WO2018117065A1 - Processing device - Google Patents

Abstract

Provided is a technology for enabling detection even when an abnormality is caused by a common cause failure. This processing device has: multiple processing circuit systems that have mutually different hardware configurations, and perform the same process and output the same output signal with respect to the same input signal; and an output signal comparison unit that compares the output signals from the multiple processing circuit systems, and outputs a comparison result. The multiple processing circuit systems have mutually different hardware configurations, so a different signal appears as the output signal even if a common cause failure occurs, and an abnormality can be detected by comparing those output signals.

Description

Processing equipment

The present invention relates to a system that requires high reliability.

Functional safety is adopted in systems that require high reliability, such as systems that control processes in nuclear power plants and factory plants. Functional safety reduces the risk of system failure by adding a monitoring device or a protection device to the system.

∙ For functional safety, for example, hardware that forms part of the system may be multiplexed or diversified. Multiplexing provides for a failure such as a failure by providing a plurality of hardware having the same function. In diversification, multiplexed hardware is composed of different hardware components. For example, an FPGA (Field Programmable Gate Array) may be employed in the process control system (see Patent Documents 1 to 3). In such a case, there are cases where multiplexing and diversification are required for components having a basic function in each module, such as an FPGA mounted on an input / output device or an arithmetic device. For example, two hardware circuits that perform the same processing on the same input signal and generate the same output signal are provided, and the hardware circuit is confirmed by confirming that the output signals match. Normal operation can be confirmed. If an abnormality occurs in either one of the hardware circuits, the output signals of the two hardware circuits become inconsistent, so that the abnormality can be easily detected.

JP 2012-103866 A JP 2010-177881 A JP 2009-212230 A

However, a common cause failure (CCF: Common Cause Failure) may occur in the multiplexed two-system hardware circuit. The common factor failure is a failure in the same place in a plurality of hardware due to a common factor. When a common factor failure occurs in two systems at the same time, the output signals of the two systems show abnormal values in the same way. In that case, an abnormality cannot be detected by monitoring whether or not the output signals match. As a cause of the common factor failure, for example, there is a lot defect in parts commonly used for a plurality of hardware.

An object of the present invention is to provide a technique that enables detection even if an abnormality is caused by a common factor failure.

A processing apparatus according to an aspect of the present invention has a plurality of processing circuits that have different hardware configurations, perform the same processing on the same input signal, and generate the same output signal. An output signal collating unit that collates the output signal of the processing circuit and outputs a collation result.

According to the present invention, since the processing circuits of a plurality of systems have different hardware configurations, even if a common factor failure occurs, different signals appear in the output signal, and these output signals are compared. Abnormalities can be detected.

FIG. 3 is a diagram illustrating a configuration of an FPGA-mounted module according to the first embodiment. It is a figure for demonstrating the case where a common factor failure occurs in Example 1. FIG. 6 is a diagram illustrating a configuration of an FPGA-mounted module according to Embodiment 2. FIG. FIG. 10 is a diagram illustrating a configuration of an FPGA-mounted module according to a third embodiment.

Embodiments for carrying out the present invention will be described with reference to the drawings.

FIG. 1 is a diagram illustrating a configuration of an FPGA-mounted module according to the first embodiment.

The A system circuit and the B system circuit exist in the FPGA mounted module 3. The A system circuit is provided with an input terminal unit 101, an output terminal unit 102, and an FPGA 1 having an internal logic A 103 and an internal logic B 104. The internal logic A 103 and the internal logic B 104 of the FPGA 1 can be programmed from the outside. Similarly, the B-system circuit is provided with an FPGA 2 having the same input terminal unit 201 and output terminal unit 202 as the FPGA 1, and the same internal logic A 203 and internal logic B 204. The internal logic A 203 and the internal logic B 204 of the FPGA 2 can be programmed from the outside.

System A internal logic A 103 and system B internal logic A 203 are functional units that perform the same processing. The A-system internal logic B 104 and the B-system internal logic B 204 are functional units that perform the same processing.

The FPGA-mounted module 3 has an output signal verification unit 8 as a common part separately from the A system circuit and the B system circuit. The output signal collation unit 8 collates the output signals A, B, and C of the FPGA 1 with the output signals A, B, and C of the FPGA 2. If the output signals A, B, C from the A system circuit and the output signals A, B, C from the corresponding B system circuit all match, it can be estimated that the FPGA-equipped module 3 is operating normally. . In that case, the output signal matching unit 8 outputs the output signals A, B, and C to the controller 30. If any one of the output signals A, B, and C does not match, the output signal matching unit 8 outputs a predetermined abnormality signal that notifies the occurrence of the abnormality.

As described above, the internal logic A 103 of the FPGA 1 and the internal logic A 203 of the FPGA 2 perform the same operation. The internal logic B104 of FPGA1 and the internal logic B204 of FPGA2 perform the same operation. And as the whole FPGA, FPGA 1 and FPGA 2 perform the same operation.

In this embodiment, since the same signal output from the same sensor 40 is used as the input signal group 4 to the FPGA 1 and the input signal group 5 to the FPGA 2, if there is no abnormality such as a failure, the FPGA The output signal group 6 from 1 and the output signal group 7 from the FPGA 2 completely match.

FPGA 1 and FPGA 2 are functional units that perform the same function as described above, but have different hardware configurations. Specifically, the combination of the input signal and the input terminal and the combination of the output signal and the output terminal are different for each system. For example, in FPGA 1, the input terminal PN1 is assigned to the input signal A, the input terminal PN2 is assigned to the input signal B, and the input terminal PN3 is assigned to the input signal C. On the other hand, in FPGA 2, the input terminal PN2 is assigned to the input signal A, the input terminal PN3 is assigned to the input signal B, and the input terminal PN1 is assigned to the input signal C. In the FPGA 1, the input terminal PN4 is allocated to the output signal A, the input terminal PN5 is allocated to the output signal B, and the input terminal PN6 is allocated to the output signal C. On the other hand, in the FPGA 2, the input terminal PN6 is allocated to the output signal A, the input terminal PN4 is allocated to the output signal B, and the input terminal PN5 is allocated to the output signal C.

FIG. 2 is a diagram for explaining a case where a common factor failure occurs in the first embodiment. Here, the internal logic A 103, 203 is a circuit that performs a predetermined process with the input signal A and the input signal B as inputs and outputs an output signal A. The internal logics B 104 and 204 are circuits that perform predetermined processing with the input signal C as an input, and output the output signal B and the output signal C.

As shown in FIG. 2, it is assumed that the input terminal PN3 has failed as a common cause failure in, for example, FPGA 1 and FPGA 2. In that case, in the A system circuit, the input of the internal logic B 104 becomes abnormal, so the output signals B and C output from the internal logic B 104 become abnormal. On the other hand, in the B system circuit, since the input of the internal logic A 203 becomes abnormal, the output signal A output from the internal logic A 203 becomes abnormal. As a result, the output signal matching unit 8 detects a mismatch between the output signals of the A system circuit and the B system circuit. In that case, the output signal collation unit 8 outputs a predetermined abnormality signal instead of the output signals A, B, and C to the controller 30. The controller 30 executes a predetermined process control based on the output signals A, B, and C if no abnormality signal has been received. However, if the abnormality signal is received as described above, the controller 30 performs a predetermined abnormality without performing the process control. Processing will be executed.

As described above, in this embodiment, the process control system has a plurality of processing circuits that have different hardware configurations, perform the same processing on the same input signal, and generate the same output signal. (FPGAs 1 and 2) and an output signal collation unit 8 that collates output signals of a plurality of processing circuits and outputs a collation result. Because multiple processing circuits have different hardware configurations in this way, even if a common cause failure occurs, different signals appear in the output signal, and the abnormality is detected by comparing these output signals. Is possible.

The output signal matching unit 5 transmits the output signals A, B, and C to the controller 30 if the output signals A, B, and C match, and abnormal if the output signals A, B, and C do not match. An abnormal signal indicating that is transmitted to the controller 30. If the controller 30 has not received an abnormal signal, it is receiving the output signals A, B, and C. Therefore, the controller 30 executes process control based on the output signals A, B, and C, but receives the abnormal signal. In such a case, predetermined abnormality processing is executed without performing process control. Since the process control is executed when the output signals of the plurality of processing circuits coincide with each other, and when they do not coincide with each other, the abnormal process is executed, so that highly reliable process control can be realized.

In this embodiment, the processing circuit is an integrated circuit (FPGA) configured for a specific application, and the processing circuit and the output signal matching unit 8 are configured in one module (FPGA-equipped module 3). Therefore, a module including a plurality of multiplexed processing circuits can be configured such that an abnormality is detected by collating output signals when a common factor failure occurs in the components of the processing circuits. Further, since the processing circuit is an FPGA, a plurality of processing circuits performing the same processing can be easily configured with different hardware configurations.

Also, multiple FPGAs have different combinations of input / output signals and input / output terminals. The hardware configuration of the FPGA can be easily changed by changing the combination of the input / output signal and the input / output terminal.

In the first embodiment, a module equipped with a two-system processing circuit is illustrated, but the present invention is not limited thereto, and the present invention can be applied to a module equipped with a plurality of system processing circuits. In the second embodiment, a module on which a 3-system processing circuit is mounted is illustrated.

FIG. 3 is a diagram illustrating a configuration of an FPGA-mounted module according to the second embodiment. In the FPGA-mounted module 3, there are an A system circuit, a B system circuit, and a C system circuit. In the A system circuit, an FPGA 1 having an input terminal unit 101, an output terminal unit 102, an internal logic C 105, an internal logic D 106, and an internal logic E 107 is provided. The internal logic C 105, internal logic D 106, and internal logic E 107 of the FPGA 1 can be programmed from the outside. Similarly, the B-system circuit is provided with an FPGA 2 having an input terminal unit 201, an output terminal unit 202, an internal logic C 205, an internal logic D 206, and an internal logic E 207. The internal logic C 205, internal logic D 206, and internal logic E 207 of the FPGA 2 can be programmed from the outside. Similarly, an FPGA 3 having an input terminal unit 901, an output terminal unit 902, an internal logic C 905, an internal logic D 906, and an internal logic E 907 is provided in the C system circuit. The internal logic C 905, internal logic D 906, and internal logic E 907 of the FPGA 3 can be programmed from the outside.

The A system internal logic C 105, the B system internal logic C 205, and the C system internal logic C 905 are functional units that perform the same processing. The A system internal logic D 106, the B system internal logic D 206, and the C system internal logic D 906 are functional units that perform the same processing. The A system internal logic E 107, the B system internal logic E 207, and the C system internal logic E 907 are functional units that perform the same processing.

Further, the FPGA-mounted module 3 has an output signal verification unit 8 as a common part separately from the A system circuit, the B system circuit, and the C system circuit. The output signal collation unit 8 collates the output signals A, B, C of the FPGA 1 with the output signals A, B, C of the FPGA 2 and the output signals A, B, C of the FPGA 3. When the output signals A, B and C from the A system circuit and the output signals A, B and C from the corresponding B system circuit and the output signals A, B and C from the C system circuit all match, It can be estimated that the FPGA-mounted module 3 is operating normally. In that case, the output signal matching unit 8 outputs the output signals A, B, and C to a controller (not shown). If any one of the output signals A, B, and C does not match, the output signal matching unit 8 outputs a predetermined abnormality signal that notifies the occurrence of the abnormality to the controller.

As described above, the internal logic C 105 of the FPGA 1 and the internal logic C 205 of the FPGA 2 and the internal logic C 905 of the FPGA 3 perform the same operation. Also, the internal logic D 106 of the FPGA 1 and the internal logic D 206 of the FPGA 2 and the internal logic D 906 of the FPGA 3 perform the same operation. Furthermore, the internal logic E 107 of FPGA 1, the internal logic E 207 of FPGA 2, and the internal logic E 907 of FPGA 3 perform the same operation. And as the whole FPGA, FPGA 1, FPGA 2 and FPGA 3 perform the same operation.

In this embodiment, it is assumed that the same signal output from the same sensor (not shown) is used as the input signal group 4 to the FPGA 1, the input signal group 5 of the FPGA 2, and the input signal group 10 of the FPGA 3. Therefore, if there is no abnormality such as a failure, the output signal group 6 from the FPGA 1, the output signal group 7 from the FPGA 2, and the output signal group 11 from the FPGA 3 completely match.

FPGA 1, FPGA 2, and FPGA 3 are functional units that perform the same function as described above, but have different hardware configurations. Specifically, the combination of the input signal and the input terminal and the combination of the output signal and the output terminal are different for each system.

For example, in FPGA 1, the input terminal PN1 is allocated to the input signal A, the input terminal PN2 is allocated to the input signal B, and the input terminal PN3 is allocated to the input signal C. On the other hand, in FPGA 2, the input terminal PN2 is assigned to the input signal A, the input terminal PN3 is assigned to the input signal B, and the input terminal PN1 is assigned to the input signal C. Further, in the FPGA 3, the input terminal PN3 is allocated to the input signal A, the input terminal PN1 is allocated to the input signal B, and the input terminal PN2 is allocated to the input signal C.

In the FPGA 1, the input terminal PN4 is assigned to the output signal A, the input terminal PN5 is assigned to the output signal B, and the input terminal PN6 is assigned to the output signal C. On the other hand, in the FPGA 2, the input terminal PN5 is allocated to the output signal A, the input terminal PN6 is allocated to the output signal B, and the input terminal PN4 is allocated to the output signal C. Further, in the FPGA 3, the input terminal PN6 is allocated to the output signal A, the input terminal PN4 is allocated to the output signal B, and the input terminal PN5 is allocated to the output signal C.

Here, the internal logic C 105, 205, 905 is a circuit that performs a predetermined process with the input signal A as an input and outputs an output signal A. The internal logic D 106, 206, 906 is a circuit that performs a predetermined process with the input signal B as an input and outputs an output signal B. The internal logics E 107, 207, and 907 are circuits that perform predetermined processing with the input signal C as an input and output an output signal C.

For example, it is assumed that the input terminal PN3 has failed as a common cause failure in FPGA 1, FPGA 2, and FPGA 3. In that case, in the A system circuit, the input of the internal logic E 107 becomes abnormal, so the output signal C output from the internal logic E 107 becomes abnormal. On the other hand, in the B system circuit, since the input of the internal logic D 206 becomes abnormal, the output signal B output from the internal logic D 206 becomes abnormal. Further, in the C system circuit, since the input of the internal logic C 905 becomes abnormal, the output signal A output from the internal logic C 905 becomes abnormal.

As a result, the output signal matching unit 8 detects a mismatch between the output signals of the A system circuit, the B system circuit, and the C system circuit. In that case, the output signal collation unit 8 outputs a predetermined abnormality signal instead of the output signals A, B, and C to a controller (not shown). The controller executes predetermined process control based on the output signals A, B, and C if no abnormality signal has been received. However, if an abnormal signal is received as described above, the controller performs predetermined abnormality processing without performing process control. Will be executed.

In the first embodiment, an example in which the combination of input / output signals and input / output terminals is different for each system in two FPGAs is shown, but the present invention is not limited to this. As another example, the third embodiment shows an example in which two FPGAs use different input / output terminals.

FIG. 4 is a diagram illustrating a configuration of an FPGA-mounted module according to the third embodiment.

The A system circuit and the B system circuit exist in the FPGA mounted module 3. The A system circuit is provided with an input terminal unit 101, an output terminal unit 102, and an FPGA 1 having an internal logic A 103 and an internal logic B 104. The internal logic A 103 and the internal logic B 104 of the FPGA 1 can be programmed from the outside. Similarly, the B-system circuit is provided with an FPGA 2 having the same input terminal unit 201 and output terminal unit 202 as the FPGA 1, and the same internal logic A 203 and internal logic B 204. The internal logic A 203 and the internal logic B 204 of the FPGA 2 can be programmed from the outside.

System A internal logic A 103 and system B internal logic A 203 are functional units that perform the same processing. The A-system internal logic B 104 and the B-system internal logic B 204 are functional units that perform the same processing.

The FPGA-mounted module 3 has an output signal verification unit 8 as a common part separately from the A system circuit and the B system circuit. The output signal collation unit 8 collates the output signals A, B, and C of the FPGA 1 with the output signals A, B, and C of the FPGA 2. If the output signals A, B, C from the A system circuit and the output signals A, B, C from the corresponding B system circuit all match, it can be estimated that the FPGA-equipped module 3 is operating normally. . In that case, the output signal matching unit 8 outputs the output signals A, B, and C to the controller 30. If any one of the output signals A, B, and C does not match, the output signal matching unit 8 outputs a predetermined abnormality signal that notifies the occurrence of the abnormality.

As described above, the internal logic A 103 of the FPGA 1 and the internal logic A 203 of the FPGA 2 perform the same operation. The internal logic B104 of FPGA1 and the internal logic B204 of FPGA2 perform the same operation. And as the whole FPGA, FPGA 1 and FPGA 2 perform the same operation.

In the present embodiment, it is assumed that the same signal output from the same sensor (not shown) is used as the input signal group 4 to the FPGA 1 and the input signal group 5 to the FPGA 2. Therefore, if there is no abnormality such as a failure, the output signal group 6 from the FPGA 1 and the output signal group 7 from the FPGA 2 completely coincide.

FPGA 1 and FPGA 2 are functional units that perform the same function as described above, but have different hardware configurations. Specifically, the two FPGAs 1 and 2 use different input / output terminals. For example, in FPGA 1, the input terminal PN1 is assigned to the input signal A, the input terminal PN2 is assigned to the input signal B, and the input terminal PN3 is assigned to the input signal C. On the other hand, in FPGA 2, the input terminal PN7 is allocated to the input signal A, the input terminal PN8 is allocated to the input signal B, and the input terminal PN9 is allocated to the input signal C. In the FPGA 1, the input terminal PN4 is allocated to the output signal A, the input terminal PN5 is allocated to the output signal B, and the input terminal PN6 is allocated to the output signal C. On the other hand, in the FPGA 2, the input terminal PN10 is allocated to the output signal A, the input terminal PN11 is allocated to the output signal B, and the input terminal PN12 is allocated to the output signal C.

Here, the internal logic A 103 and 203 are circuits that perform predetermined processing with the input signal A and the input signal B as inputs and output the output signal A. The internal logics B 104 and 204 are circuits that perform predetermined processing with the input signal C as an input, and output the output signal B and the output signal C.

For example, it is assumed that the input terminal PN3 has failed as a common cause failure in FPGA 1 and FPGA 2. In that case, in the A system circuit, the input of the internal logic B 104 becomes abnormal, so the output signals B and C output from the internal logic B 104 become abnormal. On the other hand, in the B system circuit, since the input terminal PN3 is not used, no abnormality occurs in any input of the internal logic A 203 and the internal logic B 204, and the output signal A output from the internal logic A 204, and No abnormality occurs in the output signals B and C output from the internal logic B 204. As a result, the output signal matching unit 8 detects a mismatch between the output signals of the A system circuit and the B system circuit. In that case, the output signal collation unit 8 outputs a predetermined abnormality signal instead of the output signals A, B, and C to the controller 30. The controller 30 executes a predetermined process control based on the output signals A, B, and C if no abnormality signal has been received. However, if the abnormality signal is received as described above, the controller 30 performs a predetermined abnormality without performing the process control. Processing will be executed.

As described above, in this embodiment, since a plurality of FPGAs use different input / output terminals, the hardware configuration of the FPGA can be easily varied by using different input / output terminals.

Although various embodiments have been described above, the present invention is not limited to these embodiments, and these embodiments can be used in combination within the scope of the technical idea of the present invention. The configuration of the part may be changed.

DESCRIPTION OF SYMBOLS 1 ... FPGA, 10 ... Input signal group, 101 ... Input terminal part, 102 ... Output terminal part, 11 ... Output signal group, 2 ... FPGA, 201 ... Input terminal part, 202 ... Output terminal part, 203 ... Internal logic A, 204 ... Internal logic B, 3 ... FPGA mounted module, 30 ... controller, 4 ... input signal group, 40 ... sensor, 5 ... output signal verification unit, 5 ... input signal group, 6 ... output signal group, 7 ... output signal group ,
8: Output signal verification unit, 901: Input terminal unit, 902: Output terminal unit

Claims (6)

A plurality of processing circuits that have different hardware configurations, perform the same processing on the same input signal, and generate the same output signal;
An output signal collating unit that collates output signals of the plurality of processing circuits and outputs a collation result. A controller that performs predetermined control;
The output signal verification unit transmits the output signal to the controller if the output signals match, and transmits a predetermined abnormality signal indicating an abnormality to the controller if the output signals do not match. ,
The controller executes the control based on the output signal if the abnormal signal has not been received, and executes predetermined abnormality processing without performing the control when receiving the abnormal signal.
The processing apparatus according to claim 1. The processing circuit is an integrated circuit configured for a specific application;
The processing circuit and the output signal matching unit are configured in one module.
The processing apparatus according to claim 1. The processing apparatus according to claim 1, wherein the processing circuit is an FPGA. The processing device according to claim 4, wherein the plurality of FPGAs have different combinations of input / output signals and input / output terminals. The processing apparatus according to claim 4, wherein different input / output terminals are used for the plurality of FPGAs.

Images