Evaluation system, non-transitory storage medium storing thereon evaluation program, and evaluation method

Patent metadata

Field	Value
Publication number	US-10180892-B2
Application number	US-201715417443-A
Country	US
Kind code	B2
Filing date	Jan 27, 2017
Priority date	Mar 14, 2016
Publication date	Jan 15, 2019
Grant date	Jan 15, 2019

Abstract

An evaluation system includes a process execution module that executes an operation in accordance with a safety program, a setting module that receives an evaluation condition, a first determination module that changes the value of the input signal to be evaluated, from a first input value which is an initial value to a second input value, and determines whether a first output value of the output signal to be evaluated which is determined by the process execution module is identical to the expected output value, a second determination module that restores the value of the input signal to be evaluated, from the second input value to the first input value, and determines whether a second output value of the output signal to be evaluated which is determined by the process execution module is identical to the first output value, and an output module that outputs a determination result.

First claim

What is claimed is:

1. An evaluation system for evaluating functional safety of a safety program for causing a target device to operate with safety maintained, when a predetermined condition is satisfied, the evaluation system comprising:
at least one processor or circuit programmed to execute instructions to perform the following:
determine, based on one or more input signals, a value or values of corresponding one or more output signals by performing an operation in accordance with the safety program;
receive an evaluation condition including:
an input signal to be evaluated;
an output signal to be evaluated; and
an expected output value which is a value of the output signal to be evaluated and which is to be output in response to change of a value of the input signal to be evaluated;
change the value of the input signal to be evaluated, from a first input value which is an initial value to a second input value, and make a first determination of whether a first output value of the output signal to be evaluated is identical to the expected output value;
restore the value of the input signal to be evaluated, from the second input value to the first input value, and make a second determination of whether a second output value of the output signal to be evaluated is identical to the first output value; and
output, in association with the input signal to be evaluated, said first determination and said second determination.

2. The evaluation system according to claim 1 , wherein
receiving the evaluation condition includes a setting of one of:
a first type defining that, when the value of the input signal is restored from the second input value to the first input value, an output value of a corresponding output signal should be restored to an original value following the value of the input signal being restored from the second input value to the first input value; and
a second type defining that the output value of the corresponding output signal should not be restored to the original value until a predetermined reset condition is satisfied, and
in a case where the first type is set, the processor or circuit determines that an operation under the first type is correct when the second output value of the output signal to be evaluated is different from the first output value, and
in a case where the second type is set, the processor or circuit determines that an operation under the second type is correct when the second output value of the output signal to be evaluated is identical to the first output value.

3. The evaluation system according to claim 2 , wherein
receiving the evaluation condition includes a setting of a reset signal as the predetermined reset condition for the second type, and
the processor or circuit is configured to make the reset signal valid after the second determination, and make a third determination as to whether a third output value of the output signal to be evaluated is identical to the first output value.

4. The evaluation system according to claim 1 , wherein the processor or circuit is programmed to execute instructions to set the value of the input signal to be evaluated to the first input value before the first determination, and determine whether a fourth output value of the output signal to be evaluated is identical to an initial value of the output signal.

5. The evaluation system according to claim 1 , wherein
as the first input value which is the initial value, a value is used different from a value indicated in a memory state similar to a state during failure of power supplied to a safety controller executing the safety program.

6. The evaluation system according to claim 1 , wherein
the output incorporates, in the determination result, information indicating whether the first or the second determination detects an error.

7. The evaluation system according to claim 1 , wherein
the evaluation condition includes multiple sets each constituted of the input signal to be evaluated, the output signal to be evaluated, and the expected output value, and one or more of the first and second determinations is performed for each set of the multiple sets, and
the output incorporates, in the determination result, information indicating which set includes an input signal determined as having an error.

8. The evaluation system according to claim 1 , wherein
the evaluation condition includes a set of the input signal to be evaluated, a plurality of the output signals to be evaluated, and a plurality of the expected output values corresponding to the output signals, and one or more of the first and second determinations is performed for each of the plurality of the expected output values, and
the output incorporates, in the determination result, information indicating which output signal is determined as having an error.

9. The evaluation system according to claim 1 , wherein
the output incorporates, in the determination result, a comment depending on whether the first or second determination detects an error.

10. A non-transitory storage medium storing thereon an evaluation program for evaluating functional safety of a safety program for causing a target device to operate with safety maintained, when a predetermined condition is satisfied, the evaluation program, when executed by a processor, causing the processor to perform:
determining, based on one or more input signals, a value or values of corresponding one or more output signals by performing an operation in accordance with the safety program;
receiving an evaluation condition including:
an input signal to be evaluated;
an output signal to be evaluated; and
an expected output value which is a value of the output signal to be evaluated and which is to be output in response to change of a value of the input signal to be evaluated;
changing the value of the input signal to be evaluated, from a first input value which is an initial value to a second input value, and determining whether a first output value of the output signal to be evaluated which is determined by an operation in accordance with the safety program is identical to the expected output value;
restoring the value of the input signal to be evaluated, from the second input value to the first input value, and determining whether a second output value of the output signal to be evaluated which is determined by an operation in accordance with the safety program is identical to the first output value; and
outputting, in association with the input signal to be evaluated, a determination result of the steps of determining.

11. An evaluation method for evaluating functional safety of a safety program for causing a target device to operate with safety maintained, when a predetermined condition is satisfied, the evaluation method comprising:
determining, based on one or more input signals, a value or values of corresponding one or more output signals by performing an operation in accordance with the safety program;
receiving an evaluation condition including:
an input signal to be evaluated;
an output signal to be evaluated; and
an expected output value which is a value of the output signal to be evaluated and which is to be output in response to change of a value of the input signal to be evaluated;

changing the value of the input signal to be evaluated, from a first input value which is an initial value to a second input value, and determining whether a first output value of the output signal to be evaluated which is determined by an operation in accordance with the safety program is identical to the expected output value;
restoring the value of the input signal to be evaluated, from the second input value to the first inpu

Assignees

• Omron Tateisi Electronics Co

Inventors

• Fujimura Ryosuke
• Takuma Nobuyuki
• Suganuma Hiromu
• Matsui Asahi
• Inoue Masaya

Classifications

• G05B19/048

  Monitoring; Safety · CPC title

• G06F11/3692

  for test results analysis · CPC title

• G06F11/3612 Primary

  by runtime analysis (performance monitoring G06F11/3466) · CPC title

• G05B19/0428 Primary

  Safety, monitoring (G05B19/0423 takes precedence) · CPC title

• G06F11/277

  with comparison between actual response and known fault-free response · CPC title