WO2019106830A1

WO2019106830A1 - Distribution control device

Info

Publication number: WO2019106830A1
Application number: PCT/JP2017/043279
Authority: WO
Inventors: 輝昭酒田; 広津　鉄平
Original assignee: 株式会社日立製作所
Priority date: 2017-12-01
Filing date: 2017-12-01
Publication date: 2019-06-06

Abstract

The present invention implements a distribution control device that can avoid the occurrence of a single point of failure, reduce the delay time associated with a transition to fallback operation, and enhance safety and reliability. In this distribution control device, reconfiguration control units 21, 22, and 23 are connected between CPUs 1, 2, and 3 and memories 11, 12, and 13, and are also connected to each other, in order for the CPU 2 and the CPU 3 to perform processing using calculation results from the CPU 1. A shared data diagnostic unit 27 is connected between the reconfiguration control unit 22 and the memory 12, and a shared data diagnostic unit 28 is connected between the reconfiguration control unit 23 and the memory 13. If a failure occurs in the CPU 1, the occurrence of the failure in the CPU 1 is detected and data in the memories 12 and 13 is diagnosed in order for the CPU 2 and the CPU 3 to transition to fallback operation. Then if the data in both memories is valid, the CPU 2 takes over from the CPU 1 and performs system fallback operation.

Description

Distributed controller

The present invention relates to a distributed control device.

With the miniaturization of semiconductor processes, it has become possible to increase the performance of CPUs (Central Processing Units) and to increase the speed and capacity of RAMs (Randam Access Memories, main memories, memories).

With the progress of these semiconductor devices, efforts have been started to realize various functions that could not be achieved conventionally, particularly in the industrial field and the automotive field.

For example, in the industrial field, we are working on the Internet of Things (IoT), which collects operation data from a large number of devices distributed in the real world, analyzes it in the virtual world, and feeds back better control output to the real world. It is thriving.

In addition, in the automobile field, efforts are being made to realize automatic driving by providing an automobile system with a recognition function and a control function by incorporating AI (Artificial Intelligence, artificial intelligence) into the controller of the automobile. .

In order to realize IoT in the industrial field, each layer performs distributed processing in each layer such as devices that constitute the entire industrial system, PLC (Programmable Logic Controller), cloud, etc. to communicate information mutually, and real world and virtual world Need to be connected organically.

In addition, in future automobile systems, functions to realize AI, external world recognition functions, actuation functions to operate motors and steers, etc. are assigned to multiple electronic control units (ECUs), and distributed control is performed for automatic driving. It is conceivable to adopt a configuration for realizing

In such industrial systems and automobile systems, it is the securing of safety and reliability that becomes a problem when the functions are advanced and the systems become complex. In particular, in a system involving human life, if an abnormality or failure occurs in a part of the system, the effect spreads to the entire system and control as expected can not be performed, and as a result, a system in which human life is lost is not acceptable. .

Therefore, in systems in such a field, it is general to take a mechanism to detect and take action against occurrence of abnormality or failure.

As a background art of this technical field, for example, Patent Document 1 describes a microprocessor application device having a distributed processing function in which distributed processing is performed by a plurality of microprocessors.

The microprocessor application device described in Patent Document 1 aims to continue operation as a whole by degenerate operation as a whole even if some of the plurality of microprocessors fail. Then, for each device configuration determined by a combination of presence / absence of a failure of each microprocessor, program memory in which a program to be executed by each normal microprocessor is stored, and an abnormality of each microprocessor are detected , And program assignment means.

Then, the program allocation means determines one of the plurality of microprocessors as a master processor based on the abnormality detection result of the initialization means to determine the change of the device configuration, and the program memory specific to the new device configuration Are assigned to corresponding normal microprocessors.

Unexamined-Japanese-Patent No. 5-158905

By the way, as a result of examining the technology having a distributed processing function having a plurality of conventional microprocessors, memories, and initialization means, the following has become clear as a result of examination by the inventor.

In the technology described in Patent Document 1, there is only one set of shared memory and initialization control unit shared by a plurality of microprocessors, and if these parts fail, there is a possibility of becoming a single failure point. And the configuration and operation for measures in case of failure of these parts are not specified.

Further, the master CPU needs to transfer the software at the time of degeneration to the slave CPU via the shared memory, which requires time, and it takes time to switch from the normal operation to the degeneration operation.

For this reason, there existed a problem that application to an industrial system and a car system which real-time property is required was difficult.

An object of the present invention is to realize a distributed control device capable of avoiding the occurrence of a single failure point, reducing the transition delay time to the degeneration operation, and improving the safety and reliability.

In order to achieve the above object, the present invention is configured as follows.

In a distributed control device, a first operation control unit, a first reconfiguration control unit connected to the first operation control unit, and a first memory connected to the first reconfiguration control unit A second operation control unit, a second reconfiguration control unit connected to the second operation control unit, a second memory connected to the second reconfiguration control unit, and And a first shared data diagnosis unit connected to the second memory, a third operation control unit, and a third reconfiguration control unit connected to the third operation control unit. And a third memory connected to the third reconfiguration control unit, and a second shared data diagnosis unit connected to the third reconfiguration control unit and the third memory, The second memory includes the second dedicated memory space, a shared memory space with the first memory, and the third memory. The third memory has a dedicated memory space of the third memory, a shared memory space with the first memory, and a shared memory space with the second memory, The shared data diagnostic unit 1 diagnoses data stored in the shared space with the first memory in the second memory, rewrites erroneous data to correct data, and the second shared data diagnostic unit The data stored in the shared memory space with the first memory in the third memory is diagnosed, and the erroneous data is rewritten to the correct data.

According to the present invention, in a system such as an industrial field or an automotive field, a distributed control that can avoid the occurrence of a single failure point, reduce the transition delay time to the degenerate operation, and improve the safety and reliability. The device can be realized.

FIG. 1 is a schematic configuration diagram of a distributed control device according to a first embodiment. FIG. 7 is a diagram illustrating an example of a configuration of a reconfiguration control unit according to the first embodiment. FIG. 6 is a diagram showing an example of the configuration of a shared data diagnosis unit of the first embodiment. FIG. 2 is a diagram showing an example of a memory configuration of the distributed control device of the first embodiment. FIG. 7 is an operation flowchart in the case where a failure occurs in a part of the distributed control device of the first embodiment and a transition is made to a degeneration operation. It is an operation | movement flowchart after a failure generate | occur | produces in a system and it transfers to a degeneration operation. It is a timing chart of operation in a distributed control device of the present invention. It is a timing chart of operation of a distributed control device to which the present invention is not applied. FIG. 7 is a schematic configuration diagram of a distributed control device according to a second embodiment. FIG. 13 is a schematic explanatory view of a distributed control device according to a third embodiment. It is a figure which shows an example of the data frame output with respect to a control object apparatus from the reconfiguration | reconstruction control part in the distributed control apparatus of this invention. It is a figure which shows an example of a data frame when a failure generate | occur | produces in the distributed control apparatus of this invention. FIG. 15 is a diagram showing an example of applying the distributed control device according to the fourth embodiment to a vehicle system. FIG. 18 is a diagram illustrating an example of applying the distributed control device according to the fifth embodiment to an industrial control system.

Hereinafter, embodiments of the present invention will be described using the drawings.

Example 1
Embodiment 1 of the present invention will be described with reference to FIGS. 1 to 7A and 7B.

FIG. 1 is a schematic block diagram of a distributed control apparatus according to a first embodiment of the present invention.

The example shown in FIG. 1 includes a CPU 1 (first operation control unit) and a memory 11 (first memory), a CPU 2 (second operation control unit) and a memory 12 (second memory), and a CPU 3 (a second operation control unit). It is an example of a distributed control device that performs distributed processing by a combination of a third operation control unit) and a memory 13 (third memory).

In this example of the distributed control device, the CPU 2 and the CPU 3 use the calculation result of the CPU 1 to perform processing, and the reconfiguration control unit 21 (first reconfiguration control unit) therefor, reconfiguration control Unit 22 (second reconfiguration control unit) and reconfiguration control unit 23
A (third reconfiguration control unit) is connected between each of the

CPUs

1, 2 and 3 and each of the

memories

11, 12 and 13, and the respective

reconfiguration control units

21, 22 and 23 are also mutually connected. Communicate with each other.

Furthermore, a shared data diagnosis unit 27 (first shared data diagnosis unit) is connected between the reconfiguration control unit 22 connected to the CPU 2 and the memory 12. Similarly, a shared data diagnosis unit 28 (second shared data diagnosis unit) is connected between the reconfiguration control unit 23 connected to the CPU 3 and the memory 13. The shared data diagnosis unit 27 and the shared data diagnosis unit 28 are configured to mutually communicate data.

FIG. 2 is a diagram showing an example of a detailed configuration of the reconfiguration control unit 22 shown in FIG.

In FIG. 2, the address 101, the write data 102, the command 103, and the failure detection signal 132 (failure detection signal number 2) are input to the reconfiguration control unit 22 from the CPU 2. Further, the failure detection signal 131 (failure detection signal No. 1) is input to the reconfiguration control part 22 from another reconfiguration control part 21 and the failure detection signal 133 (failure detection signal No. 3) from the reconfiguration control part 23 Is input.

The shared space determination unit 30 determines the memory space used by the CPU 2 and the memory space shared by the CPU 1 and the CPU 3 in the memory 12. In this example, which memory space is shared by software operated by the control system Is predetermined.

The demultiplexer 40 switches the output destination of the address 101 to the address 111 and the address (shared) 121 according to the result of the shared space determination signal 150 output from the shared space determination unit 30. If the address 101 is the memory space of the CPU 2, the demultiplexer 40 outputs the address 101 as the address 111 to the memory 12. If the address 101 is the memory space shared with the CPU 1 or CPU 3, the demultiplexer 40 outputs the address 101 ( It is output to the shared data diagnosis unit 27 as the sharing 121.

Similarly, when the address 101 is the memory space of the CPU 2, the demultiplexer 41 outputs the write data 102 as the write data 112 to the memory 12, and the demultiplexer 42 outputs the command 103 as the command 113 to the memory 12.

If the address 101 is a memory space shared by the CPU 1 or CPU 3, the demultiplexer 41 outputs the write data 102 as the write data (shared) 122 to the shared data diagnosis unit 27, and the demultiplexer 42 performs a command ( It is output to the shared data diagnosis unit 27 as the sharing) 123.

The shared area determination signal 150 is output to the memory 12 as described later.

The read data 114 is input from the memory 12 to the reconfiguration control unit 22, and the read data (shared) 124 is input from the shared data diagnosis unit 27.

If the address 101 is the memory space of the CPU 2 according to the result of the shared space determination signal 150, the selector 46 selects the read data 114 as the read data 104 and outputs it to the CPU 2.

If the address 101 is a memory space shared with the CPU 1 or CPU 3, the selector 46 selects the read data (shared) 124 as the read data 104 and outputs it to the CPU 2.

The failure location determination unit 31 is input from the failure detection signal 131 of the CPU 1 input from the reconfiguration control unit 21 of the CPU 1, the failure detection signal 132 of the CPU 2 input from the CPU 2, and the reconfiguration control unit 23 of the CPU 3 From the information with the failure detection signal 133 of the CPU 3, it is detected which one of the CPU 1, the CPU 2 and the CPU 3 has a failure.

Then, the failure point determination unit 31 outputs the data diagnosis request signal 137 to the shared data diagnosis unit 27 according to the failed CPU.

The reconfiguration control unit 23 shown in FIG. 1 also has the same configuration as the reconfiguration control unit 22 shown in FIG. Further, the reconfiguration control unit 21 which is not connected to the shared data diagnosis unit 27 shown in FIG. 1 receives an address (shared) 121, a write data (shared) 122, a command (shared) from the reconfiguration control unit 22 in FIG. The configuration similar to that of the reconfiguration control unit 22 can be obtained by excluding the read data (shared) 124, the failure location determination unit 31, and the like.

FIG. 3 is a diagram showing an example of a configuration of shared data diagnosis unit 27 shown in FIG.

In FIG. 3, the shared data diagnosis unit 27 receives an address (shared) 121, a write data (shared) 122, a command (shared) 123, and a data diagnosis request signal 137 from the reconfiguration control unit 22. Further, read data (shared) 125 is input to the shared data diagnosis unit 27 from another shared data diagnosis unit 28.

The address buffer 51 is configured to be able to hold a plurality of addresses (shared) 121, and sequentially outputs the contents of the held address (shared) 121 to the memory 12 as an address (shared) 126.

Similarly, the write data buffer 52 holds a plurality of write data (shared) 122 and sequentially outputs the write data (shared) 127 to the memory 12. Further, the command buffer 53 holds a plurality of commands (shared) 123 and sequentially outputs the commands (shared) 128 to the memory 12.

The fault diagnosis state machine 56 uses the command (shared) 128 in the memory space indicated by the address (shared) 126 at the timing when the occurrence of a fault is detected by any of the CPUs 1 to 3 according to the value of the data diagnosis request signal 137. It controls the diagnosis of the written light data (shared) 127.

The fault diagnosis state machine 56 validates the data diagnosis start signal 138 and sends it to the data diagnostic means 55 when a fault occurs in any one of the CPUs 1 to 3.

The data diagnosis unit 55 having received the data diagnosis start signal 138 diagnoses the value of the read data (shared) 124 input from the memory 12 and the value of the read data (shared) 125 input from another shared data diagnosis unit 28 And diagnoses whether any read data has an incorrect value due to the influence of a CPU failure, rewrites the incorrect data as correct data, and outputs it as the data diagnosis result 54 to the shared data diagnosis unit 28 .

As data failure detection means in the data diagnosis means 55, techniques such as parity, error correction code (ECC), cyclic redundancy check (CRC), data collation and the like are known, and these can be used.

The shared data diagnosis unit 28 shown in FIG. 1 has the same configuration as the shared data diagnosis unit 27 in FIG. 3.

FIG. 4 is a diagram showing an example of a detailed configuration of the memory 12 shown in FIG.

In FIG. 4, the memory 12 receives the address 111, the write data 112, the command 113 and the shared space determination signal 150 from the reconfiguration control unit 22, and the shared data diagnostic unit 27 transmits the address (shared) 126 and the write data (shared ) And a command (shared) 128 are input.

Depending on the result of the shared space determination signal 150, the selector 60 outputs the selected address of the address 111 and the address (shared) 126 to the memory cell 15 as the address 141. The selector 61 outputs the selected write data of the write data 112 and the write data (shared) 127 as the write data 142 to the memory cell 15.

Further, the selector 62 outputs the selected command of the command 113 and the command (shared) 128 to the memory cell 15 as the command 143.

Further, according to the result of the shared space determination signal 150, the demultiplexer 66 outputs the read data 144 as the read data 114 to the reconfiguration control unit 22 or as the read data (shared) 124 to the shared data diagnosis unit 27.

The memory cell 15 is a part which can write and read data in the memory 12. If the command 143 input to the memory cell 15 is write, the write data 142 is written to the memory space indicated by the address 141. If the command 143 input to the memory cell 15 is read, the memory space indicated by the address 141 Lead data 144 from the

The memory space 17 indicated by # 2 of the memory cell 15 in FIG. 4 is a dedicated memory space used by the CPU 2, and the address 111, the write data 112, the command 113, and the read data 114 are used to access the memory space 17. .

On the other hand, a memory space 18 indicated by # 12 of the memory cell 15 is a shared memory space shared and used by the CPU 2 with the CPU 1 and a shared memory used by the CPU 2 shared with the CPU 3 by the memory space 19 indicated by # 23. It is a space.

In the access to the

memory spaces

18 and 19, an address (shared) 126, write data (shared) 127, command (shared) 128, and read data (shared) 124 are used.

The memory 13 shown in FIG. 1 has the same configuration as the memory 12 of FIG. In addition, the memory 11 to which the shared data diagnosis unit 27 shown in FIG. 1 is not connected is connected to the address (shared) 126, the write data (shared) 127, the command (shared) 128, the read data (shared) from the memory 12 of FIG. It can be configured in a form excluding 124) and the like.

FIG. 5 is a diagram showing an example of an operation flowchart in the case where a failure occurs in part during operation of this system in the system using the distributed control device shown in FIG. 1 to FIG. .

At step S01 in FIG. 5, the system is activated, and at step S02, initialization for system operation is performed, and the system transitions to the system normal operation at step S03.

During normal operation of the system, for example, periodically in step S04 in the control cycle, the failure point determination unit 31 of the

reconfiguration control units

21, 22 and 23 performs failure diagnosis of each of the

CPUs

1, 2 and 3 and It is determined in step S05 whether a failure occurs in the

CPUs

1, 2 and 3.

In step S05, if no failure occurs in each of the

CPUs

1, 2 and 3, the process proceeds from step S05 to step S03 to continue the normal operation of the system.

If it is determined in step S05 that the failure point determination unit 31 of the

reconfiguration control unit

21, 22 or 23 has caused a failure in any one of the

CPUs

1, 2 or 3, the process proceeds to step S11. In the example of FIG. 5, in order to detect that a failure has occurred in the CPU 1 in step S11, and to shift to the degeneration operation in the CPU 2 and CPU 3 in step S12, data diagnosis means (data diagnosis unit) of the shared data diagnosis unit 27 55 diagnoses the data stored in the memory 12 and the data input from the shared data diagnosis unit 28.

Data diagnosis performed in step S12 is performed using parity, ECC (error correction code), CRC (cyclic redundancy check), data matching, and the like.

As a result of the data diagnosis in step S12, it is determined in step S13 whether the data is correct. If any data is correct in step S13, the process proceeds to step S14. In this example, the CPU 2 substitutes the CPU 1 and performs the system degeneration operation in step S15.

On the other hand, if one of the data is incorrect at step S13, the process goes to step S21 to correct the incorrect data, and then the process goes to step S14 to perform CPU substitution processing.

In the operation flow chart of FIG. 5, the CPU 1 is broken and the CPU 2 is substituted. However, the CPU 3 may be substituted. Further, the operation when the CPU 2 or the CPU 3 fails can also be shown by the same operation flowchart as the operation flowchart shown in FIG.

Here, if the degeneration operation is a case where the automatic driving operation is changed to the degeneration operation, the important operation of the automatic driving operation is maintained while the other automatic driving operation is not performed. , The automatic driving operation is to operate with restriction.

FIG. 6 shows a case where in the system using the distributed control device shown in FIG. 1 to FIG. FIG. 6 is a diagram showing an example of an operation flowchart of FIG.

The operation flow chart of FIG. 6 is different from the operation flow chart shown in FIG. 5 in that the return operation of the CPU 1 of steps S16 to S18 is added after step S15.

If it is a hardware failure such as disconnection, it can not recover, but if it is a temporary failure such as a software error, it may be able to recover due to a reset of the CPU. For this reason, it is possible to input the reset signal to the faulty CPU, perform the recovery operation, and perform the operation again when the CPU recovers.

In FIG. 6, steps S01 to S15 are the same as the operations shown in FIG.

In step S16 following step S15, the return operation of the CPU 1 is performed. For example, the CPU 2 outputs a reset signal to the CPU 1.

Next, in step S17, a failure of the CPU 1 is detected. This can be performed by the CPU 2. Then, in step S18, if it is possible to confirm that the CPU 1 has recovered by whether or not the failure is detected in the CPU 1 in step S17, all of the CPU 1, CPU 2 and CPU 3 operate normally, and transition to system normal operation in step S03. Do.

On the other hand, if it is not possible to confirm that the CPU 1 has recovered in step S18, the system transitions to the system degeneration operation in step S15 again.

If the return operation of the CPU 1 in step 16 is attempted a plurality of times and return is not made, the entire system may be safely stopped.

In the operation flow chart of FIG. 6, the CPU 1 is broken down and replaced by the CPU 2. However, even when the CPU 2 or CPU 3 is broken down, the same operation flow chart can be used.

FIG. 7A is a timing chart of the operation in the distributed control device of the first embodiment shown in FIGS. 1 to 6, and FIG. 7B is an example of a timing chart of the operation of the distributed control device to which the present invention is not applied.

The system normal operation of step S03 shown in FIG. 7A to the system degeneration operation of step S15 correspond to each step of the operation flowchart shown in FIG. In addition, the determination step of step S05 and step S13 is abbreviate | omitted and shown in figure.

In the example shown in FIG. 7A, the normal operation in which no failure occurs in the CPU is performed in the first steps S03 and S04, but a failure occurs in the CPU 1 in the failure diagnosis of each CPU in the second step S04. In step S11, a failure of the CPU 1 is detected, the data diagnosis in step S12 and the incorrect data correction in step S21 are performed, the substitution process in step S14 is performed, and the transition to the degeneration operation in step S15 is performed.

Here, the data diagnosis in step S12 and the unauthorized data correction in step S21 can be performed by the hardware of the CPU by the distributed control device of the present invention, and can be performed at a very high speed. take time _{t a} is short.

In the timing chart of the operation of the distributed control device to which the present invention shown in FIG. 7B is not applied, as in FIG. 7A, the operation flowchart shown in FIG. 5 from the system normal operation in step S03 to the system degeneration operation in step S15. It corresponds to each step of. As in FIG. 7A, the determination steps of step S05 and step S13 are also omitted in FIG. 7B.

The timing chart of FIG. 7B as compared to the timing chart of FIG. 7A, a data diagnosis of the memory 2 and the memory 3 in step S12, a long time t _b according to bad data correction step S21. In the example shown in FIG. 7B, the data diagnosis and data correction functions by the hardware (mainly the data diagnosis means 55 (data diagnosis unit)) in the distributed control device of the present invention are not applied and executed by processing by software. It is for.

That is, it takes time for the master CPU to transfer the degeneracy software to the slave CPU via the shared memory, and it takes time to switch from the normal operation to the degeneracy operation, and the time t _b becomes long. It becomes.

On the other hand, by the distributed control device according to the first embodiment of the present invention, even if a failure occurs in part of the system, it is possible to shift to the degeneration operation at high speed by the data diagnosis and correction mechanism by hardware. .

Therefore, it is possible to realize a system that requires real time performance and high reliability.

That is, according to the first embodiment of the present invention, it is possible to realize a distributed control device capable of improving the safety and the correctness by avoiding the occurrence of a single failure point and reducing the transition delay time to the degeneration operation. Can.

In the example of the first embodiment, although the common data diagnosis unit 27 is connected to the memory 12 and the common data diagnosis unit 28 is connected to the memory 13, the common data diagnosis unit 27 is connected to the memory 12 and the memory 13. The common data diagnostic unit 28 may also be connected to the memory 12 and the memory 13.

In the example of the first embodiment, the number of CPUs and memories is three, but the number of CPUs and memories may be four or more.

Furthermore, in the example of the first embodiment, as shown in FIG. 6, although the recovery operation of the CPU 1 is performed after the system degeneration operation is performed, the recovery operation of the CPU 1 is performed before the degeneration operation is performed. The operation of the CPU 1 may be restored without performing the degeneration operation. In this case, when it is determined that recovery of the CPU 1 is difficult, the degeneracy operation is performed.

(Example 2)
Next, a second embodiment of the present invention will be described.

FIG. 8 is a schematic block diagram of the distributed control device according to the second embodiment.

The second embodiment is different from the first embodiment shown in FIG. 1 in that nonvolatile memories 70 (first nonvolatile memory) and 71 (second nonvolatile memory) are added.

In FIG. 8, a non-volatile memory 70 is connected to a bus between the reconfiguration control unit 22 and the shared data diagnosis unit 27. This non-volatile memory 70 is shared data from the reconfiguration control unit 22 when a failure occurs in the CPU 2. Information of write data to be transmitted to the diagnosis unit 27 is held (stored).

A non-volatile memory 71 is connected to a bus between the reconfiguration control unit 23 and the shared data diagnosis unit 28. This non-volatile memory 71 performs shared data diagnosis from the reconfiguration control unit 23 when a failure occurs in the CPU 3 It holds (stores) information on write data to be sent to the unit 28.

As described above, by adding the

non-volatile memories

70 and 71 to the distributed control device to hold information when a failure occurs, the entire system is stopped due to the influence of the failure and the volatile memory Even if the contents are not held, etc., the contents held (stored) in the

non-volatile memories

70 and 71 can be checked later to increase the possibility that the cause of the system stop can be confirmed, which is useful for system maintenance. It becomes possible.

As described above, according to the second embodiment, in addition to the effects obtained by the first embodiment, the above-described effects can be obtained.

Although the non-volatile memory 70 is connected to the reconfiguration control unit 22 and the non-volatile memory 71 is connected to the reconfiguration control unit 23 in the example of the second embodiment, the non-volatile memory 70 is connected to the

reconfiguration control units

22 and 23. The connection may be made, and the non-volatile memory 71 may also be connected to the

reconfiguration control units

22 and 23.

Furthermore, although the number of CPUs and memories is three in the example of the second embodiment, the number may be four or more.

(Example 3)
Next, a third embodiment of the present invention will be described.

FIG. 9 is a schematic explanatory diagram of the distributed control device according to the third embodiment.

In the third embodiment, compared to the first embodiment shown in FIG. 1, the CPU 4 (operation control unit) and the CPU 5 (operation control unit) having a lock step configuration in which the CPU is duplicated for the CPU 2 and the CPU 3 in the first embodiment. The point I made was different. The other configuration of the third embodiment is similar to that of the first embodiment.

In FIG. 9, the lockstep CPU 4 includes the CPU core 6 and the CPU core 7. The calculation result of the CPU 6 and the calculation result of the CPU 7 are collated by the collator 80, and a failure occurs in either of the CPU cores 6 and 7. Then, the failure detection signal is output to the outside of the lock step CPU 4.

The lockstep CPU 5 also includes the CPU core 8 and the CPU core 9 as in the lockstep CPU 4 and collates the calculation result of the CPU core 8 with the calculation result of the CPU core 9 by the collator 81. If a failure occurs in the system, the failure detection signal is output to the outside of the lockstep CPU 5.

In addition, the collation method in lock step operation | movement is a well-known technique.

As described above, by using a part of the CPUs (CPU 4 and CPU 5) constituting the distributed control device as lockstep CPUs, failure detection is immediately performed when a failure occurs in the distributed control device, and transition to the degeneration operation is performed at high speed. It becomes possible to realize a distributed control device that requires high reliability.

Also, if the

CPU

4 or 5 becomes the master CPU instead of the CPU 1, a failure of the master CPU itself can be detected, and the safety can be further improved.

As described above, according to the third embodiment, in addition to the effects obtained by the first embodiment, the above-described effects can be obtained.

In the example of the third embodiment, the lockstep CPU has been described as having two

CPUs

4 and 5. However, the lockstep CPU may be one of three CPUs (CPU1, CPU4, and CPU5). Good.

Further, all CPUs including the CPU 1 may be configured as lock step CPUs.

Further, although the number of CPUs and memories is three in the example of the third embodiment, various other numbers may be used.

Next, examples of data formats used in the present invention will be described using FIGS. 10A and 10B. This data format can be common to the first to third embodiments.

FIG. 10A is a diagram showing an example of a data frame output from the

reconfiguration control units

22 and 23 in the distributed control device of the present invention to a control target device.

This data frame includes a 1-bit SOF (Start of Frame) 200, a 2-bit ID (Identification) 201, an 8-bit data 202, a 4-bit CRC (203), and a 3-bit CPU in this order from the left in FIG. 10A. Data 204 and a 1-bit EOF (End of Frame) 205.

The values of the data 200 to 205 are represented by binary numbers of 0 and 1, respectively.

The data frame shown in FIG. 10A is a frame in which the value of ID 201 is 10 and the frame is output from CPU 2, the value of data 202 is 10111110, the value of CRC 203 for data 202 is 1110, and faulty CPU 204 is 000. It indicates that no failure has occurred in any of the CPUs.

On the other hand, FIG. 10B is a diagram showing an example of a data frame when a failure occurs, and the value of data 210 is 00111110 and the value of CRC 211 is 0111 as compared to the data frame shown in FIG. 10A. The place where the value of is 001 is different. In the example shown in FIG. 10B, a fault occurs in the CPU 1 due to the value of the faulty CPU 212, and as a result, the value of the data 210 is affected by the fault, and the value of the CRC 211 for the data 210 is different.

As described above, by adding information on whether each CPU is operating normally or malfunctioning to a data frame communicated in the distributed control device, it is possible to determine which CPU has occurred in or out of the distributed control device. Since accurate and quick detection is possible, a highly reliable system can be realized.

(Example 4)
A fourth embodiment of the present invention will now be described using FIG.

FIG. 11 is a diagram showing an example in which the distributed control system according to the fourth embodiment is applied to a vehicle control system in a vehicle control system.

In FIG. 11, the interior of a car 500 is configured in a form in which a plurality of electronic control units are connected.

This automobile 500 includes an autonomous driving ECU (Automating Driving ECU, AD-ECU) 511 receiving the inputs of the

sensors

514 and 515, and a power train ECU 510 for operating the automobile 500 by operating the

front wheels

501 and 502. Vehicle motion control devices (Vehicle Motion Control, VMC) 512 and 513 for transmitting a traveling command from the AD-ECU 511 to the power train ECU 510 are connected as shown in FIG.

The AD-ECU 511 includes a CPU 511a, a reconfiguration control unit 511b, and a local memory 511c (Local Memory, LM). The VMC 512 includes a CPU 512a, a shared data diagnosis unit 512b, a reconfiguration control unit 512c, and an LM 512d.

Similarly, the VMC 513 includes a CPU 513a, a shared data diagnosis unit 513b, a reconfiguration control unit 513c, and an LM 513.

In the automobile 500, the AD-ECU 511, the

VMCs

512 and 513, and the power train ECU 510 are connected to one another and perform coordinated operation to perform automatic operation control.

The automatic driving ECU 511 corresponds to the CPU 1, the reconfiguration control unit 21 and the memory 11 of FIG. 1, and the vehicle motion control device 512 corresponds to the CPU 2, the reconfiguration control unit 22, the shared data diagnosis unit 27 and the memory 12 of FIG. It corresponds. A vehicle motion control device 513 corresponds to the CPU 3, the reconfiguration control unit 23, the shared data diagnosis unit 28, and the memory 13 in FIG. 1.

In the automobile system shown in FIG. 11, for example, when a failure occurs in the AD-ECU 511, the

VMCs

512 and 513 connected to the AD-ECU 511 detect that the failure occurs in the AD-ECU 511, respectively.

In this example, the VMC 512 quickly performs the degeneration operation of the AD-ECU 511 by diagnosing data shared by the LM 511 c of the AD-ECU 511 and the LM 512 d of the VMC 512 by the reconfiguration control unit 512 c of the VMC 512.

By these operations, the AD-ECU 511,

VMCs

512 and 513, and the power train ECU 510 can continue the minimum operation while shifting to the degeneracy operation, and continue or stop the rotation of the

front wheels

501, 502 according to the surrounding conditions. Secure the safe operation of the entire automobile system.

As described above, by applying the distributed control device of the present invention to the vehicle control device of the automobile 500, even if a failure occurs in a part of the device constituting the automatic driving function of the automobile 500, a fallback operation is performed as the entire automobile 500. It will be possible to keep safety while doing

(Example 5)
Next, a fifth embodiment of the present invention will be described.

FIG. 12 is a diagram showing an example where the distributed control device according to the fifth embodiment is applied to an operation control device in an industrial control system.

In FIG. 12, this industrial control system includes a computer 600 for overall control of the system, a controller 631 controlled by the computer 600, a programmable logic controller 632 for controlling the display plate 640, and programmable logic for controlling the actuator 641. And a controller 633.

The controller 631 and the

programmable logic controllers

632, 633 are connected via the control bus 637, respectively.

The controller 631 is configured by combining a plurality of modules such as a CPU module 601, a memory module 611, and a reconfiguration control module 621.

The programmable logic controller 632 is also configured by combining a plurality of modules in the same manner as the controller 631. The programmable logic controller 632 is configured by combining the CPU module 602, the memory module 612, the reconfiguration control module 622, and the like.

Similarly, the programmable logic controller 633 also includes a CPU module 603, a memory module 613, a reconfiguration control module 623, and the like.

The controller 631 corresponds to the CPU 1, the reconfiguration control unit 21, and the memory 11 in FIG. 1, and the programmable logic computer 632 corresponds to the CPU 2, the reconfiguration control unit 22, the shared data diagnosis unit 27, and the memory 12 in FIG. 1. . The programmable computer 633 corresponds to the CPU 3, the reconfiguration control unit 23, the shared data diagnosis unit 28, and the memory 13 in FIG. 1. However, in FIG. 12, the shared data diagnosis unit is omitted.

In this industrial control system, for example, when a failure occurs in the controller 631, the

programmable logic controllers

632 and 633 detect that the failure has occurred in the controller 631 via the control bus 637.

In this example, the reconfiguration control unit 622 diagnoses data shared by the memory module 612 of the programmable logic controller 632 and the memory module 611 of the control controller 631 to allow the programmable logic controller 632 to perform the degeneration operation of the controller 631. It is done promptly by

By the operation described above, the controller 631 and the

programmable logic controllers

632, 633 can continue the minimum operation while shifting to the degeneracy operation, and by continuing or safely stopping the operation of the display plate 640 and the actuator 641, the industrial system As a whole, safe operation can be secured.

As described above, by applying the distributed control apparatus according to the fifth embodiment of the present invention to the operation control apparatus in the industrial control system, even if a failure occurs in some of the apparatuses constituting the industrial control system, the system as a whole can It is possible to maintain safety while immediately shifting to the degeneracy operation.

The present invention is not limited to the embodiments described above, but includes various modifications. For example, the embodiments described above are described in detail in order to explain the present invention in an easy-to-understand manner, and are not necessarily limited to those having all the configurations described.

Also, it is possible to replace part of the configuration of one embodiment with the configuration of another embodiment. In addition, it is possible to add the configuration of another embodiment to the configuration of one embodiment.

Furthermore, it is possible to add, delete, and replace other configurations for some of the configurations of the respective embodiments.

1, 2, 3, 511a, 512a, 513a ... CPU, 4, 5 ... lock step CPU, 6, 7, 8, 9 ... CPU core, 11, 12, 13, 511c, 512d, 513d ...

memory

17, 18, 19 ...

memory space

21, 22, 23, 511 b, 512 c, 513 c ...

reconfiguration control unit

27, 28, 512 b, 513 b ... shared data diagnosis unit, 30 ... shared area determination unit, 31 ... failure point determination unit, 40, 41, 42, 66 ... demultiplexer, 46, 60, 61, 62 ... selector, 51 ... address buffer, 52: Write data buffer,
53: command buffer, 55: data diagnostic means (data diagnostic unit), 56: failure diagnosis state machine, 70, 71: non-volatile memory, 80, 81: verification unit, 500.・ Automobile, 501, 502 ・・・ front wheel, 510 ・・・ Power train ECU, 511 ・ Automatic operation ECU, 512, 513 ... Vehicle motion control device, 514, 515 ... Sensor, 600 ... Computer, 601, 602, 603 ... CPU module, 611, 612, 613 ... Memory module, 621, 622, 623 ... Reconfiguration control module, 631 ... Control controller, 632, 633 ... Programmable logic controller, 640 ... display board, 641 ... actuator

Claims

A first operation control unit,
A first reconfiguration control unit connected to the first operation control unit;
A first memory connected to the first reconfiguration control unit;
A second operation control unit,
A second reconfiguration control unit connected to the second operation control unit;
A second memory connected to the second reconfiguration control unit;
A second shared data diagnosis unit connected to the second reconfiguration control unit and the second memory;
A third operation control unit,
A third reconfiguration control unit connected to the third operation control unit;
A third memory connected to the third reconfiguration control unit;
The third reconfiguration control unit and a second shared data diagnosis unit connected to the third memory;
And the second memory has the second dedicated memory space, the shared memory space with the first memory, and the shared memory space with the third memory, and the third memory has the second memory. 3 dedicated memory space, shared memory space with the first memory, and shared memory space with the second memory,
The first shared data diagnostic unit diagnoses data stored in the shared space with the first memory in the second memory, and rewrites erroneous data into correct data, and the second shared data diagnostic unit A distributed control device for diagnosing data stored in a shared memory space with the first memory in the third memory and rewriting erroneous data into correct data.
In the distributed control device according to claim 1,
Each of the second reconfiguration control unit and the third reconfiguration control unit determines a shared area determination signal indicating whether to access the dedicated memory space or the shared memory space. A distributed control device characterized by comprising a shared area determination unit for outputting data to the third memory or the third memory.
In the distributed control device according to claim 1,
The second reconfiguration control unit and the third reconfiguration control unit receive failure detection signals of the first operation control unit, the second operation control unit, and the third operation control unit, respectively. , And the first shared data diagnostic unit and the second shared data diagnostic unit respectively output the shared memory in response to the data diagnostic request signal. A distributed control device characterized by comprising a data diagnosis unit for diagnosing data stored in a space.
In the distributed control device according to claim 3,
The distributed control device, wherein the data diagnosis unit diagnoses data using parity of data stored in the shared memory space, an error correction code, or a cyclic redundancy check.
In the distributed control device according to claim 1,
The second reconfiguration control unit, a first nonvolatile memory connected to the second memory, and a third nonvolatile memory connected to the third reconfiguration control unit and the third memory , A distributed control device characterized by further comprising.
In the distributed control device according to claim 1,
One, two, or all of the first operation control unit, the second operation control unit, and the third operation control unit are characterized by being an operation control unit having a lock step configuration. Distributed control unit.
In the distributed control device according to claim 1,
The first reconfiguration control unit, the second reconfiguration control unit, and the third reconfiguration control unit mutually communicate data, and a data frame of data to be communicated with each other is the same as that of the first operation control unit. A distributed control device comprising failure information, failure information of the second operation control unit, and failure information of the third operation control unit.
The distributed control device according to any one of claims 1 to 7.
The distributed control device, wherein the distributed control device is a vehicle control device.
The distributed control device according to any one of claims 1 to 7.
The distributed control device, wherein the distributed control device is an operation control device in an industrial control system.