GB2512468A

GB2512468A - Control equipments, control systems, and data generation methods

Info

Publication number: GB2512468A
Application number: GB1402502.7A
Authority: GB
Inventors: Kotaro Shimamura; Naoki Shibata; Nobuyasu Kanekawa; Naoki Kurihara
Original assignee: Hitachi Ltd
Current assignee: Hitachi Ltd
Priority date: 2013-02-26
Filing date: 2014-02-13
Publication date: 2014-10-01
Anticipated expiration: 2034-02-13
Also published as: JP2014164561A; GB2512468B; IN2014DE00412A; GB2512468A8; GB201402502D0; CN104008025A; CN104008025B; JP6017344B2

Abstract

Control equipment has a plurality of processing modules 101, 102 performing the same processing and whose results are compared to detect a malfunction in the processing modules. Transmission of data is cut off at the time of detection of the malfunction. A check code concatenation circuit 131 concatenates the processing result outputted by one module 101 with a check code generated on the basis of the result of another module 102, and outputs the processing result concatenated with the check code.

Description

CONTROL EQUIPMENTS, CONTROL SYSTEMS, AND DATA GENERATION

METHODS

BACKGROUND OF THE INVENTION

Field of the Invention

The present invention relates to control equipments, control systems, and data generation methods.

Description of the Related Art

As a background art of this technical field, there

is Japanese Patent Laid-Open Publication No. 10-340102 relating to triplicated control equipments which are configured to secure fail-safe characteristics in a railroad system and a single or duplicated control equipments. An apparatus is disclosed in paragraph number 0008 of Japanese Patent Laid-Open Publication No. 10-340102, the apparatus including: triplicated control equipments consist of three control equipments; compare data communication lines for transmitting data prepared by each of the triplicated control equipments to the other control equipments at the time when the triplicated control equipments transmit data to the other equipment connected by serial communication; triplicated comparators each of which is provided in each of the triplicated control equipments and configured to compare the data of the control equipment having the comparator with the data received from the other control equipments via the compare data communication lines; triplicated fault detection sections each of which is provided in each of the triplicated control equipments and configured to detect a fault of the control equipment provided with the fault detection section; and a transmission right selection section configured, on the basis of the comparison results from the comparators and on the basis of signals from the fault detection sections, to select one of the control equipments which transmits the data to the other equipment connected by serial communication.

Further, an apparatus is disclosed in paragraph number 0009 of Japanese Patent Laid-Open Publication No. 10-340102, the apparatus being configured such that each control equipment transmits the data to be transmitted to the two other control equipments, and such that the first equipment compares the data to be transmitted with data received from the two other control equipments, and such that when, in the first equipment, the data of the first equipment is equal to the data from the other equipments, and when, in each of the other equipments, the data of each of the other equipments is equal to the data of the first equipment, and when no fault is detected in the first equipment, the data of the first equipment is transmitted from the control apparatus.

Further, as another background art of this technical field, there is Japanese Patent Laid-Open Publication No. 2005-102037. A checking method of a communication equipment is disclosed as described in paragraph number 0046 to 0052 of Japanese Patent Laid-Open Publication No. 2005-102037, as follows. "FIG. S is a view showing an example of a configuration of a packet used when a packet communication equipment 1 according to the present invention transmits! receives a TCP!IP conimunication packet encapsulated in an Ethernet (registered trademark) packet. ... At the time of encapsulation, a checksum calculation is used in TCP (UDP) and IP in order to determine whether or not the packet is correct. As shown in FIG. 5, the target range of the checksum calculation is, in the case of a TCP packet, the entire TCP packet including a TCP header and TCP data, and is, in the case of TJDP and I?, only a header. At the time of encapsulation, the transmission source calculates a checksum, and adds, as checksum information, the calculation result to each of the headers. The receiver side calculates the checksum of the target range including the checksum information. When the calculation result is zero, the receiver side determines that the packet is normal. When the calculation result is not zero, the receiver side determines that the packet is erroneous." In Japanese Patent Laid-Open Publication No. 10- 340102, the control equipment is described, in which, after processing results of a plurality of processing modules are compared with each other and confirmed as being correct, the data of the processing result is transmitted, and thereby transmission of erroneous data due to a fault in the processing modules is prevented.

However, in the control equipment described in Japanese Patent Laid-Open Publication No. 10-340102, even when the data subjected to the comparison is different from the transmitted data, the difference cannot be detected.

In Japanese Patent Laid-Open Publication No. 2005- 102037, the equipment is described, in which an error of transmitted data is detected by adding a checksum to the data on the transmission side and by checking the checksum on the receiver side. However, in the equipment described in Japanese Patent Laid-Open Publication No. 2005-102037, in the case where data to be transmitted is already erroneous at the time of adding a checks.nu to the data on the transmission side, the error cannot be detected.

An object of the present invention is to provide a control equipment which is configured such that the same processing is performed by a plurality of processing modules, and such that the processing results are then compared with each other to detect a malfunction occurred in the processing modules to cut off the data transmission, and which is featured in that it can detect a difference between the data subjected to the comparison and transmitted data.

SUMMARY OF THE INVENTION

In order to solve the above described problem, a control equipment according to the present invention includes a check code concatenation circuit whici concatenates and outputs a processing result outputted by a first processing module with a check code generated on the basis of a processing result of a second processing module.

In the case where a processing result outputted by the first processing nodule is different from data subjected to the comparison, consistency cannot be maintained between the processing result outputted by the first processing module and the check code generated on the basis of the processing result of the second processing module. Accordingly, the consistency between the processing result outputted by the first processing module and the check code is confirmed in an apparatus receiving the transmitted data, to thereby make it possible to detect the difference between the transmitted data and the data subjected to the comparison. Further, issues other than those described above, configurations and effects will be apparent from the following

description of embodiments.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a view showing a configuration of a control system of embodiment 1 to which the present invention is applied; FIG. 2 shows an example of data arrangement of a RIM 112 and an example of a processing flow of a processing module 101 of the control system of FIG. 1,; FIG. 3 is a view showing a first example of a configuration of a check code concatenation circuit 131 of the control system of FIG. 1; FIG. 4 shows an example of data arrangement of a check code memory 301 of the check code concatenation circuit of FIG. 3; FIG. 5 is a view showing a first example of an operation of the check code concatenation circuit of FIG. 3; FIG. 6 is a view showing a second example of the operation of the check code concatenation circuit of FIG. 3;

-H -

FIG. 7 is a view showing a third example of the operation of the check code concatenation circuit of FIG -FIG. 8 is a view showing a second example of the confio;uration of tne check code concaten.at i.on circuit ±31.

of the control system of-FIG. 1; FIG. 9 shows an example of data arrangemer1t or a check code memory 801 of the check code concatenatmor circuit ofE 7G. 8; FIG. 10 is a view showing an example of an operation of the check oode concatenation circuit of FIG. 8; FIG. 11 is a view showing a oorificurat±on of a control system of embodiment 2 to whic.h the present invention is applied.; FIG. 12.is a view showing a configurat.ion o-f a cont:co I svst em of embodiment 3 to which the cresent.

invention is applied; and FIG, 13 is a view showing an example of an operation.

of a switch corLtroi circuit 1243 of the control system of FIG. 12.

DETAIlED DESCRIPTION OF THE PREFERRED EMBODIMENTS

In the following, embodiments according to the loresentinvenr.ion will he described with reference to t-he accompanying drawings.

Further, rocessing may be expianed eiow by using "program" as a subject. The program is executed by a rocessor, for example, an NP (Mi cr0 Processor) or a CPU (Central Processing Unit) , to perform defined processing.

It should be noted that t.he. processing is performed by suitabi usin a storage resource (for e?amo!.e, a memory) and a communication interface module (for example, a communcaton port.), aic hence a processor may al so be used as the s.ubj c-ct of process ing. The processor may have dedicated hardware other than the CPU. A computer program may he installed in each of corLputers from a program sourc The program sourc.e may be provide.d, for example., by a program distribution server, a memory medj.um or the like.

-

Further, each comuonent, for example, each controller, can he identified by a number, or the like, but may he identified by using *other kind of identification information, such as a name, as long as eacn component can ne aentata.ea by *the identification information, in the figures and desc.ription of the present invention, the same portions are denoted by the same reference numerals or oharacters, However, the present invention is not limited to the present embodiments, and all applications that conform to the spirit of the pre sent invention are included in the.

technical scope of the present invention. ITirther, unless otherwise specific--d a plurality of or single component may be provided.

Lfroodiment i] FIG. 1 is a view showirci a-co-nrquratron of a control system of embodiment 1 to which the present invention s applied.

A control system 100 according to the present embodiment includes a first processing mu dtile 101, a second pr:ocessing module 102., a check code concatenation circuit 131, a transmission cut off--switch 132, a switch control circuit 135, a ontrol terminal 133, and a plant 134.

The first processing module 101 includes a CPU 111, PAM (Random Access Mern.orv) 112, a RPM (Read OnI.y Memory) 113, a transmitter 114., a receivu 115, arid a comparator 116. These components are connected t-o each other h-y an internal! bus 117.

The second proc-easing module 102 includes a CPU 121, a RAM 122, a. RPM 123, an ir-Lterfa.ce cir utit 12:4, a receiver 125, and a comparator 126. These components are connE-! cted to each other by an internal bus 1.2-7.

There ceiver 115 receives data from the control terminal 133 via transmission lines 145, and writes the data into the R14 1 12 via the b-us 117 The CPIJ 111 pe.rfo.rms the following proc-essing according to a progr-am stored in the RPM 113. The CPU 111 first reads, via the bus 117, data written int-o the RAM 112 by the receiver 115, and performs predetermined control processing based on the data. Then, the Cpu 111 writes the result of the processing into the RAM 112 via the bus 117.

Further, the cu 111 receives, via the bus.17, comparison results written into the RAM 112 by the comparator 116. In the case where the comparison results indicate that compared data are equal, the Cpu 111 generates, from the processing result written into the RAM 112, data to be transmitted having a predetermined form. Then, the cu 111 writes the generated data into the RAM 112. In the case where the comparison results indicate that compared data are not equal, the Cpu 111 stops the processing.

The comparator 116 reads, from the RAM 112, the processing result of the CPU 111, and transmits the processing result to the comparator 126 via transmission lines 150. Further, the comparator 116 receives the processing result of the CPU 121 of the second processing module 102 from the comparator 126 via the transmission lines 150, and compares the received processing result with the processing result of the CPU 111, the result being read from the RAM 112. when completing the comparison, the comparator 116 writes the comparison result into the RAM 112 via the bus 117, and transmits the comparison result to the switch control circuit 135 via transmission lines 147.

The transmitter 114 reads, via the bus 117, the data to be transmitted written into the RAM 112 by the CPU 111.

Then, the transmitter 114 transmits the read data to the check code concatenation circuit 131 via transmission lines 141.

The operation of each of the receiver 125 and the comparator 126 is similar to the operation of each of the receiver 115 and the comparator 116.

It should be noted that, in the present embodiment, an example in which the comparison processing is performed by the comparator 116 and the comparator 126, but a method is also considered in which the comparison processing is performed by the Cpu 111 and the CPU 121 respectively according to programs stored in the ROM 113 and the ROM 123.

The operation of the CPU 121 is almost the same as the operation of the Cpu 111. However, instead of writing data to be transmitted into the RAM 122, the CPU 121 writes, into the RAM 122, a check code generated from the processing result written into the RAM 122. It should be noted that, other than the checksum described above, there are, as check codes, codes to detect errors, such as parity codes, and CRC (Cyclic Redundancy Check).

Further, a code to correct errors, such as ECC (rror Correcting Code), may also be used.

The interface circuit 124 reads, via the bus 127, the check code written into the RAN 122 by the CPU 121, and transmits the read check code to the check code concatenation circuit 131 via transmission lines 149.

The check code concatenation circuit 131 concatenates the transmitted data received from the transmitter 114 via the transmission lines 141, with the check code received from the interface circuit 124 via the transmission lines 149 and outputs the data concatenated with the check code to the transmission cut off switch 132 via transmission lines 142.

The switch control circuit 135 outputs a control signal of the transmission cut off switch 132 to signal lines 151 on the basis of the comparison result received from the comparator 116 via the transmission lines 147, and on the basis of the comparison result received from the comparator 126 via transmission lines 148.

The transmission cut off switch 132 is controlled to be set to ON only when both the comparison results of the comparator 116 and the comparator 126 indicate that the compared data are equal. The transmission cut off switch 132 is controlled to be set to OFF when either one or both of the comparison results of the comparator 116 and the comparator 126 indicate that the compared data are not equal. Further, the transmission cut off switch 132 controls ON/ OFF of an internal switch according to the control signal received from the signal lines 151. When the internal switch is set to ON, the transmission cut off switch 132 outputs, as it is? the transmitted data received from the transmission lines 142 to transmission lines 143. when the internal switch is set to OFF, the transmission cut off switch 132 outputs nothing to the transmission lines 143, and the transmission lines 143 is set in an idle state.

The control terminal 133 checks the consistency between the check code and the data body of the data received from the transmission lines 143, so as to confirm whether or not the received data is correct.

When the consistency is not obtained, the control terminal 133 outputs, to signal lines 144, control signals for safely stopping the plant 134. When the consistency is obtained, the control terminal 133 performs predetermined processing to the received data, so as to generate control signals of the plant 134, and outputs the control signals to the signal lines 144.

Further, the control terminal 133 receives signals indicating the state of the plant 134 via signal lines 146, and performs predetermined processing to the signals, so as to transmit the signals to the transmission lines 145. It should be noted that examples of the plant 134 include a moving vehicle, such as a railway vehicle, an automobile, and an airplane, a construction machine, an operation system for controlling operation of a moving vehicle, various plants, such as an oil refining plant and a power generation plant, communication equipment, and the like, but the plant 134 is not limited to these.

Further, in the present embodiment, only one control terminal is shown, but a plurality of control terminals can also be provided. In this case, a repeater may be provided at each of the transmission lines 143 and 145 as required.

FIG. 2 shows an example of data arrangement of the RAN 112 and an example of a processing flow of tie processing module 101 of the control system of FIG. 1.

The left side of FIG. 2 shows the data arrangement of the -10 -RAM 112, and the right side of FIG. 2 shows the processing flow of the processing nodule 101.

"Receiving data" denoted by (1) is processing in which the receiver 115 writes, into the RAM 112, data received via the transmission lines 145.

"Control processing" denoted by (2) is processing in which the Cpu 111 reads the received data from the RAM 112, so as to perform predetermined control processing to the received data, and then writes the processing result into the RAM 112.

"Data exchange and comparison" denoted by (3) is processing in which the comparator 116 exchanges the processing results with the comparator 126, so as to compare the processing results with each other.

"Addition of header and check code" denoted by (4) is processing in which the cu 111 generates data to be transmitted having a predetermined form, and writes the data into the RAM 112. Here, an example is shown, in which a header including information on transmission source, transmission destination, and data size, and a check code calculated for the header or data are added to the data. It should be noted that there is a case where one header and one check code are added to the entire processing result, but when the size of the processing result is large, the processing result may be divided into a plurality of data so that a header and a check code are added to each of the divided data.

"Transmission" denoted by (5) is processing in which the transmitter 114 reads the data to be transmitted from the RAM 112 and transmits the data to the transmission lines 141.

FIG. 3 is a view showing a first example of a configuration of the check code concatenation circuit 131 of the control system 100 of FIG. 1.

The check code concatenation circuit 131 of the present embodiment includes the check code memory 301, a check code concatenation position detection circuit 302, and a selector 303.

-11 -The check code memory 301 receives, from the transmission lines 149, the check codes generated by the processing module 102, and stores the check codes in internal memory elements. Further, the check code memory 301 outputs, to the selector 303 via signal lines 312, a check code stored in the memory elements corresponding to a reading address received from the check code concatenation position detection circuit 302 via signal lines 311.

The check code concatenation position detection circuit 302 receives transmitted data from the transmission lines 14]. and counts the number of data between the head of the transmitted data and the data being currently received. Further, according to the calculated number of data, the check code concatenation position detection circuit 302 outputs, to signal lines 313, control signals of the selector 303.

Further, the check code concatenation position detection circuit 302 counts the number of transmitted data (the number of transmitted packets) received from the transmission lines 141, and outputs, to the signal lines 311, the counted number as a reading address of the check code memory 301. On the basis of the reading address, a correct check code corresponding to the transmitted data currently received can be read from the check code memory 301, so as to be sent to the selector 303.

When the counted number of data is equal to a predetermined numerical value, the selector 303 is controlled to select the check code received from the signal lines 312. Otherwise, the selector 303 is controlled to select the transmitted data received from the transmission lines 141. That is, when determining that the counted number of data corresponds to the position at which the check code is to be inserted or replaced, the selector 303 outputs, to the transmission lines 142, the check code from the check code memory 801.

Otherwise, the selector 303 outputs and sends the header -12 -or the processing result to the transmission cut off switch 132 via the transmission lines 142.

Further, according to the control signal received from the check code concatenation position detection circuit 302 via the signal lines 313, the selector 303 selects either the transmitted data received from the transmission lines 141, or the check code received from the signal lines 312, and outputs the selected data or check code to the transmission lines 142.

FIG. 4 shows an example of data arrangement of the check code memory 301 of the check code concatenation circuit 131 of FIG. 3.

The check code memory 301 has memory elements for storing a plurality of check codes generated by the second processing module 102. FIG. 4 shows an example in which check codes 2-1 to 2-3, and the other check codes are stored in the check code memory 301.

FIG. 5 is a view showing a first example of an operation of the check code concatenation circuit 131 of FIG. 3.

No check code is included in the transmitted data received from the transmission lines 141, and the transmitted data is composed of a header and a processing result. Therefore, between the header and the processing result, the check code concatenation circuit 131 inserts a check code (check code generated by the processing module 102) stored in the check code memory 301, and then outputs the resultant data.

Specifically, between a header 1-1 and a processing result 1-1 which are data received from the transmission lines 141, the check code concatenation circuit 131 inserts a check code 2-1 received from the check code memory 301, so as to generate a transmitted data to the transmission lines 142. It should be noted that the size of the header is the same for all the transmitted data, and also the number of data from the head to the insertion position of the check code is the same for all the transmitted data. The check code is inserted before the processing result, and thereby the insertion position -13 -of the check code can be fixed even when the size of the processing result is changed.

As another example, there is also a method of fixing the number of data between the check code and the end of the transmitted data. In this case, the insertion position of the check code can be fixed even in the method of inserting the check code at the end of the processing result. As described above, the check code generated on the basis of the processing result of the second processing module is added to the processing result outputted by the first processing module, arid then the consistency between the processing result and the check code is checked on the receiver side, such as the control terminal. Thereby, it is possible to detect that a processing result subjected to the comparison between the processing modules is different from a processing result transmitted from the first processing module.

FIG. 6 is a view showing a second example of the operation of the check code concatenation circuit 131 of FIG. 3.

A check code is also included in the transmttted data received from the transmission lines 141. After the check code is replaced by the check code stored in the check code memory 301, the transmitted data is outputted.

Specifically, a check code 1-1 of the transmitted data received from the transmission lines 141 is replaced by a check code 2-1 received from the check code memory 301, and then the transmitted data to the transmission lines 142 are generated.

Similarly to FIG. 5, as for the position of the check code, a method is also considered, in which the check code is arranged at the end of the processing result so that the number of data between the check code and the end of the transmitted data is fixed.

In the example of FIG. 6, since a check code can be included in the data transmitted from the first processing module 101, there is an advantage, in addition to the advantage of the example shown in FIG. 5, that the transmission data creation program used in the -14 -conventional processing module can also be used as the transmission data creation program executed by the CPU 111.

FIG. 7 is a view showing a third example of the operation of the check code concatenation circuit 131 of FIG. 3.

The transmitted data received from the transmission lines 141 include, at the position of each of the check codes, an incorrect code (code which is not equal to the check code generated from the processing result). The check code concatenation circuit 131 replaces the incorrect code by a check code stored in the check code memory 301, and outputs the resultant data. Specifically, the check code concatenation circuit 131 generates transmitted data to the transmission lines 142, in such a manner that a incorrect code -1, arranged between a header 1-1 and a processing result 1-1 which are the data received from the transmission lines 141, is replaced by a check code 2-1 received from the check code memory 301.

In the example of FIG. 7, when the check code concatenation circuit 131 malfunctions so that the check code is not replaced, the header and the processing result are inconsistent with the incorrect code, and hence there is further an advantage that the malfunction of the check code concatenation circuit 131 can be detected by the consistency check performed by the control terminal 133.

FIG. 8 is a view showing a second example of the configuration of the check code concatenation circuit 131 of the control system 100 of FIG. 1.

A check code concatenation circuit 131 according to the present embodiment includes a check code memory 801, a check code concatenation position detection circuit 802, and a selector 803.

The check code memory 801 receives check codes and information about the concatenation positions of the check codes from the transmission lines 149, and stores the check codes and the information in internal memory elements. Further, via the signal lines 312, the check -15 -code memory 801 outputs, to the selector 303, a check code stored in an internal memory element corresponding to a reading address received from the check code concatenation position detection circuit 802 via the signal lines 311. Further, the check code memory 801 outputs the information about the concatenation position of the check code to the check code concatenation position detection circuit 802 via signal lines 811.

The check code concatenation position detection circuit 802 receives transmitted data from the transmission lines 141 and counts the number of data between the head of the transmitted data and the data currently received. Further, the check code concatenation position detection circuit 802 outputs a control signal of the selector 303 to the signal lines 313 according to the counted number of data and the information about the concatenation position of the check code, the information being received from the check code memory 801 via the signal lines 811. Further, the check code concatenation position detection circuit 802 counts the number of check code concatenation, and outputs, as a reading address of the check code memory 801, the count result to the signal lines 311.

The selector 303 is controlled to select the check code received from the signal lines 312 at the time when the counted number of data is equal to the position received from the signal lines 811. Otherwise, the selector 303 is controlled to select the transmitted data received from the transmission lines 141.

Further, according to the control signal received from the check code concatenation position detection circuit 802 via the signal lines 313, the selector 303 selects either the transmitted data received from the transmission lines 141 or the check code received from the signal lines 312, and outputs the selected data or check code to the transmission lines 142.

FIG. 9 shows an example of arrangement of data of the check code memory 801 of the check code concatenation circuit of FIG. 8.

-16 -The check code memory 801 stores therein check codes (C2-?) and information (F-?, A-?) about the concatenation position of the check code. Reference character P-? denotes a packet number that is an order number representing the transmitted data to which the check code (C2-?) is concatenated. Reference character A-? denotes a replacement address that is a numerical value representing the number of data between the head of the transmitted data and the position to which the check code is concatenated.

FIG. 10 is a view showing an example of an operation of the check code concatenation circuit 131 of FIG. 8.

The first transmitted data has only one place for check code replacement, and the data at the place specified by A-l stored in the check code memory 801 is replaced by C2-1 stored in the check code memory 801.

Although not shown in FIG. 10, a number representing that the transmitted data for check code replacement is the first transmitted data is stored at P-i of the check code memory 801.

The second transmitted data has two places for check code replacement, and the data at the places respectively specified by A-2 and A-3 stored in the check code memory 801 are respectively replaced by C2-2 and C2-3 stored in the check code memory 801. Reference character C2-2 denotes a check code for the header, and reference character C2-3 denotes a check code for the processing result. Although not shown in FIG. 10, a number representing that the transmitted data for check code replacement is the second transmitted data is stored in P-2 and P-3 of the check code memory 801.

In the examples of FIG. 9 and FIG. 10, there is an advantage that, even when the number of check codes to be concatenated and the concatenation position are different for each of the transmitted data, the concatenation of the check codes can be performed. Further, when check codes are respectively added to the header and the processing result, there is also an effect that the place of error occurrence can be immediately specified. -17

[Embodiment 2] FIG. 11 Is a view showing a config-uration of a control system of embodiment 2 to which the present invent ion i s applied.

A control. system I 100 of the pres ent embod.ine-nt includes a first processing jmodu1-e 1101, a second processing module 1102, a check code conca Lenation ci rout t 131,at ran emission out off switch 132, a cortro 1 -i-----t-LerhLiLL,)-J_J Jy fin))-cn -LU The. first processing module 1101 inciuo:es a Cpu lii, a RAM:112,aRGM 113, a transmitter un, a receiver 115, and a transfer conlirol circuit 1116.

The second processing module 1102 inc.ludes a CPU 121, a RAM 122, a P014 123, an interface circuit 124, a receiver 125, and a comparator 1126.

The control system 1100 of FIG. 11 of-the presE:-3nt embodiment is different from the control s-ps tern 100 of PlC. 1 in that the comparator is provided only in the second processing module 1102. Further, the operatinan of the circuit denoted by the same reference numeral is the same between FIG -11 and FIG. I The transfer control circuit 2 116 transmi Us the processing result of the CPU 111, which urocessing result is stored in-the RPM 112, t-o the comparator 1126 via transmlsslcn lines 1150. Further, the transfer control circuit 1116 receives a comparlson result from the comparator 112.6 via the transmission 1 irL s 11 50, anid writes the comp-arison result into the RAM 112 via a bus 11 7 The comoarator 1126 receives the. processing result ci the CPU 111 fonni the transfer con ho] ci rc'ui U 1116 via the transmission lines 1150. Also, the comparator 1126 reads the pro cess-ing resuLt of-the CPU I I from the PAM 122, and compares the nroc sing result of the CPU lI:L with-the processing result of the CPL-121. When finishing tt-e comparison processing, the comparator 1126 writes the comparison result into the RAM 122 via a bus 127, and transmits the comparison result tc thetr ansner control crcurt 111 tnc transnicscn ires 15 -18 -Further, the comparator 1126 outputs a control signal of the transmission cut off switch 132 via a transmission lines 1148. when the comparison result represents that the compared data are equal, the transmission cut off switch 132 is controlled to be set to ON, while when the comparison result represents that the compared data are not equal, the transmission cut off switch 132 is controlled to be set to OFF.

In embodiment 2, the switch control circuit 135 of FIG. 1 is not necessary, and hence, in addition to the similar effect in embodiment 1, embodiment 2 has an advantage that the control system can be simplified as compared with the control system of FIG. 1.

lEmbodiment 3] FIG. 12 is a view showing a configuration of a control system of embodiment 3 to which the present invention is applied.

A control system 1200 of the present embodinent includes a first processing module 1201, a second processing module 1202, a third processing module 1203, a transmission cut off switches 1241 and 1242, a switch control circuit 1243, a selector 1244, a check code concatenation circuit 1245, a control terminal 1246, and a plant 1247.

The first processing module 1201 includes a Cpu 1211, a RAN 1212, a RON 1213, a transmitter 1214, a receiver 1215, and a comparator 1216. These components are connected to each other by an internal bus 1217.

The second processing module 1202 includes a CPU 1221, a RAN 1222, a RON 1223, an interface circuit 1224, a transmitter 1225, a receiver 1226, and a comparator 1227. These components are connected to each other by an internal bus 1228.

The third processing module 1203 includes a CPU 1231, a RAM 1232, a RON 1233, an interface circuit 1234, a receiver 1235, and a comparator 1236. These components are connected to each other by an internal bus 1237.

The present embodiment has a triple-redundant majority voting configuration in which, even in the case -19 -where one of the first processing module 1201, the second processing module 1202, and the third processing module 1203 malfunctions so that the processing result of the one of the processing modules is determined as incorrect, it is possible to continue transmission of correct data by the other two modules.

The operation of the receiver 1215, the receiver 1226, and the receiver 1235 is similar to the operation of the receiver 115 of FIG. 1.

The operation of the Cpu 1211 is almost the same as the operation of the Cpu 111 of FIG. 1. However, in the case of determination of the comparison results, when one of the processing results of the CPU 1221 and the CPU 1231 is equal to the processing result of the CPU 1211, the cu 1211 performs processing to generate data to be transmitted, and when both the processing results of the Cpu 1221 and the CPU 1231 are not equal to the processing result of the CPU 1211, the CPU 1211 stops the processing.

The operation of the CPU 1221 is almost the sante as the operation of the CPU 1211. However, in addition to the operation of the CPU 1211, the CPU 1221 writes, into the RAM 1222, a check code to be transmitted to the check code concatenation circuit 1245.

The operation of the CPU 1231 is almost the sante as the operation of the Cpu 1221, but the CPU 1231 does not perform the processing to generate data to be transmitted.

The operation of the comparator 1216, the comparator 1227, and the comparator 1236 is similar to the operation of the comparator 116 and the comparator 126 of FIG. 1, except that the comparator 1216, the comparator 1227, and the comparator 1236 mutually exchange data via transmission lines 1251, 1252 and 1253, so as to generate three comparison results.

The operation of the transmitter 1214 and the transmitter 1225 is similar to the operation of the transmitter 114 of FIG. 1.

The operation of the interface circuit 1224 and the interface circuit 1234 is similar to the operation of the interface circuit 124 of FIG. 1. -20

The swit.ch control ci: cci 0 1243 race.ives conipa r.i son results from the comparators 1216, 1227 and 1236 via transmission lines 1256, 1257 and 1258, and outputs control signals of the transmii ssion cut cf--f swi tches 1241 and 1212, and the selector 1244 via the signal lines 1.259, 1260 and 1261. The control method of the transmission cut off switches 1241 arid 1242, and the control method of the selector 1241 will be described Is ten.

The or:-eration of the-transmission cut off switches 1241 and 1242 is similar to the operation of the transmission out off switch 132 of FIG. I -l'he oreratiori of the chec.k code c.omcatenatiom circuit 1245 and-tho operation of thc control terminal 1246 an e similar to the operation of the check co-dc concatenation circuit 131 arid the operatic-n of the control terminal 133, respectively, FIG. 13 is a view showing an example of an operation of the switch control circul t 1243 of-the control system of FIG. 12.

When the urocessing results of the Cpu 121-1 and tie (:211 1221 are equal ("yes") , it is determined that the rocessing re suits of the CPU 1211 and the CPU 1221 are correct. Therefore, the switch control circuit 1243 erforms control in such a manner that. the transnission cut off switch 1241 arid the transmission cut off switch 1242 are respectively set to ON and OFF s-c as-to allow the processing result of the first processing module 1201 to he outputted, as transcutted data, to the check code concatenation circuit 1245. Further, the switch control circuit 1243 oontr-o Is the selector 1241 to select the.

check code which is the output of t:he *iu:terface ci rcuit 1224 of the second processing module 1202.

Whe-n the rc:-cessinq results -of the CPU 1211 and the cpu 1221 are rot equal ("no") , arid when the processing results of the CPU 1211 and the CPU 1231 a.re e-qual ("yes") , it is determined that the processing result of the CPU 1221 is n.ct correct, and that the processing results of the C PU 1211 and the CPU 12:31 are correct, Therefore, the switch control circuit 124-3 performs -21 -control in such a manner that the transmission cut off switch 1241 and the transmission cut off switch 1242 are respectively set to ON and OFF so as to allow the processing result of the first processing module 1201 to be outputted, as transmitted data, to the check code concatenation circuit 1245. Further, the switch control circuit 1243 controls the selector 1244 to select the check code which is the output of the interface circuit 1234 of the third processing module 1203.

When the processing results of the Cpu 1211 and the Cpu 1221 are not equal ("no"), and the processing results of the Cpu 1211 and the CPU 1231 are not equal ("no"), and when the processing results of the Cpu 1221 and the CPU 1231 are equal ("yes"), it is determined that the processing result of the CPU 1211 is not correct, and that the processing results of the Cpu 1221 and the CPU 1231 are correct. Therefore, the switch control circuit 1243 performs control in such a manner that the transmission cut off switch 1241 and the transmission cut off switch 1242 are respectively set to OFF and ON so as to allow the processing result of the second processing module 1202 to be outputted, as transmitted data, to the check code concatenation circuit 1245. Further, the switch control circuit 1243 controls the selector 1244 to select the check code which is the output of the interface circuit 1234 of the third processing module 1203.

When the processing results of the CPU 1211 and the CPU 1221 are not equal ("no"), and the processing results of the Cpu 1211 and the CPU 1231 are not equal ("no"), and when the processing results of the Cpu 1221 and the Cpu 1231 are not equal ("no"), it is not known which of the processing results of the CPUs is correct. Therefore, the switch control circuit 1243 sets both the transmission cut off switch 1241 and the transmission cut off switch 1242 to OFF, so as to cut off the transmission of data. In this case, the output of the selector 1244 has no meaning, and hence the switch control circuit 1243 -22 -may output any of the control signals to the selector 1244.

With the above-described operations, even when one of the first processing module 1201, the second processing module 1202, and the third processing module 1203 malfunctions so that the processing result of the one of the processing modules becomes incorrect, the processing result of one of the two remaining processing modules can be transmitted by being concatenated with the check code of the other of the two remaining processing modules. Therefore, it is possible to confirm whether or not the data received by the control terminal 1246 is correct.

It should be noted that the present invention is not intended to be limited to the embodiments described above, and includes various modifications.

Further, the embodiments described above have been described in detail so as to better illustrate the present invention and are not intended to be necessarily limited to include all the configurations described above.

Further, a part of one of the embodiments described above can be replaced by a part of the configuration of the other embodiment, and also one of the embodiments described above can be additionally provided with a part of the configuration of the other embodiment. Further, for some of the configuration of each of the embodiments, the addition, deletion, and substitution of the configuration of the other embodiment are possible.

Further, a part or all of the respective configurations, functions, processing sections, processing means, and the like, described above may be realized by hardware such as, for example, an integrated circuit designed specifically for these applications.

Further, the respective configurations, functions, and the like, described above may be realized by software in such a manner that processors interpret and execute programs for realizing the respective functions.

Information, such as programs, tables, and files, for realizing the respective functions may be provided in -23 -a recording device, such as a memory, a hard disk, and an SSD (Solid State Drive), or in a recording medium, such as an IC card, an SD card, and a DVD.

Further, in the above-described configurations, the control lines and the information lines, which are considered to be necessary for explanation, are shown, and all of the control lines and the information lines necessary for realizing a product are not necessarily shown. In practice, almost all of the configurations may be considered to be connected to each other. -24

Claims

Claims: 1 A control equipment comprising-a plurality of processing modules including a first processin module and *a second processinq module, wherejn the piirai ity of proc.esslng modules pe.r:orn the same processing and the processing results of the plurality of processing modules are compared to thereby detect a malfunc ti on in the plurality of process i modules, and at the tjrrLe of detection of a malfunction.transmissIon of d.ata comprising the processing result and a check code generated from the processing result is-cut off, the control equipment further comprising a check code concatenation circuit configured to generate data by conc.atenating a processin.g resulLt outputted by the first processing module with a check code enerated from a rocessing result of the second processing module and t-o cransmlt the generated data.
2. The controfl. eqTllpri.enm: according to claim I, whereir the check code cor1catenation circuit includes a check code memory for storing at least one check code, and concatenates the check code stored in the check code memory with an ol.mtput including the processing result of the first p55 inn modulLe at a predetc-rmined posit ion of the output.
3 * The control equlprLent according to claim I, wherein the check c.ode. concatenation circuit includes' a memory for storing at feast one check code. and information indicating a concatenation position of the chEl-Ic k code, and performs concat one t ion c. I the check code on the basis of the information indicating the concatination position stored in the memory.
4. The control equipment acoord.ing to any one of the previous claims, wnerern -25 -an incorrect check code not equal to the check code generated from the processing result of the first processing module is added to an output including the processing result of the first processing module, and the check code concatenation circuit replaces the incorrect check code with the check code generated on the basis of the processing result of the second processing module.
5. The control equipment according to any one of the previous claims, wherein three or more processing modules compare processing results of the processing modules with each other, and for one pair of processing modules among the three or more processing modules, which pair of processing modules have processing results equal to each other, the check code concatenation circuit concatenates a processing result of one of the pair of processing modules with a check code generated on the basis of a processing result of the other of the pair of processing modules.
6. A control system including a control equipment and at least one control terminal connected to the control equipment, wherein: the control equipment comprises a plurality of processing modules including a first processing module and a second processing module; in the control equipment, the plurality of processing modules perform the same processing and the processing results of the plurality of processing modules are compared to thereby detect a malfunction in the plurality of processing modules, and at the time of detection of a malfunction, transmission of data comprising the processing result and a check code is cut off; the control equipment further comprises a check code concatenation circuit configured to generate the data by concatenating a processing result outputted by the first -26 -processing module with a check code generated on the basis of a processing result of the second processing module and to transmit the generated data; and the control terminal receives the data outputted by the control equipment, and performs, with the check code of the data, error detection or error correction of the processing result of the first processing module included in the data.
7. The control system according to claim 6, wherein the check code concatenation circuit includes a check code memory for storing at least one check code, and concatenates the check code stored in the check code memory with an output including the processing result of the first processing module at a predetermined position of the output.
8. The control system according to claim 6, wherein the check code concatenation circuit includes a memory for storing at least one check code and information indicating a concatenation position of the check code, and performs concatenation of the check code on the basis of the information indicating the concatenation position stored in the memory.
9. The control system according to any one of claims 6 to 8, wherein an incorrect check code not equal to the check code generated from the processing result of the first processing module is added to an output including the processing result of the first processing module, and the check code concatenation circuit replaces the incorrect check code with the check code generated on the basis of the processing result of the second processing module.
10. The control system according to any one of claims 6 to 9, wherein in the control equipment, -27 -three or more processing modules compare processing results of the processing modules with each other, and for one pair of processing modules among the three or more processing modules, which pair of processing modules have processing results equal to each other, the check code concatenation circuit concatenates a processing result of one of the pair of processing modules with a check code generated on the basis of a processing result of the other of the pair of processing modules.
11. A data generation method comprising: detecting a malfunction by mutually comparing processing results including a first processing result and a second processing result, the first processing result and the second processing result being obtained by performing the same processing, cutting off, at the time of detection of a malfunction, transmission of data comprising the processing result and a check code, and generating data by concatenating the first processing result with the check code generated on the basis of the second processing result, and transmitting the generated data.
12. The data generation method according to claim 11, further comprising comparing three or more processing results with each other, and for one pair of processing results among the three or more processing results, which pair of processing results are equal to each other, concatenating one of the pair of processing results with a check code generated on the basis of the other of the pair of processing results.