Safety computing device, safety input device, safety output device, and safety controller

Patent metadata

Field	Value
Publication number	US-9417943-B2
Application number	US-201314420988-A
Country	US
Kind code	B2
Filing date	Mar 11, 2013
Priority date	Sep 11, 2012
Publication date	Aug 16, 2016
Grant date	Aug 16, 2016

Abstract

A safety computing device includes a processor and a memory. The memory includes a first memory area and a second memory area having an address different from the first memory area. The processor includes an execution control unit performing a first process including the program process on input data written in the first memory area, and a second process including the program process on input data written in the second memory area and addition of redundancy code to output data written in the second memory area, a result collating unit collating output data to which redundancy code is added in the first and second processes, a computation diagnosis unit diagnosing presence or absence of failure in the processor and the memory, and an abnormality processing unit that, when an abnormality is detected by at least one of redundancy check, collation, and diagnosis, stops outputting output data.

First claim

The invention claimed is:

1. A safety computing device comprising:
a processor that executes a program process on input data; and
a memory that stores the input data input to the processor and output data that is a result of the program process, wherein
the memory is capable of storing the input data and the output data in each of a first memory area and a second memory area having an address different from an address of the first memory area, and
the processor includes
an execution control unit that performs a first process, which includes a redundancy check and the program process performed on the input data written in the first memory area and addition of a redundancy code to the output data that is a result of the program process and is written in the first memory area, and a second process, which includes a redundancy check and the program process performed on the input data written in the second memory area and addition of a redundancy code to the output data that is a result of the program process and is written in the second memory area,
a result collating unit that collates the output data to which the redundancy code is added in the first process and the output data to which the redundancy code is added in the second process,
a computation diagnosis unit that diagnoses, by computation, presence or absence of a failure in the processor and the memory, and
an abnormality processing unit that, when an abnormality is detected by at least the redundancy check being performed on the input data by the execution control unit, stops outputting the output data.

2. The safety computing device according to claim 1 , wherein
in the second process, the execution control unit writes the output data having an inverted bit in the second memory area, and
the result collating unit collates the output data read from the first memory area and the output data read from the second memory area by exclusive-ORing the output data read from the first memory area and the output data read from the second memory area.

3. The safety computing device according to claim 1 , wherein
in the second process, the execution control unit writes the output data on which complement conversion is performed in the second memory area, and
the result collating unit collates the output data read from the first memory area and the output data read from the second memory area on a basis of a sum of the output data read from the first memory area and the output data read from the second memory area.

4. A safety computing device comprising:
a processor that executes a program process on input data; and
a memory that stores the input data input to the processor and output data that is a result of the program process, wherein
the memory is capable of storing the input data and the output data in each of a first memory area and a second memory area having an address different from an address of the first memory area, and
the processor includes
an execution control unit that performs a first process, which includes a redundancy check and the program process performed on the input data written in the first memory area and addition of a redundancy code to the output data that is a result of the program process and is written in the first memory area, and a second process, which includes a redundancy check and the program process performed on the input data written in the second memory area and addition of a redundancy code to the output data that is a result of the program process and is written in the second memory area,
a result collating unit that collates the output data to which the redundancy code is added in the first process and the output data to which the redundancy code is added in the second process,
a computation diagnosis unit that diagnoses, by computation, presence or absence of a failure in the processor and the memory, and
an abnormality processing unit that, when an abnormality is detected by at least one of the redundancy check performed on the input data by the execution control unit, a collation performed by the result collating unit, and a diagnosis performed by the computation diagnosis unit, stops outputting the output data, wherein
the execution control unit reverses an endian of one of the output data to be written in the first memory area and the output data to be written in the second memory area, and
the result collating unit collates the output data read from the first memory area and the output data read from the second memory area after reversing an endian of one of the output data read from the first memory area and the output data read from the second memory area.

5. A safety computing device comprising:
a processor that executes a program process on input data; and
a memory that stores the input data input to the processor and output data that is a result of the program process, wherein
the memory is capable of storing the input data and the output data in each of a first memory area and a second memory area having an address different from an address of the first memory area, and
the processor includes
an execution control unit that performs a first process, which includes a redundancy check and the program process performed on the input data written in the first memory area and addition of a redundancy code to the output data that is a result of the program process and is written in the first memory area, and a second process, which includes a redundancy check and the program process performed on the input data written in the second memory area and addition of a redundancy code to the output data that is a result of the program process and is written in the second memory area,
a result collating unit that collates the output data to which the redundancy code is added in the first process and the output data to which the redundancy code is added in the second process,
a computation diagnosis unit that diagnoses, by computation, presence or absence of a failure in the processor and the memory, and
an abnormality processing unit that, when an abnormality is detected by at least one of the redundancy check performed on the input data by the execution control unit, a collation performed by the result collating unit, and a diagnosis performed by the computation diagnosis unit, stops outputting the output data,
wherein the execution control unit uses a program created as a 16-bit compiler in the program process to be performed on the input data read from the first memory area and uses a program created as a 32-bit compiler in the program process to be performed on the input data read from the second memory area.

6. A safety computing device comprising:
a processor that executes a program process on input data; and
a memory that stores the input data input to the processor and output data that is a result of the program process, wherein
the memory is capable of storing the input data and the output data in each of a first memory area and a second memory area having an address different from an address of the first memory area, and
the processor includes
a message processing unit that performs an input message process of performing a redundancy check by decoding-a redundancy code added to an input message that includes the input data and an output message process of obtaining an output message by adding a redundancy code to the output data,
an execution control unit that performs a first process, which includes control computation performed on the input message written in the first memory area and writing of the output message obtained by the output message process into the first memory area, and a second process, which includes control computation performed on the input message written in the second memory area and writing of the output message on which the output message pr

Assignees

• Kanamaru Hiroo
• Asano Yoshitomo
• Yato Keiichi
• Harada Hidetoshi
• Mitsubishi Electric Corp

Inventors

• Kanamaru Hiroo
• Asano Yoshitomo
• Yato Keiichi
• Harada Hidetoshi

Classifications

• G05B2219/24182

  Redundancy · CPC title

• G06F11/08

  Error detection or correction by redundancy in data representation, e.g. by using checking codes · CPC title

• G06F11/079

  Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36) · CPC title

• G06F11/263

  Generation of test inputs, e.g. test vectors, patterns or sequences {; with adaptation of the tested hardware for testability with external testers} · CPC title

• G05B9/03 Primary

  with multiple-channel loop, i.e. redundant control systems · CPC title