processing result verification unit 111 determines that the processing results are inconsistent, while the processing result verification unit 211 determines that the processing results are consistent. Therefore, the processing result verification unit 111 determines that the verification results are inconsistent. The processing result verification unit 111 then continues the control processing of the control unit 110.

[0058] If a soft error occurs in either CPU module 1 or 2, the processing result repair units 112 and 212 retrieve information from the processing result storage table 113 or 213 and overwrite it to restore the correct processing result. Specifically, the processing result repair unit 112 performs the following process.

[0059] The processing result repair unit 112 receives a request from the processing result verification unit 111 to repair the processing result. Next, the processing result repair unit 112 obtains the processing result of the previous cycle from the processing result storage table 113. Then, the processing result repair unit 112 uses the processing result of the previous cycle as the control processing result of the current cycle. The processing result repair unit 112 may also re-execute the control processing of the current cycle using the processing result of the previous cycle.

[0060] The processing result repair units 112 and 212 both repair the processing results, thereby resolving the issue of being unable to identify which CPU module 1 or 2 experienced the soft error. In other words, by having the control units 110 and 210 both repair the processing results, the control process can proceed normally regardless of whether the soft error occurred in CPU module 1 or 2. Furthermore, the processing result repair unit 112 solves the problem of being unable to identify incorrect information due to the soft error by overwriting the set of data to be carried over to the next cycle's periodic processing with the data from the previous cycle where no soft error occurred. In other words, the control unit 110 can proceed normally regardless of which information was incorrect due to the soft error.

[0061] The processing result storage tables 113 and 213 are storage tables used to overwrite and repair the processing result with the correct result when there is a suspicion that the processing result is incorrect due to a soft error. The information stored in the processing result storage tables 113 and 213 is a collection of all values ​​that, if overwritten with an incorrect value due to a soft error, will also result in an incorrect result for the control logic of the next cycle. In other words, the information stored in the processing result storage tables 113 and 213 is used to calculate the output value for the next cycle relative to the previous cycle, using the value generated in the previous cycle.

[0062] Figure 4 shows an example of a processing result storage table. For example, as shown in Figure 4, the processing result storage table 113 stores the valve opening / closing degree and the total liquid flow rate.

[0063] The valve opening / closing degree is the absolute value of the valve opening / closing degree output for each processing cycle. When calculating the opening / closing degree (relative value) to increase or decrease in the current cycle compared to the previous cycle's opening / closing degree of 50%, if the absolute value of the valve opening / closing degree is incorrect, the calculated output will also be incorrect.

[0064] The total liquid flow rate is the cumulative value of the liquid that flowed through the pipeline at the end of each processing cycle. The total flow rate for the current cycle is calculated by adding the flow rate from the current cycle to the total flow rate of 150 liters from the previous cycle. Therefore, if the cumulative value from the previous cycle is incorrect, the calculated output will also be incorrect.

[0065] (Soft error correction process) Figure 5 is a flowchart of the soft error repair process by the CPU module according to the first embodiment. Next, referring to Figure 5, the flow of the soft error repair process by CPU module 1 or 2 according to this embodiment will be explained. Here, CPU module 1 will be used as an example.

[0066] The control processing unit 102 acquires the data collected by the input unit 101 (step S1).

[0067] Next, the control processing unit 102 inputs the data into the control logic and executes the control process (step S2).

[0068] The processing result comparison unit 111 exchanges the processing results of the control processing unit 102 of CPU module 1 and the processing results of the control processing unit 202 of CPU module 2 with the processing result comparison unit 211 of the CPU module 2 that is the redundancy partner (step S3).

[0069] Next, the processing result comparison unit 111 compares the processing result of the control processing unit 102 of CPU module 1 with the processing result of the control processing unit 202 of CPU module 2 (step S4).

[0070] Furthermore, the processing result verification unit 111 exchanges its own verification result with the processing result verification unit 211 of the CPU module 2, which is the redundancy partner, (step S5).

[0071] Next, the processing result comparison unit 111 compares its own comparison result with the comparison result obtained by the processing result comparison unit 211 (step S6).

[0072] The processing result verification unit 111 determines whether the processing results match (step S7). If the processing results match (step S7: affirmative), the processing result verification unit 111 determines that no soft errors occurred during the control process and proceeds to step S11.

[0073] In contrast, if the processing results do not match (step S7: negative), the processing result matching unit 111 determines whether the matching results match or not (step S8). If the matching results do not match (step S8: negative), the processing result matching unit 111 determines that no soft error occurred during the control processing and proceeds to step S11.

[0074] In response, if the matching results match (Step S8: Affirmative), the processing result matching unit 111 determines that the soft error occurred during control processing and requests the processing result repair unit 112 to repair the processing result. The processing result repair unit 112 receives the request and retrieves the processing result from the processing result storage table 113 for the previous cycle (Step S9).

[0075] Next, the processing result repair unit 112 uses the processing result from the previous cycle as the processing result for the current cycle (step S10).

[0076] On the other hand, if the processing results match (step S7: affirmative) or if the comparison results do not match (step S8: negative), the processing result comparison unit 111 saves the processing results for the current cycle to the processing result storage table 113 (step S11).

[0077] The control processing unit 102 determines whether the CPU module 1 is active or not (step S12). If the CPU module 1 is in standby mode (step S12: negative), the control processing unit 102 proceeds to step S14.

[0078] In response to this, if CPU module 1 is active (step S12: affirmative), the control processing unit 102 sends output data including the processing result of the current cycle to the output unit 103 (step S13).

[0079] Subsequently, the control processing unit 102 determines whether or not to terminate the control process (step S14).

[0080] If the control process is not terminated (step S14: negative), the control processing unit 102 sleeps until the elapsed time from the start of the cycle reaches the fixed cycle time (step S15). When the elapsed time from the start of the cycle reaches the fixed cycle time, the control processing unit 102 returns to step S1.

[0081] On the other hand, if the control process is to be terminated (step S14: affirmative), the control processing unit 102 stops operating and terminates the control process.

[0082] (Dual-function operation process) Here, we will explain an example of the workflow for redundant operation processing. Here, CPU modules 1 and 2 are not distinguished as active or standby, and are both considered to be either active or standby, and are described as CPU module 3 without distinction. Also, redundant operation switching units 121 and 221 are described as redundant operation switching unit 321 without distinction. Furthermore, redundant operation recovery units 122 and 222 are described as redundant operation recovery unit 322 without distinction.

[0083] Figure 6 is a flowchart of the operation of the redundant operation switching unit. The operation of the redundant operation switching unit 321 will be explained with reference to Figure 6.

[0084] The memory unit 130 or 230 detects a bit error through the function of the memory circuit unit 12 or 22 (step S21).

[0085] The redundant operation switching unit 321 determines whether or not a bit error has been detected in the active CPU module 3 (step S22).

[0086] If a bit error is detected in the active CPU module 3 (step S22: affirmative), the redundancy operation switching unit 321 switches the standby CPU module 3 to perform control processing for the active CPU module 3 (step S23).

[0087] Then, the redundant operation switching unit 321 restarts the active CPU module 3 (step S24).

[0088] In response to this, if a bit error is detected in the standby CPU module 3 (step S22: negative), the redundancy operation switching unit 321 switches the active CPU module 3 to single operation (step S25).

[0089] Then, the redundant operation switching unit 321 restarts the standby CPU module 3 (step S26).

[0090] Figure 7 is a flowchart of the operation of the redundant operation recovery unit. Next, the operation of the redundant operation recovery unit 322 will be explained with reference to Figure 7.

[0091] The redundant operation switching unit 321 restarts the CPU module 3 upon detection of a bit error (step S31).

[0092] The restarted CPU module 3 determines whether or not an abnormality was detected in its own memory circuit section 12 or 22 during startup (step S32).

[0093] If an abnormality is detected (step S32: affirmative), the redundant operation recovery unit 322 determines that the bit error is a permanent failure of the memory circuit section 12 or 22 of the restarted CPU module 3 (step S33).

[0094] Then, the redundancy operation recovery unit 322 on the restarted side of the CPU module 3 stops the restarted CPU module 3 (step S34).

[0095] In contrast, if no abnormality is detected (step S32: negative), the redundancy operation recovery unit 322 of the restarted CPU module 3 determines whether the active CPU module 3 has started up or not (step S35).

[0096] If the active CPU module 3 is already started (step S35: affirmative), the redundancy operation recovery unit 322 starts the CPU module 3 to be restarted as the standby module (step S36).

[0097] Subsequently, the redundant operation recovery unit 322 initiates redundant operation between the CPU modules 3 (step S37).

[0098] In contrast, if the active CPU module 3 is not already started (step S35: negative), the redundancy operation recovery unit 322 starts the CPU module 3 to be restarted as the active one (step S38).

[0099] Subsequently, the redundant operation recovery unit 322 starts single operation of the activated CPU module 3 (step S39).

[0100] Here, periodic processing is an example of "multiple processes," and the periodic control process is an example of "control processing that performs multiple processes in sequence." More specifically, the periodic control process is an example of "control processing that repeats processing at a fixed period and performs multiple processes in sequence." Furthermore, the result of comparing the processing results by the processing result comparison units 111 and 211 is an example of a comparison result. Furthermore, the result of comparing each of the results of the processing result comparison by the processing result comparison units 111 and 211 is an example of a "comparison result."

[0101] Specifically, the logic circuit units 11 and 21, which are processors, execute control processing that performs multiple processes in sequence, compare the result of the current process with the result of the current process of the other information processing device, and compare their own comparison result with the comparison result of the other information processing device. Then, the logic circuit units 11 and 21, which are processors, detect soft errors based on their own comparison result and comparison result, and if a soft error is detected, both devices acquire the processing result and continue the control processing. Furthermore, the logic circuit units 11 and 21, which are processors, detect a soft error if the comparison result does not match but the comparison result does match. Furthermore, if the comparison result does match, or if the comparison result does not match and the comparison result does not match, the logic circuit units 11 and 21, which are processors, continue the control processing using the result of the current process. Also, the final result of the previous cycle is an example of a "periodic result in the previous cycle" and is an example of a "result of the previous processing". Furthermore, the final result of the current cycle is an example of a "periodic result in the current cycle" and is an example of a "result of the current processing". The logic circuit units 11 and 21, which are processors, execute control processing that repeats processing at a fixed interval and performs multiple processes in sequence. If a soft error is detected, the result of the previous processing in the current period is used as the result of the current processing in the current period.

[0102] As described above, the logic circuit units 11 and 21, which are processors, duplicate two information processing units, CPU modules 1 and 2, with one being the active side (operational side) and the other the standby side (waiting side). When an error is detected in the data stored in the memory of one of the information processing units, the logic circuit units 11 and 21 switch the other information processing unit to the operational side.

[0103] (effect) As described above, the process control system 100 according to this embodiment exchanges and verifies the processing results of the control process in each of the redundant CPU modules 1 and 2, and also exchanges and compares the results of the processing result verification. The process control system 100 then detects a soft error according to the processing result verification result and the comparison result of the verification result, and if a soft error is detected, the processing result of the previous cycle is set as the processing result of the current cycle.

[0104] As a result, the process control system 100 can correct errors caused by soft errors and continue correct control processing without having to determine whether the soft error occurred in CPU module 1 or 2. Furthermore, the process control system 100 can continue correct control processing without having to identify the erroneous data caused by the soft error. Therefore, the reliability of the process control system 100 can be improved by avoiding the adverse effects of erroneous data when a soft error occurs.

[0105] (Comparison with a triple-redundancy configuration) A comparison between the process control system 100 according to this embodiment and a triple-redundancy configuration using three identical CPU modules 1 to 3 will be described. For example, the triple-redundancy configuration can consist of one active CPU module 1 and two standby CPU modules 2 and 3. In this case, the processing result comparison unit 111 of the active CPU module 1 collects the processing results of the standby CPU modules 2 and 3 and compares the processing results. Since one of the three processing results is an incorrect result due to a soft error, the processing result comparison unit 111 can determine the correct processing result and the incorrect processing result by majority vote of the processing results.

[0106] However, the process control system 100 according to this embodiment, which has a redundant configuration, is fundamentally superior to the triple-redundant configuration in the following two respects. The first advantage is its superiority from a hardware perspective. Because the redundant configuration uses fewer components than the triple-redundant configuration, the process control system 100 according to this embodiment has lower implementation costs compared to the triple-redundant configuration. Specifically, the triple-redundant configuration uses three CPU modules, 1 to 3, but the redundant process control system 100 only requires two, CPU modules 1 and 2. Therefore, the process control system 100 according to this embodiment can reduce the number of components and costs to two-thirds compared to the triple-redundant configuration, and the probability of failure can also be reduced.

[0107] The second advantage is its superiority from a software perspective. Because the processing involved in the redundancy configuration is simpler in the dual configuration than in the triple configuration, the process control system 100 according to this embodiment reduces implementation effort and the risk to program quality compared to the triple configuration. The processing involved in the redundancy configuration refers to redundancy processing and soft error avoidance processing. Redundancy processing includes synchronization, equalization, and switching of multiplexed operations. In the process control system 100 according to this embodiment, for example, the dual processing unit 120 only needs to perform dual processing based on its relationship with CPU module 2. In contrast, in the triple configuration, for example, the triple processing unit of CPU module 1 needs to perform triple processing based on its relationship with CPU modules 2 and 3, respectively. Soft error avoidance processing is, for example, the processing performed by the processing result verification unit 111 and the processing result repair unit 112 according to this embodiment. The amount of verification processing required by the processing result verification unit 111 in CPU modules 1 and 2 is only 1 / 3 of the amount of verification processing required in CPU modules 1 to 3. Furthermore, the amount of processing required to repair the processing results is not significantly different whether it is the process control system 100 according to this embodiment or a triple-redundant configuration, as it only repairs two CPU modules, either CPU modules 1 and 2 or CPU modules 2 and 3.

[0108] (Second Embodiment) Next, a second embodiment will be described. Since soft errors occur when invisible external energy particles accidentally collide with the element, the tendency for soft errors to occur is unknown. Therefore, even if a soft error is avoided by using the processing result of the previous period as the processing result of the current period when a soft error occurs, it is difficult to determine whether the effect of the avoidance measure is sufficiently large or whether the avoidance measure needs to be further strengthened. In addition, knowing the tendency for soft errors to occur would require setting up a large-scale measuring instrument to visualize the collision of energy particles and measuring over a long period of time, which is impractical. Therefore, it is preferable to be able to measure the effect of soft error avoidance measures using general-purpose CPU modules 1 and 2 without using special hardware. However, there are the following technical challenges in measuring the effect of soft error avoidance measures using general-purpose CPU modules 1 and 2.

[0109] The first challenge is the inability to determine whether soft error avoidance measures are truly necessary in a redundant configuration. Hardware components are improving year by year, and the process control system 100 uses components that significantly reduce the frequency of soft errors. However, the process control system 100 does not collect statistical information on the actual frequency of soft errors across the entire system. For example, if the continuous operating period of the equipment is five years until the statutory periodic inspection, and soft errors can be kept to almost zero during that time, then avoidance measures are unnecessary. However, because there is no statistical information, it is difficult to decide whether or not to implement soft error avoidance measures.

[0110] The second challenge is that even with the same model and using the same components, the frequency of soft errors varies, making it difficult to understand the occurrence trends and determine whether workarounds are effective. The occurrence of soft errors varies considerably depending on the equipment's condition, such as its installation location and usage, ranging from zero occurrences for several years to at least one occurrence per year. Therefore, even if soft errors can be detected, simply logging the number of occurrences does not reveal the occurrence trends based on the equipment's condition. In other words, it is difficult to appropriately implement workarounds for soft errors based on the observed occurrence trends.

[0111] Figure 8 is a block diagram of the process control system according to the second embodiment. In addition to the parts shown in Figure 2, the process control system 100 according to this embodiment includes a control processing unit 102 which has a soft error information collection unit 114 and a soft error information storage table 115. Furthermore, the control processing unit 202 includes a soft error information collection unit 214 and a soft error information storage table 215. In the following description, the operation of parts similar to those in the first embodiment may be omitted. Also, since CPU module 1 and CPU module 2 perform similar operations, the operation of CPU module 1 will be used as an example in the following description.

[0112] The process control system 100 according to this embodiment collects statistical information on the frequency of soft errors from the time the equipment is manufactured until it is discarded. Furthermore, in order to confirm the trend of soft errors, the process control system 100 adds information about how the equipment is used to the information that notifies the occurrence of a soft error when a soft error occurs.

[0113] The soft error information storage table 115 includes, for example, information on how the equipment is used and soft error occurrence log information. The equipment usage information is added each time the way the process control system 100 is used changes. On the other hand, the soft error occurrence log information is a record of when a soft error occurred, and the equipment usage information at that time is added. The soft error information storage table 115 is stored in non-volatile memory, so the registered information is not lost even if the CPU module 1 stops.

[0114] Figure 9 shows an example of equipment usage information. The soft error information storage table 115 may include the table 302 shown in Figure 9 as equipment usage information.

[0115] As shown in Table 302, the equipment usage information includes information related to the characteristics of soft error occurrence, encompassing three categories: equipment installation information, equipment configuration information, and equipment operation information. More detailed usage items within each category shown in Table 302 can be added as needed when soft errors occur frequently, and are used to narrow down the types of usage that cause frequent soft errors. The details of each category of equipment usage information and each item within each category are described below.

[0116] Equipment installation information refers to information about the installation environment of the equipment, including CPU modules 1 and 2. The type and amount of energy particles that affect the equipment may vary depending on the installation environment. Equipment installation information includes, for example, geographical location (latitude, longitude, altitude, sea level), weather (weather, atmospheric pressure, temperature, humidity), and environmental conditions (outdoor, indoor, electrical noise).

[0117] The device configuration information refers to the hardware configuration of the device, including CPU modules 1 and 2. The hardware configuration can affect the arrival and collision of energy particles that may impact the device. The device configuration information includes the configuration of I / O (Input / Output) devices connected to the device, the network configuration, and the configuration of CPU module 1 (redundancy, single, etc.).

[0118] Equipment operation information refers to information about the operating status of the equipment, including CPU modules 1 and 2. Depending on the operating status, the durability of hardware components against collisions of energy particles that affect the equipment may change. Equipment operation information includes manufacturing / diagnosis / maintenance of hardware components (power supply, CPU modules 1 and 2, I / O modules), continuous operating period, and operating load (CPU, I / O, or network load, etc.).

[0119] Figure 10 shows an example of soft error occurrence log information. The soft error information storage table 115 may include the table 303 shown in Figure 10 as soft error occurrence log information. The soft error occurrence log information shown in table 303 indicates that no soft errors occurred when ID 1 was used, and two soft errors occurred when ID 2 was used.

[0120] Returning to Figure 8, the explanation continues. When the way the process control system 100 is used changes, the soft error information collection unit 114 receives information about how the equipment is being used via the input unit 101. The soft error information collection unit 114 then stores the acquired information about how the equipment is being used in the soft error information storage table 115.

[0121] Furthermore, when a soft error occurs, the soft error information collection unit 114 stores the processing results of the control process and product usage information in the soft error information storage table 115. Specifically, when the processing results of CPU module 1 and CPU module 2 do not match but the comparison results match, the soft error information collection unit 114 receives an instruction from the processing result comparison unit 111 to collect a soft error occurrence log.

[0122] When the soft error information collection unit 114 receives an instruction to collect soft error occurrence logs, it collects information about the soft error occurrence, such as the time and circumstances of the soft error. By collecting and accumulating information about the soft error occurrence, the soft error information collection unit 114 collects statistical information on the frequency of soft errors.

[0123] Furthermore, the soft error information collection unit 114 acquires information on how the equipment is used, which is included in the soft error information storage table 115. The soft error information collection unit 114 then generates soft error occurrence log information from the collected information on when the soft error occurred and the information on how the equipment is used, and stores it in the soft error information storage table 115.

[0124] Figure 11 is a flowchart of the soft error repair process by the CPU module according to the second embodiment. Next, the flow of the soft error repair process by CPU module 1 or 2 according to this embodiment will be explained with reference to Figure 11. Here, CPU module 1 will be used as an example.

[0125] The processes enclosed in the dashed box in Figure 11 are different from the processes shown in the flow chart in Figure 5. Specifically, the processes in steps S101 to S108 are the same as the processes in steps S1 to S8 in Figure 5, and the processes in steps S110 to S116 are the same as the processes in steps S9 to S15 in Figure 5. Below, we will omit the explanation of processes that are the same as in Figure 5 and explain the differences in the processes.

[0126] If the matching results match (step S108: affirmative), the processing result matching unit 111 instructs the soft error information collection unit 114 to collect the soft error occurrence log. The processing result matching unit 111 also requests the processing result repair unit 112 to repair the processing result. Upon receiving the instruction to collect the soft error occurrence log, the soft error information collection unit 114 stores the soft error occurrence log information, which includes information on how the equipment was used in addition to the information at the time of the soft error, in the soft error information storage table 115 (step S109). After that, the processing result repair unit 112 proceeds to step S109.

[0127] In this way, the logic circuit units 11 and 21, which are processors, collect information on how the CPU module 1 or 2, which is an information processing device, is used. The logic circuit units 11 and 21, which are processors, then collect statistical information on the frequency of soft errors and store it together with information on how the CPU module 1 or 2, which is an information processing device, was used at the time each soft error occurred.

[0128] (effect) As described above, the process control system 100 according to this embodiment stores soft error occurrence log information in the soft error information storage table 115 when an error occurs. This log information includes information about how the equipment was used, in addition to the information about when the soft error occurred. By referring to the soft error occurrence log information, users can understand the frequency and trend of soft errors and determine soft error avoidance measures based on the frequency and trend. Therefore, the process control system 100 can help users make appropriate judgments about whether soft error avoidance measures are necessary and whether those measures are effective. Furthermore, by showing the trend of soft errors, the process control system 100 can provide users with the possibility of discovering new software countermeasures at the product level.

[0129] (Third embodiment) Next, a third embodiment will be described. Figure 12 is a block diagram of the process control system according to the third embodiment. The process control system 100 according to this embodiment employs techniques to avoid adverse effects of soft errors on periodic control processing, such as executing non-periodic processing like sequence control and duplication processing.

[0130] For example, sequence control, an example of aperiodic processing, is a type of control that operates machines and equipment sequentially and step-by-step according to a predetermined procedure or sequence of operations. A procedure can be a well-defined group of processes that allows for the saving of results within a series of controls. A procedure may contain multiple processes or just one process. A procedure may be the smallest unit of processing from which a result can be obtained. Sequence control is a type of aperiodic processing because it operates according to a predetermined procedure in order. In a sequence control unit, multiple operations are executed in a predetermined order, and the process may be interrupted midway. Specifically, sequence control is the control of a series of operations with a predetermined order, such as an automatic door opening and closing, a conveyor belt stopping and starting, or parts flowing one after another and being processed on a manufacturing line. Unlike feedback control, sequence control does not involve periodic control such as automatic adjustment to a target value; rather, it faithfully executes a predetermined procedure.

[0131] Techniques for avoiding adverse effects of soft errors on periodic control processes are difficult to apply directly to non-periodic processes. Therefore, the process control system 100 according to this embodiment avoids adverse effects of soft errors on non-periodic processes in the same way as on periodic processes. In the following description, the operation of parts similar to those in the first embodiment may be omitted.

[0132] In the process control system 100 according to this embodiment, the control processing unit 102 of CPU module 1 includes an intermediate result verification unit 116, an intermediate result repair unit 117, and an intermediate result storage table 118. The control processing unit 202 of CPU module 2 includes an intermediate result verification unit 216, an intermediate result repair unit 217, and an intermediate result storage table 218.

[0133] Control processing unit 102 and control processing unit 202 have the same function and perform the same processing. That is, the intermediate result verification unit 116, the intermediate result repair unit 117, and the intermediate result storage table 118 have the same function as the intermediate result verification unit 216, the intermediate result repair unit 217, and the intermediate result storage table 218, respectively. Therefore, the control processing unit 102, as well as the intermediate result verification unit 116, the intermediate result repair unit 117, and the intermediate result storage table 118 will be explained below as examples.

[0134] The control processing unit 102 executes a control process that is aperiodic. Hereinafter, a control process that is aperiodic will simply be referred to as "aperiodic processing." Herein, aperiodic processing is processing that includes multiple steps. The control processing unit 102 completes the execution of the entire aperiodic processing by executing all the steps included in the aperiodic processing in order. Among the steps included in the aperiodic processing, the latest step, which is the step that is the target of soft error detection at the present time, is called the "current step," the step immediately preceding a particular step is called the "previous step," and the step immediately following a particular step is called the "next step."

[0135] The intermediate result matching unit 116 is called before the start of non-periodic processing to initialize the intermediate result storage table 118. The intermediate result matching unit 116 is also called at the timing of matching during non-periodic processing.

[0136] When called at the timing of the comparison, the intermediate result comparison unit 116 exchanges the intermediate results obtained from processing a specific procedure in the non-periodic processing with the intermediate result comparison unit 216 of the CPU module 2. Note that the intermediate result comparison unit 116 and the intermediate result comparison unit 216 execute the same procedure in the non-periodic processing at the same timing and exchange the intermediate results obtained from processing the same procedure.

[0137] The intermediate result comparison unit 116 compares the intermediate results obtained from processing a specific procedure in the non-periodic processing executed by the control processing unit 102 with the intermediate results obtained from processing a specific procedure in the non-periodic processing executed by the control processing unit 202. The intermediate result comparison unit 116 corresponds to the processing result comparison unit 111 in the first embodiment, and the intermediate results in the non-periodic processing correspond to the processing results of the periodic processing.

[0138] Intermediate results represent the processing results up to the timing of the comparison. The timing of the comparison is before CPU module 1 outputs or sends data to the outside, and at each processing demarcation. Processing demarcations include, for example, immediately before and immediately after a function call, immediately before and immediately after the start and end of a conditional branch, and immediately before the start and immediately after the end of each iteration of a loop. The processing performed from one comparison timing to the next comparison timing constitutes one step of the process.

[0139] Furthermore, the intermediate result verification unit 116 exchanges the verification results of intermediate results obtained in processing a specific procedure in the non-periodic processing with the intermediate result verification unit 216 of the CPU module 2.

[0140] The intermediate result verification unit 116 performs error detection using the exchanged verification results as follows. The following soft error detection is based on the following conditions: The verification results match only if no soft errors occur in either CPU module 1 or 2. Therefore, if the verification results do not match, it is considered that a soft error has occurred in either CPU module 1 or 2.

[0141] Furthermore, the frequency of occurrence is based on the following assumptions: Since soft errors occur very rarely, when a soft error does occur, it occurs only once within the processing of either CPU module 1 or 2. Therefore, a second soft error will not occur within the same procedure in which the first soft error occurred.

[0142] If the comparison of the intermediate results of the current procedure performed by CPU module 1 and CPU module 2 matches, and the comparison result of the intermediate result comparison unit 116 matches the comparison result of the intermediate result comparison unit 216, then the intermediate result comparison unit 116 determines that no soft errors occurred during the processing from the next process after the previous comparison to the processing during the current comparison, that is, from the end of the previous procedure to the completion of the current procedure. The intermediate result comparison unit 116 continues the asynchronous processing of the control unit 110 as is. Then, the intermediate result comparison unit 116 saves the intermediate results of the current procedure to the intermediate result storage table 118. (Corresponds to determination #1 in Figure 3)

[0143] If the comparison of the intermediate results of the current procedure performed by CPU module 1 and CPU module 2 matches, and the comparison result of the intermediate result comparison unit 116 does not match the comparison result of the intermediate result comparison unit 216, then it is considered that a soft error occurred in either CPU module 1 or CPU module 2 during the comparison of the comparison results, and the processing of the current procedure by the control processing unit 102 was performed normally. Therefore, if the comparison of the intermediate results of the current procedure performed by CPU module 1 and CPU module 2 matches, and the comparison result of the intermediate result comparison unit 116 does not match the comparison result of the intermediate result comparison unit 216, the intermediate result comparison unit 116 determines that no soft error occurred in the current procedure. In this case, since the intermediate result of the current procedure is correct, the intermediate result comparison unit 116 continues the asynchronous processing of the control unit 110 as is. The intermediate result comparison unit 116 saves the processing result of the current procedure to the processing result storage table 113. (Corresponds to determination #4 in Figure 3)

[0144] In contrast, if the results of the current procedure processed by CPU module 1 and CPU module 2 do not match, and the results of the intermediate result verification unit 116 and the intermediate result verification unit 216 match, it is considered that a soft error occurred in either CPU module 1 or CPU module 2 during the current procedure, and no further soft errors have occurred in either module since. Therefore, if the results of the control processing performed by CPU module 1 and CPU module 2 do not match, and the results of the intermediate result verification unit 116 and the intermediate result verification unit 216 match, the intermediate result verification unit 116 determines that a soft error occurred during the current procedure. In other words, the intermediate result verification unit 116 detects a soft error in the current procedure. The intermediate result verification unit 116 then requests the intermediate result repair unit 117 to repair the intermediate result. (Corresponds to determination #2 in Figure 3)

[0145] If the comparison of the intermediate results of the current procedure performed by CPU module 1 and CPU module 2 is inconsistent, and the comparison result of the intermediate result comparison unit 116 is inconsistent with the comparison result of the intermediate result comparison unit 216, then it is considered that a soft error occurred in either CPU module 1 or CPU module 2 during the comparison of the intermediate results, and the current procedure performed by the control processing unit 102 was performed normally. Therefore, if the comparison of the intermediate results of the current procedure performed by CPU module 1 and CPU module 2 is inconsistent, and the comparison result of the intermediate result comparison unit 116 is inconsistent with the comparison result of the intermediate result comparison unit 216, the intermediate result comparison unit 116 determines that no soft error occurred in the current procedure. In this case, since the intermediate result of the current procedure is correct, the intermediate result comparison unit 116 continues the asynchronous processing of the control unit 110 as is. The intermediate result comparison unit 116 saves the processing result of the current procedure to the processing result storage table 113. (Corresponds to determination #3 in Figure 3)

[0146] Intermediate result repair units 117 and 217, when a soft error occurs in either CPU module 1 or 2 during aperiodic processing, each retrieve information from the intermediate result storage table 118 or 218 and overwrite the current intermediate result with the intermediate result obtained in the previous step, thereby repairing the intermediate result to the correct one. Intermediate result repair unit 117 corresponds to the processing result repair unit 112 in the first embodiment, and the intermediate result obtained in the previous step in aperiodic processing corresponds to the processing result of the previous cycle in periodic processing.

[0147] More specifically, if the intermediate result repair unit 117 finds that the intermediate result is inconsistent and the comparison result is correct, it receives a request from the intermediate result comparison unit 116 to repair the intermediate result. The intermediate result repair unit 117 then retrieves the intermediate result obtained in the previous step from the intermediate result storage table 118. Subsequently, the intermediate result repair unit 117 overwrites the current intermediate result with the intermediate result obtained in the previous step. After that, the intermediate result repair unit 117 instructs the control processing unit 102 to re-execute the aperiodic processing from the first step of the current step. Re-executing the current step using the intermediate result of the previous step in the aperiodic processing corresponds to re-executing the current cycle using the processing result of the previous cycle in the first embodiment.

[0148] The intermediate result storage table 118 is a table used by the intermediate result matching unit 116 to store the successful intermediate result from the previous matching match. The intermediate result information stored in the intermediate result storage table 118 is a collection of information necessary to restart the aperiodic processing using the intermediate result obtained in the processing of the previous procedure. Therefore, when a soft error occurs, the intermediate result repair unit 117 overwrites the current intermediate result with the stored intermediate result information obtained in the processing of the previous procedure to restore it to its original value, and then re-executes the current procedure using the intermediate result from the previous procedure. The intermediate result storage table 118 corresponds to the processing result storage table 113 in the first embodiment. The intermediate result storage table 118 is initialized by the intermediate result matching unit 116, which is called before the start of the aperiodic processing.

[0149] Figure 13 shows an example of an intermediate result storage table. For example, if the intermediate results up to the fourth step of a non-periodic process match between CPU module 1 and CPU module 2, the intermediate result storage table 118 will store the intermediate result of the fourth step, as shown in Figure 13.

[0150] For example, let's consider the case where the intermediate result storage table 118 shown in Figure 13 does not match between CPU module 1 and CPU module 2 in the fifth step. In this case, the intermediate result matching unit 116 determines that a soft error has occurred. The intermediate result repair unit 117 then, based on the determination by the intermediate result matching unit 116, overwrites the intermediate result of the previous fourth step stored in the intermediate result storage table 118 with the current intermediate result, restoring the current intermediate result to the value obtained in the fourth step. The control processing unit 102 then restarts execution from the fifth step, after the fourth step.

[0151] Figure 14 is a flowchart of the soft error repair process by the CPU module according to the third embodiment. Next, the flow of the soft error repair process by CPU module 1 or 2 according to this embodiment will be explained with reference to Figure 14. Here, CPU module 1 will be used as an example.

[0152] The processes enclosed in the dashed box in Figure 14 are different from the processes shown in the flow chart in Figure 5. Specifically, the processes in steps S201 to S202 are the same as the processes in steps S1 to S2 in Figure 5, and the processes in steps S214 to S215 are the same as the processes in steps S12 to S13 in Figure 5. Below, we will omit the explanation of processes that are the same as in Figure 5 and explain the differences in the processes.

[0153] The intermediate result comparison unit 116 exchanges the intermediate results of the control processing unit 102 of CPU module 1 and the intermediate results of the control processing unit 202 of CPU module 2 with the intermediate result comparison unit 216 of the redundant CPU module 2 (step S203).

[0154] Next, the intermediate result comparison unit 116 compares the intermediate result of the control processing unit 102 of CPU module 1 with the intermediate result of the control processing unit 202 of CPU module 2 (step S204).

[0155] Furthermore, the intermediate result verification unit 116 exchanges its own verification result with the intermediate result verification unit 216 of the redundant CPU module 2 (step S205).

[0156] Next, the intermediate result comparison unit 116 compares its own comparison result with the comparison result obtained by the intermediate result comparison unit 216 (step S206).

[0157] The intermediate result verification unit 116 determines whether the intermediate results match (step S207). If the intermediate results match (step S207: affirmative), the intermediate result verification unit 116 determines that no soft errors occurred during the current procedure and proceeds to step S211.

[0158] In contrast, if the intermediate results do not match (step S207: negative), the intermediate result matching unit 116 determines whether the matching results match or not (step S208). If the matching results do not match (step S208: negative), the intermediate result matching unit 116 determines that no soft errors occurred during the current procedure and proceeds to step S211.

[0159] In response, if the matching results match (step S208: affirmative), the intermediate result matching unit 116 determines that the soft error occurred during the current procedure and requests the intermediate result repair unit 117 to repair the intermediate result. The intermediate result repair unit 117 receives the request and retrieves the intermediate result obtained from the processing of the previous procedure from the intermediate result storage table 118 (step S209).

[0160] Next, the intermediate result repair unit 117 overwrites the intermediate result obtained in the previous step with the current intermediate result (step S210). After that, the soft error repair process returns to step S202.

[0161] On the other hand, if the intermediate results match (step S207: affirmative) or if the comparison results do not match (step S208: negative), the intermediate result comparison unit 116 saves the intermediate results of the current procedure to the intermediate result storage table 118 (step S211).

[0162] The control processing unit 102 advances the control processing, which is a non-periodic process, from the current procedure to the next procedure (step S212).

[0163] Next, the control processing unit 102 determines whether the control processing, which is a non-periodic process, has finished (step S213). If the control processing has not finished (step S213: negative), the control processing unit 102 returns to step S202.

[0164] On the other hand, if the control process is completed (step S213: affirmative), the control processing unit 102 proceeds to step S214.

[0165] The non-periodic control processing described here is an example of "control processing that sequentially performs multiple processes, each of which is a process in a series of steps." Furthermore, the processing result of the previous step relative to the current step is an example of "the result of the previous step" and an example of "the result of the previous processing." In other words, the logic circuit units 11 and 21, which are processors, execute control processing that sequentially performs multiple processes, each of which is a process in a series of steps, and if a soft error is detected, they obtain the result of the previous step and re-execute the current step.

[0166] (effect) As described above, the process control system 100 according to this embodiment exchanges and verifies the intermediate results from each step of a periodic process, and also exchanges and compares the results of the intermediate result verification. The process control system 100 then detects soft errors according to the intermediate result verification result and the comparison result of the verification result, and if a soft error is detected, it restarts processing from the current step, using the intermediate result obtained in the previous step as the current intermediate result.

[0167] As a result, the process control system 100 can correct errors caused by soft errors and continue correct control processing without having to determine whether the soft error occurred in CPU module 1 or 2 during each step of the aperiodic processing. Furthermore, the process control system 100 can continue correct control processing without having to identify the erroneous data caused by the soft error. Therefore, the reliability of the process control system 100 can be improved by avoiding the adverse effects of erroneous data when a soft error occurs in aperiodic processing.

[0168] While dividing the procedure into smaller steps reduces the processing time for each step, it also increases the frequency with which the process control system 100 performs verification and saving of intermediate results. When the procedure is divided into smaller steps, the process control system 100 performs verification and saving each time a process is completed, causing it to wait for the saving and execution to finish before proceeding with the original process. As a result, the processing speed of the process control system 100 may decrease significantly. However, even when the procedure is divided into smaller steps, the process control system 100 can avoid this decrease in processing speed by performing parallel processing using multiple processors. For example, the process control system 100 can minimize the decrease in processing speed of the normal procedure by having separate processors handle the processing of the normal procedure and the execution of additional verification and saving.

[0169] (Fourth Embodiment) Next, a fourth embodiment will be described. If the processing result of the previous cycle is overwritten when a soft error occurs, the processing result of the cycle processing when the soft error occurs will be the same as the previous cycle, and adverse effects may occur due to the repetition of the same processing result. For example, cumulative values ​​and counters will become inaccurate because they will not increase even after one cycle has elapsed. In the total flow rate of liquid registered in the processing result storage table 113 shown in Figure 4, if the processing result of the cycle processing when a soft error occurs is the same as the previous cycle, the error will widen because the flow rate for one cycle that should be added each time a soft error occurs will not be added.

[0170] The process control system 100 according to this embodiment also has the configuration shown in the block diagram of Figure 12. In the following description, the operation of parts similar to those in the third embodiment may be omitted.

[0171] In the process control system 100 according to this embodiment, the control processing unit 102 and the control processing unit 202 have the same function and execute the same processing. Therefore, the control processing unit 102, as well as the intermediate result verification unit 116, the intermediate result repair unit 117, and the intermediate result storage table 118 will be described below as examples.

[0172] The control processing unit 102 executes a cyclical process, which is a hybrid of cyclical and non-cyclical processing, in which a series of processes including multiple steps are performed in a single cycle, and the processing of one cycle is repeated at a fixed period. The control processing executed by the control processing unit 102 in this embodiment includes batch control, etc. In batch control, for example, a certain amount of material is placed in the apparatus, and a series of processes (input, reaction, mixing, separation, etc.) are repeatedly executed as one cycle. Specifically, batch control is used in wastewater treatment, where a certain amount is pumped up before processing, or in food manufacturing, where a certain amount of material is placed in a reaction vessel to produce a product. In batch control, the process is divided into stages, and processed materials are removed or equipment maintenance is performed at each stage. Batch control is suitable for high-mix low-volume production, and it is relatively easy to identify defects in the product.

[0173] In the following explanation, a series of processes included in the control process for each cycle will be referred to as "one cycle of control processing." The control processing unit 102 completes the execution of the entire one cycle of control processing by executing all the steps included in one cycle of control processing in order. Here, a step may be a group of processes that is well-defined enough to save the result in a series of controls. A step may include multiple processes or one process. A step may be the smallest unit of processes from which a result can be obtained. Among the steps included in one cycle of control processing, the latest step, which is the target of soft error detection at the present time, will be called the "current step," the step immediately preceding a particular step will be called the "previous step," and the step immediately following a particular step will be called the "next step."

[0174] The intermediate result verification unit 116 is called before the start of non-periodic processing to initialize the intermediate result storage table 118. The intermediate result verification unit 116 is also called at the timing of verification in non-periodic processing. The timings at which the intermediate result verification unit 116 is called are at the start of the first periodic processing of the control process, just before outputting the processing results in the periodic processing, before the CPU module 1 outputs or transmits data to the outside, and at each processing interval. The timing at each processing interval may include the timing just before outputting the processing results in the periodic processing. Processing performed from one verification timing to the next verification timing constitutes the processing of one procedure. The intermediate result verification unit 116 always performs verification at least just before starting the first periodic processing and just before outputting the processing results in each periodic processing.

[0175] When called at the timing of the comparison, the intermediate result comparison unit 116 exchanges the intermediate results obtained from processing a specific procedure in one cycle of control processing with the intermediate result comparison unit 216 of the CPU module 2. The intermediate result comparison unit 116 and the intermediate result comparison unit 216 execute the same procedure in one cycle of control processing at the same timing and exchange the intermediate results obtained from processing the same procedure.

[0176] The intermediate result comparison unit 116 compares the intermediate results obtained from processing a specific procedure in the control processing for one cycle executed by the control processing unit 102 with the intermediate results obtained from processing a specific procedure in the control processing executed by the control processing unit 202.

[0177] Furthermore, the intermediate result verification unit 116 exchanges the verification results of intermediate results obtained in processing a specific procedure in one cycle of control processing with the intermediate result verification unit 216 of the CPU module 2.

[0178] If the comparison of the intermediate results of the current procedure performed by CPU module 1 and CPU module 2 matches, and the comparison result of the intermediate result comparison unit 116 matches the comparison result of the intermediate result comparison unit 216, then the intermediate result comparison unit 116 determines that no soft errors occurred during the processing from the next process after the previous comparison to the processing during the current comparison, that is, from the end of the previous procedure to the completion of the current procedure. The intermediate result comparison unit 116 continues the asynchronous processing of the control unit 110 as is. Then, the intermediate result comparison unit 116 saves the intermediate results of the current procedure to the intermediate result storage table 118. (Corresponds to determination #1 in Figure 3)

[0179] If the comparison of the intermediate results of the current procedure performed by CPU module 1 and CPU module 2 matches, and the comparison result of the intermediate result comparison unit 116 does not match the comparison result of the intermediate result comparison unit 216, then it is considered that a soft error occurred in either CPU module 1 or CPU module 2 during the comparison of the comparison results, and the processing of the current procedure by the control processing unit 102 was performed normally. Therefore, if the comparison of the intermediate results of the current procedure performed by CPU module 1 and CPU module 2 matches, and the comparison result of the intermediate result comparison unit 116 does not match the comparison result of the intermediate result comparison unit 216, the intermediate result comparison unit 116 determines that no soft error occurred in the current procedure. In this case, since the intermediate result of the current procedure is correct, the intermediate result comparison unit 116 continues the asynchronous processing of the control unit 110 as is. The intermediate result comparison unit 116 saves the processing result of the current procedure to the processing result storage table 113. (Corresponds to determination #4 in Figure 3)

[0180] In contrast, if the results of the current procedure processed by CPU module 1 and CPU module 2 do not match, and the results of the intermediate result verification unit 116 and the intermediate result verification unit 216 match, it is considered that a soft error occurred in either CPU module 1 or CPU module 2 during the current procedure, and no further soft errors have occurred in either module since. Therefore, if the results of the control processing performed by CPU module 1 and CPU module 2 do not match, and the results of the intermediate result verification unit 116 and the intermediate result verification unit 216 match, the intermediate result verification unit 116 determines that a soft error occurred during the current procedure. In other words, the intermediate result verification unit 116 detects a soft error in the current procedure. The intermediate result verification unit 116 then requests the intermediate result repair unit 117 to repair the intermediate result. (Corresponds to determination #2 in Figure 3)

[0181] If the comparison of the intermediate results of the current procedure performed by CPU module 1 and CPU module 2 is inconsistent, and the comparison result of the intermediate result comparison unit 116 is inconsistent with the comparison result of the intermediate result comparison unit 216, then it is considered that a soft error occurred in either CPU module 1 or CPU module 2 during the comparison of the intermediate results, and the current procedure performed by the control processing unit 102 was performed normally. Therefore, if the comparison of the intermediate results of the current procedure performed by CPU module 1 and CPU module 2 is inconsistent, and the comparison result of the intermediate result comparison unit 116 is inconsistent with the comparison result of the intermediate result comparison unit 216, the intermediate result comparison unit 116 determines that no soft error occurred in the current procedure. In this case, since the intermediate result of the current procedure is correct, the intermediate result comparison unit 116 continues the asynchronous processing of the control unit 110 as is. The intermediate result comparison unit 116 saves the processing result of the current procedure to the processing result storage table 113. (Corresponds to determination #3 in Figure 3)

[0182] The intermediate result verification unit 116 repeats the process of verifying the intermediate results and detecting soft errors by comparing the verification results, as described above, for each periodic processing of the control process until the control process is completed.

[0183] If the intermediate result repair unit 117 finds that the intermediate result is inconsistent but the verification result is correct, it receives a request from the intermediate result verification unit 116 to repair the intermediate result. The intermediate result repair unit 117 then retrieves the intermediate result obtained in the previous step from the intermediate result storage table 118. After that, the intermediate result repair unit 117 overwrites the current intermediate result with the intermediate result obtained in the previous step. After that, the intermediate result repair unit 117 instructs the control processing unit 102 to resume the aperiodic processing from the first step of the current step.

[0184] In this way, the intermediate result verification unit 116 and the intermediate result repair unit 117 detect soft errors and repair intermediate results within one cycle of control processing, thereby returning to the intermediate result from the previous step within the same cycle when a soft error occurs. Furthermore, if the intermediate result verification unit 116 performs verification under the condition that the maximum interval time for verification timing of intermediate results is shorter than the idle time of one cycle of control processing, even if a soft error occurs, the cycle processing at the time of occurrence can be completed within the cycle time. Here, the maximum interval time for verification timing is the time from when the intermediate result verification unit 116 is called until the intermediate result repair unit 117 completes the repair of the intermediate results.

[0185] For example, suppose the idle time for periodic processing is 200ms and the maximum interval time for matching timing is 150ms. In this case, even if a soft error occurs and the intermediate result repair unit 117 repairs the intermediate result, the control processing can be retried once within the idle time for one period of control processing. Therefore, the control processing unit 102 can complete the periodic processing of the current period within the period time regardless of when the soft error occurs. It is preferable that the user adjusts the system through prior engineering so that even if they revert to the intermediate result of the previous procedure and restart the current procedure during the control processing of one period, they can still complete the control processing of one period within the period time.

[0186] Figure 15 is a flowchart of the soft error repair process by the CPU module according to the fourth embodiment. Next, the flow of the soft error repair process by CPU module 1 or 2 according to this embodiment will be explained with reference to Figure 15. Here, CPU module 1 will be used as an example. The processes enclosed in the dashed box in Figure 15 are different from the processes shown in the flow chart in Figure 5. Specifically, the processes in steps S301 to S302 are the same as the processes in steps S1 to S2 in Figure 5, and the processes in steps S314 to S317 are the same as the processes in steps S12 to S15 in Figure 5. Below, we will omit the explanation of processes that are the same as in Figure 5 and explain the differences in the processes.

[0187] The intermediate result comparison unit 116 exchanges the intermediate results of the control processing unit 102 of CPU module 1 and the intermediate results of the control processing unit 202 of CPU module 2 with the intermediate result comparison unit 216 of the redundant CPU module 2 (step S303).

[0188] Next, the intermediate result comparison unit 116 compares the intermediate result of the control processing unit 102 of CPU module 1 with the intermediate result of the control processing unit 202 of CPU module 2 (step S304).

[0189] Furthermore, the intermediate result verification unit 116 exchanges its own verification result with the intermediate result verification unit 216 of the redundant CPU module 2 (step S305).

[0190] Next, the intermediate result comparison unit 116 compares its own comparison result with the comparison result obtained by the intermediate result comparison unit 216 (step S306).

[0191] The intermediate result verification unit 116 determines whether the intermediate results match (step S307). If the intermediate results match (step S307: affirmative), the intermediate result verification unit 116 determines that no soft errors occurred during the current procedure and proceeds to step S311.

[0192] In contrast, if the intermediate results do not match (step S307: negative), the intermediate result matching unit 116 determines whether the matching results match or not (step S308). If the matching results do not match (step S308: negative), the intermediate result matching unit 116 determines that no soft errors occurred during the current procedure and proceeds to step S311.

[0193] In response, if the matching results match (step S308: affirmative), the intermediate result matching unit 116 determines that the soft error occurred during the current procedure and requests the intermediate result repair unit 117 to repair the intermediate result. The intermediate result repair unit 117 receives the request and retrieves the intermediate result obtained from the processing of the previous procedure from the intermediate result storage table 118 (step S309).

[0194] Next, the intermediate result repair unit 117 overwrites the intermediate result obtained in the previous step with the current intermediate result (step S310). After that, the soft error repair process returns to step S302.

[0195] On the other hand, if the intermediate results match (step S307: affirmative) or if the comparison results do not match (step S308: negative), the intermediate result comparison unit 116 saves the intermediate results of the current procedure to the intermediate result storage table 118 (step S311).

[0196] The control processing unit 102 proceeds from the current procedure to the next procedure for a series of processes that constitute one cycle in the control process (step S312).

[0197] Next, the control processing unit 102 determines whether a series of processes constituting one cycle of control processing has been completed (step S313). If the control processing for one cycle has not been completed (step S313: negative), the control processing unit 102 returns to step S302.

[0198] In response to this, if the control processing for one cycle is completed (step S313: affirmative), the control processing unit 102 proceeds to step S314.

[0199] The maximum interval time for matching is the time from step S303 to step S310.

[0200] The control process, which is a periodic process that repeats a series of processes including multiple steps at a fixed period, is an example of a "control process that repeats each process in a series of steps at a fixed period to perform multiple processes in order." Furthermore, the processing result of the previous step relative to the current step in the current period of the periodic process is an example of a "procedure result of the previous step" and an example of a "result of the previous process." In other words, the logic circuit units 11 and 21, which are processors, execute a control process that repeats each process in a series of steps at a fixed period to perform multiple processes in order. When the logic circuit units 11 and 21, which are processors, detect a soft error, they obtain the procedure result of the previous step in the current period and re-execute the current step. Alternatively, when the logic circuit units 11 and 21, which are processors, detect the soft error, they may obtain the result of the previous process in the current step and re-execute the current step.

[0201] (effect) As described above, the process control system 100 according to this embodiment exchanges and verifies the intermediate results of each step in the periodic aperiodic processing for control processing that performs aperiodic processing periodically, and also exchanges and compares the verification results of the processing results. The process control system 100 then detects soft errors according to the verification results of the processing results and the comparison results of the verification results, and if a soft error is detected, it obtains the intermediate result of the processing of the previous step and re-executes the current step. The process control system 100 executes the entire control processing by repeating the above aperiodic processing periodically.

[0202] As a result, even if a soft error occurs, the process control system 100 does not repeat the periodic processing at the time of the error using the processing results of the previous period, but instead performs the control processing normally during the periodic processing at the time of the error and obtains processing results corresponding to the periodic processing at the time of the error. Therefore, the process control system 100 can suppress the adverse effects caused by the same processing results continuing. In addition, the reliability of the process control system 100 can be improved by avoiding the adverse effects of incorrect data when a soft error occurs.

[0203] (system) Unless otherwise specified, the processing procedures, control procedures, specific names, and various data and parameters shown in the above documents and drawings may be changed at will.

[0204] Furthermore, the components of each illustrated device are functionally conceptual and do not necessarily need to be physically configured as shown. In other words, the specific forms of distribution and integration of each device are not limited to those shown. That is, all or part of them can be functionally or physically distributed and integrated in any unit according to various loads and usage conditions.

[0205] Furthermore, each processing function performed by each device may be implemented, in whole or in part, by a CPU and a program executed for analysis by that CPU, or by wired logic hardware.

[0206] (Hardware) The memory circuit section 12 can store various programs, including programs for realizing the functions of the control unit 110 and the redundancy processing unit 120. The memory circuit section 22 can also store various programs, including programs for realizing the functions of the control unit 210 and the redundancy processing unit 220.

[0207] The logic circuit unit 11 reads and executes various programs stored in the memory circuit unit 12. This enables the logic circuit unit 11 to perform the functions of the control unit 110 and the redundancy processing unit 120. The logic circuit unit 21 reads and executes various programs stored in the memory circuit unit 22. This enables the logic circuit unit 21 to perform the functions of the control unit 210 and the redundancy processing unit 220.

[0208] Thus, CPU modules 1 and 2 operate as information processing devices that execute various processing methods by reading and executing programs. Furthermore, CPU modules 1 and 2 can also achieve the same functionality as the embodiments described above by reading the program from a recording medium using a media reader and executing the read program. It should be noted that the program referred to here is not limited to being executed by CPU modules 1 and 2. For example, the present invention can be similarly applied when another computer or server executes a program, or when they collaborate to execute a program.

[0209] This program can be distributed via networks such as the Internet. Furthermore, this program can be recorded on computer-readable storage media such as hard disks, flexible disks (FDs), CD-ROMs, MO (Magneto-Optical disks), and DVDs (Digital Versatile Discs), and executed by reading the program from these media using a computer.

[0210] Some examples of the combinations of technical features that will be disclosed are listed below.

[0211] (1) An information processing system having two information processing devices, All of the aforementioned information processing devices are Memory and A processor connected to the aforementioned memory, Equipped with, The aforementioned processor, Execute a control process that performs multiple processes in sequence. The result of the current processing is compared with the result of the current processing of the other information processing device. The matching result of the self is compared with the matching result of the other information processing device, Based on the aforementioned self-matching result and comparison result, a soft error is detected. If the aforementioned soft error is detected, the result of the previous processing is obtained and the control processing is continued. A process control system that executes processing. (2) The aforementioned processor, If the aforementioned matching results are inconsistent and the aforementioned comparison results are consistent, the soft error is detected. (1) The process control system described above. (3) The aforementioned processor, If the matching results match, or if the matching results do not match and the comparison results do not match, the control process is continued using the result of the current process. The process control system described in (1) or (2). (4) The aforementioned processor, The information processing device acquires information on how it is used, The system acquires statistical information on the frequency of the aforementioned soft errors and stores it together with information on how the information processing device was used at the time each soft error occurred. A process control system described in any one of (1) to (3). (5) The aforementioned processor, The control process is executed, which repeats the process at a fixed interval and performs the multiple processes in order. If the aforementioned soft error is detected, the period result from the previous period will be used as the period result for the current period. A process control system described in any one of (1) to (4). (6) The aforementioned processor, The control process is executed to perform the plurality of processes, which are each process in a series of steps, in order. If the aforementioned soft error is detected, the result of the previous procedure is retrieved and the current procedure is re-executed. A process control system described in any one of (1) to (4). (7) The aforementioned processor, The control process is executed to perform the multiple processes in sequence by repeating each process in a series of steps at a fixed interval. If the aforementioned soft error is detected, the procedure result of the previous procedure in the current cycle is obtained and the current procedure is re-executed. A process control system described in any one of (1) to (4). (8) The aforementioned processor, The detection of the aforementioned soft error and the maximum interval time for re-executing the current procedure are performed in a time shorter than the idle time of the control process for one cycle. (7) The process control system described above. (9) The aforementioned processor, The two information processing devices are duplicated, with one being the operational side and the other the standby side. When an error is detected in the data stored in the memory of one of the information processing devices, the other information processing device is switched to the operation side. A process control system described in any one of (1) to (7). (10) A control method for a process control system having two information processing devices, The aforementioned information processing device is Execute a control process that performs multiple processes in sequence. The result of the current processing is compared with the result of the current processing of the other information processing device. The matching result of the self is compared with the matching result of the other information processing device, Based on the aforementioned self-matching result and comparison result, a soft error is detected. If the aforementioned soft error is detected, the result of the previous processing is obtained and the control processing continues. Control method. (11) A control program for a process control system having two computers, Execute a control process that performs multiple processes in sequence. The result of the current processing is compared with the result of the current processing of the other information processing device. The matching result of the self is compared with the matching result of the other information processing device, Based on the aforementioned self-matching result and comparison result, a soft error is detected. If the aforementioned soft error is detected, the result of the previous processing is obtained and the control processing continues. A control program that instructs a computer to perform a process. [Explanation of symbols]

[0212] 1, 2 CPU modules 11, 21 Logic Circuit Section 12, 22 Memory Circuit Section 100 Process Control Systems Input sections 101 and 201 102, 202 Control Processing Unit 103, 203 Output section 110, 210 Control Unit 111, 211 Processing result verification unit 112, 212 Processing result repair unit 113, 213 Processing result storage table 114, 214 Soft Error Information Collection Unit 115, 215 Soft Error Information Storage Table 116, 216 Intermediate Result Verification Unit 117, 217 Intermediate result repair part 118, 218 Intermediate result storage table 120, 220 Redundancy Processing Unit 121, 221 Redundancy operation switching section 122, 222 Redundant Operation Restoration Unit 130, 230 storage section

Claims

1. A process control system having two information processing devices, All of the aforementioned information processing devices are Memory and A processor connected to the aforementioned memory, Equipped with, The aforementioned processor, A control process is executed that repeats each step in a series of procedures at a fixed interval, performing multiple processes in sequence. The result of the current processing is compared with the result of the current processing of the other information processing device. The matching result of the self is compared with the matching result of the other information processing device, If the self-matching result is inconsistent and the comparison result is consistent, a soft error during the control process is detected. If the aforementioned soft error is detected, the control process retrieves the result of the previous procedure in the current cycle and re-executes the current procedure. A process control system that executes processing.

2. The aforementioned processor, If the matching results match, or if the matching results do not match and the comparison results do not match, the control process is continued using the result of the current process. The process control system according to claim 1.

3. The aforementioned processor, The information processing device acquires information on how it is used, The system acquires statistical information on the frequency of the aforementioned soft errors and stores it together with information on how the information processing device was used at the time each soft error occurred. The process control system according to claim 1.

4. The aforementioned processor, If the aforementioned soft error is detected, the period result from the previous period will be used as the period result for the current period. The process control system according to claim 1.

5. The aforementioned processor, The control process is executed to perform the plurality of processes, which are each process in a series of steps, in order. If the aforementioned soft error is detected, the result of the previous procedure is retrieved and the current procedure is re-executed. The process control system according to claim 1.

6. The aforementioned processor, The detection of the aforementioned soft error and the maximum interval time for re-executing the current procedure are performed in a time shorter than the idle time of the control process for one cycle. The process control system according to claim 1.

7. The aforementioned processor, The two information processing devices are duplicated, with one being the operational side and the other the standby side. When an error is detected in the data stored in the memory of one of the information processing devices, the other information processing device is switched to the operation side. The process control system according to claim 1.

8. A control method for a process control system having two information processing devices, The aforementioned information processing device is A control process is executed that repeats each step in a series of procedures at a fixed interval, performing multiple processes in sequence. The result of the current processing is compared with the result of the current processing of the other information processing device. The matching result of the self is compared with the matching result of the other information processing device, If the self-matching result is inconsistent and the comparison result is consistent, a soft error during the control process is detected. If the aforementioned soft error is detected, the control process retrieves the result of the previous step in the current cycle and re-executes the current step. Control method.

9. A control program for a process control system having two computers, A control process is executed that repeats each step in a series of procedures at a fixed interval, performing multiple processes in sequence. The result of the current processing is compared with the result of the current processing of the other information processing device. The matching result of the self is compared with the matching result of the other information processing device, If the self-matching result is inconsistent and the comparison result is consistent, a soft error during the control process is detected. If the aforementioned soft error is detected, the control process retrieves the result of the previous step in the current cycle and re-executes the current step. A control program that instructs a computer to perform a process.

Images