JP2015103192A - Verification device for control software - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a verification device that verifies whether a verification object component of a control object device may perform malfunction, when the control object device is controlled by a control software.SOLUTION: A verification device includes: first determination means 105 of determining whether a predetermined control parameter of a verification object component of a control object device meets a predetermined condition based upon a control signal that a control part simulator 301 outputs to a device simulator 303; second determination means 109 of determining whether predetermined disturbance affecting an operation of the verification object component occurs to the verification object component based on a simulating operation of the device simulator; and third determination means 110 of determining that the verification object component may perform malfunction if the predetermined disturbance occurs when the predetermined control parameter of the verification object component meets the predetermined condition.

Description

  The present disclosure relates to a verification device that verifies control software.

  Patent Document 1 discloses a simulation system for verifying a motor. In Patent Document 1, a load applied to a motor shaft is calculated based on a motor drive signal output by executing control software, and a drive torque necessary for motor operation is calculated. Patent Document 2 discloses a simulation system for verifying the operation of control software for an apparatus including a motor. In Patent Document 2, the operation of the apparatus is simulated according to a control signal output from the control apparatus by executing control software.

JP 2003-30251 A JP 2010-33192 A

  The control software is verified for operation prior to its release. Here, for example, if the control unit that executes the control software performs a process in which the motor is overloaded during the acceleration / deceleration of the motor, the motor may cause malfunction such as step-out. As described above, in the verification of the control software, it is necessary to verify whether or not the verification target part of the control target device of the control software may cause an operation failure by the control software. However, Patent Documents 1 and 2 do not disclose performing such verification.

  The present invention provides a verification device and a program for verifying whether there is a possibility that a verification target component of the control target device may malfunction when the control target device is controlled by control software.

  According to an aspect of the present invention, the verification device includes a control unit simulator for executing control software, a device simulator for simulating the operation of the control target device of the control software, and the control unit simulator outputting to the device simulator A first determination unit that determines whether a predetermined control parameter of a verification target component of the control target device satisfies a predetermined condition based on a control signal to be affected, and an operation of the verification target component is influenced by a simulated operation of the device simulator Second predetermined means for determining whether or not a predetermined disturbance that gives the verification target component occurs, and the predetermined disturbance occurs when a predetermined control parameter of the verification target component satisfies a predetermined condition Then, it is provided with the 3rd determination means which determines with the said verification object component having a possibility of a malfunctioning.

  It is possible to verify whether there is a possibility that the verification target part may malfunction.

The schematic block diagram of the verification apparatus by one Embodiment. The hardware block diagram of the verification apparatus by one Embodiment. The figure which shows the example of a signal input / output between the control part simulator and apparatus simulator by one Embodiment. The flowchart of the process in the simulator hub by one Embodiment. The flowchart of the process in the parameter extraction part by one Embodiment. The figure which shows the example disturbance factor information by one Embodiment. The flowchart of the process in the determination part by one Embodiment. The figure which shows the control parameter by one Embodiment. The block diagram of the possibility detection part by one Embodiment. The relationship between the weak state classification classified by the value of the control parameter by one Embodiment and the weak state classification and disturbance type which a judgment part holds is shown. The figure which shows the disturbance classification by one Embodiment.

  Hereinafter, exemplary embodiments of the present invention will be described with reference to the drawings. In the following drawings, components that are not necessary for the description of the embodiments are omitted from the drawings.

<First embodiment>
The verification apparatus according to the present embodiment can be realized by executing a program on a computer system, and the hardware configuration thereof is shown in FIG. The hard disk 202c of the main body 202 in FIG. 2 stores a program for realizing each function of the verification apparatus, various data including information on the control target apparatus, and control software to be verified. The central processing unit 202a loads a program and various data into the main storage unit 202b and executes the program, whereby the computer system 201 operates as a verification device. The display device 203 displays a screen in accordance with an instruction from the main body unit 202. A keyboard 204 is used to input user instructions and character information to the computer system 201. Further, the mouse 205 is for inputting an instruction corresponding to an icon or the like displayed at the position by designating an arbitrary position on the display device 203.

  FIG. 1 is a configuration diagram of a verification apparatus for verifying control software according to the present embodiment. In the following description, it is assumed that the control target device of the control software is an image forming device and the verification target component is a two-phase stepping motor. However, the verification target component may be another type of motor. good. Further, the control target apparatus may be an apparatus other than the image forming apparatus. The verification apparatus according to the present embodiment includes a simulator unit 101 and a possibility detection unit 102. The simulator unit 101 uses a synchronization method in which a predetermined period is one unit time and simulation processing is performed every unit time. In the following description, time or time is used to indicate time or time in this simulation.

  The control unit simulator 301 of the simulator unit 101 simulates the operation of the control unit of the control target device. That is, the control unit simulator 301 executes control software executed by the control unit of the control target device, receives a signal indicating an operation state of the control target device output from a sensor or the like of the control target device, and receives each signal of the control target device. Output control signals to parts. The control unit simulator 301 outputs a control signal to a simulator hub (hereinafter referred to as HUB) 302. Further, when changing the control signal, the control unit simulator 301 notifies the HUB 302 of the time at that time.

  An apparatus simulator 303 simulates the operation of each component of the control target apparatus of the control software, in this example, the image forming apparatus. The device simulator 303 manages a control signal for each component of the control target device and an output signal output by each component. Specifically, the device simulator 303 assigns a component identifier (hereinafter referred to as a component ID) to each component of the control target device, and manages the component ID and the control signal or output signal of the component in association with each other. FIG. 3 shows an example of a control signal for a stepping motor whose component ID is STPM. Signals 1 to 4 in the table of FIG. 3 are connection signal identifiers (hereinafter referred to as signal IDs) of the respective units of the simulator unit 101, and are managed by the HUB 302.

  The device simulator 303 notifies the HUB 302 of the change in the value of the output signal of each component together with the time. In addition, the event determination unit 304 of the apparatus simulator 303 receives, from the disturbance detection unit 107, an event that notifies the disturbance detection unit 107 of the occurrence and termination thereof by event information notification, and the event received by the event information notification as event information 305. keeping. Then, when the event indicated by the event information 305 occurs or ends as a result of the simulated operation of the control target device, the event determination unit 304 notifies the disturbance detection unit 107 of the occurrence or end of the event by a status notification. The event information 305 is identified by an event management number. Specifically, the device simulator 303 analyzes the device state after one unit time from the control signal from the HUB 302 at a certain point in time, the characteristics of each component of the device to be controlled, and the like. The event determination unit 304 determines whether or not the event indicated in the event information 305 has occurred for each operation simulation for one unit time. When the determination result is different from the determination result one unit time ago, the disturbance detection unit 107 is notified of the update of the event state. This event notification includes an event management number, a value indicating the occurrence or end of the event, and its time.

  Further, the apparatus simulator 303 outputs the motor information 306 to the outside before the simulation is started in order to share the information of the motor that is the verification target component of the present embodiment with the HUB 302 and the possibility detection unit 102. The motor information 306 includes a component ID of a motor to be verified and a signal ID of a motor control signal. The HUB 302 and the possibility detection unit 102 read the motor information 306 to acquire information about the verification target motor at the start of the simulation.

  The HUB 302 performs time synchronization processing, signal connection processing, and signal transmission processing of the control unit simulator 301 and the device simulator 303. Further, the HUB 302 performs cooperation processing with the possibility detection unit 102 and notifies the possibility detection unit 102 of a change in the control signal for the motor to be verified.

  The time synchronization between the control unit simulator 301 and the device simulator 303 will be briefly described. First, the HUB 302 instructs the control unit simulator 301 and the device simulator 303 to execute a simulation for a predetermined time (one unit time). Each simulator that receives the instruction executes a simulation process for a predetermined time, and when the simulation process is completed, notifies the HUB 302 of the end of the simulation process.

  The HUB 302 has signal management information 307 for signal connection and signal information transmission processing. The signal management information 307 includes four items: a signal ID, a signal size (information indicating how many bits the signal line is), a signal output source simulator, and a signal input destination simulator. Further, the HUB 302 has a change notification unit 308 in order to notify the vulnerability detection unit 103 of a change in the control signal for the verification target motor. The change notification unit 308 reads the motor information 306 and stores the signal ID of the control signal for each motor component ID. The change notification unit 308 notifies the vulnerability detection unit 103 of a change in the control signal when the control signal of the verification target motor output from the control unit simulator 301 changes. This notification includes the signal ID of the control signal, the signal value, and the time of change.

  FIG. 4 is a flowchart of processing in the HUB 302 for notifying the vulnerability detection unit 103 of a change in the motor control signal. In step S10, the HUB 302 waits until the control signal output from the control unit simulator 301 and the output signal output from the apparatus simulator 303 change. When the signal changes, the HUB 302 transmits the signal change to the control unit simulator 301 or the device simulator 303 in S11. Thereafter, in S12, the HUB 302 determines whether the changed signal is a control signal from the control unit simulator 301 for the motor that is the verification target component. This determination is made based on the motor information 306 read before starting the simulation. If the changed signal is not the control signal for the motor that is the verification target component, the HUB 302 repeats the processing from S10. On the other hand, if the changed signal is a control signal of the motor that is the verification target component, the HUB 302 notifies the weakness detection unit 103 of the change of the motor control signal in S13, and repeats the processing from S10.

  Next, processing performed by the HUB 302 regarding cooperation between the simulator unit 101 and the possibility detection unit 102 at the start of simulation will be described. The HUB 302 outputs a simulation start notice to the possibility detection unit 102 at the start of the simulation. The possibility detection unit 102 notifies the HUB 302 of the completion of preparation after completion of preparation for malfunction detection. The HUB 302 waits until a preparation completion notification is sent from the possibility detection unit 102 and, after receiving the preparation completion notification, instructs each simulator to start simulation.

  Next, the possibility detection unit 102 will be described. The vulnerability detection unit 103 of the possibility detection unit 102 detects whether or not the motor is vulnerable to disturbance (a state in which the motor operation may be defective). Also, the disturbance detection unit 107 detects whether or not a disturbance to the motor has occurred. Furthermore, the determination unit 110 determines whether or not there is a possibility of malfunction from the fragile state and the disturbance state.

  When receiving the simulation start notice from the HUB 302, the possibility detecting unit 102 starts preparation. In preparation, the vulnerability detection unit 103 reads the motor information 306 and stores the signal ID of the motor control signal therein. The signal ID to be stored is the signal ID for the motor that is the verification target. Also, the disturbance detection unit 107 transmits disturbance factor information 108 described later to the apparatus simulator 303 as an event information notification. When the above preparation is completed, the possibility detection unit 102 notifies the HUB 302 of the preparation completion.

  The vulnerability detection unit 103 includes a parameter extraction unit 104 and a vulnerability determination unit 105. The parameter extraction unit 104 focuses on the control elements of the program related to the stepping motor and extracts the control parameters related to the motor vulnerability. The control elements of the program relating to the stepping motor are, for example, the motor speed, the motor current setting value, and the motor excitation pattern. Further, the control parameters related to vulnerability are, for example, a motor speed change rate (motor acceleration), a motor current value, and a motor excitation pattern.

  The parameter extraction unit 104 holds in advance information related to a control parameter to be extracted (hereinafter referred to as extraction parameter information 113) and a motor control signal necessary for extraction of the control parameter. When the control parameter to be extracted is motor acceleration, the motor control signal necessary for the control parameter extraction can be an A-phase excitation signal and a B-phase excitation signal that determine the motor speed. Further, when the control parameter to be extracted is a motor current value, the A-phase current setting and the B-phase current setting can be set.

  FIG. 5 is a flowchart of processing in the parameter extraction unit 104. In S20, the parameter extraction unit 104 stands by until a change in the motor control signal is notified from the HUB 302. Upon receiving the control signal change notification, the parameter extraction unit 104 determines whether the control signal is related to the control parameter to be extracted based on the extracted parameter information 113 in S21. If it is not a control signal related to the control parameter to be extracted, the parameter extraction unit 104 repeats the processing from S20. On the other hand, if it is a control signal related to the control parameter to be extracted, the parameter extraction unit 104 calculates the value of the control parameter from the control signal in S22, and sends an update notification to the vulnerability determination unit 105 in S23. The update notification includes the value of the control parameter and its change time. Thereafter, the parameter extraction unit 104 repeats the processing from S20.

  As a specific example, the process of FIG. 5 will be described by taking as an example a case where the control parameter to be extracted is motor acceleration and the signal is defined as shown in FIG. The control signals related to the motor acceleration are the signals 1 and 2 in FIG. 3, that is, the A phase and B phase excitation signals. When the parameter extraction unit 104 is notified of the change in the motor control signal in S20, the parameter extraction unit 104 determines in S21 whether the control signal is an A-phase excitation signal or a B-phase excitation signal. For example, when the control signal notified of the change in S20 is the signal 4 in FIG. 3, that is, the B-phase current setting, the determination in S21 is “No” and the process returns to S20. On the other hand, when the control signal notified of the change in S20 is, for example, an A-phase excitation signal, the determination in S21 is “Yes”, and the process proceeds to S22. Since the control parameter to be extracted is motor acceleration, the parameter extraction unit 104 calculates the motor acceleration in S22. The parameter extraction unit 104 first obtains the motor speed from the time interval of the excitation signal change, and sets this as the current motor speed. Then, the motor acceleration is obtained from the current motor speed, the previous motor speed, and the time interval.

  In S23, the parameter extraction unit 104 notifies the vulnerability determination unit 105 of the motor acceleration value, the change time, and the motor component ID. Note that the parameter extraction unit 104 can perform filtering on variations in software control when extracting control parameters. For example, if the absolute value of the motor acceleration may vary by 0.005 or less for control, the motor acceleration value can be treated as 0 if the absolute value of the motor acceleration is 0.005 or less.

  The vulnerability determination unit 105 (first determination unit) includes determination criterion information 106 for determining whether the motor is vulnerable to disturbance based on the control parameter value notified from the parameter extraction unit 104. ing. The vulnerability determination unit 105 uses the update notification from the parameter extraction unit 104 as a trigger to start determination of the vulnerable state, and notifies the determination unit 110 of the determination result (whether or not a vulnerable state has occurred).

  For example, if the criterion is that a fragile state occurs during acceleration / deceleration of the motor, the criterion information 106 indicates a criterion that a fragile state occurs when the motor acceleration is not zero. In addition, for example, a determination criterion that the absolute value of acceleration or deceleration is greater than or less than a predetermined value may be used. The vulnerability determination unit 105 determines whether or not it is in a fragile state, and notifies the determination unit 110 of a vulnerability when it is different from the previous determination result. The vulnerability notification includes information indicating the occurrence or end of the vulnerability state and information indicating the time. The time is time information included in the update notification from the parameter extraction unit 104.

  Next, the disturbance detection unit 107 will be described. The disturbance detection unit 107 includes disturbance factor information 108 and a disturbance determination unit 109. The disturbance factor information 108 is information indicating factors that affect the operation of the motor that is the verification target component in the operation of the control target device. FIG. 6 shows an example of the disturbance factor information 108. The disturbance factor information 108 is notified as event information to the device simulator 303 and managed as event information 305 in the device simulator 303. Therefore, the state notification performed by the apparatus simulator 303 to the disturbance detection unit 107 is a notification indicating that the state indicated by the disturbance factor information 108 has occurred or ended.

  When the disturbance determination unit 109 (second determination unit) receives a state notification indicating occurrence from the apparatus simulator 303, the disturbance determination unit 109 determines that a disturbance has occurred, and when receiving a state notification indicating completion, determines that the disturbance has ended, The determination unit 110 is notified of the end. This disturbance notification includes information indicating the occurrence or end of the disturbance and the time of occurrence or end of the disturbance.

  The determination unit 110 (third determination unit) determines that there is a possibility of a malfunction of the motor when detecting the overlap between the fragile state notified by the vulnerability detection unit 103 and the occurrence of the disturbance notified by the disturbance detection unit 107. .

  FIG. 7 is a flowchart of the determination process in the determination unit 110. The determination unit 110 waits until a weak state occurs in S30. When a fragile state occurs, the determination unit 110 determines whether or not a disturbance has occurred in S31. If the disturbance has occurred, the determination unit 110 determines that there is a possibility of a malfunction and notifies a warning in S33. Here, the notification of the warning is performed by an arbitrary output to the user, such as a screen display for the user using the verification device. If no disturbance has occurred in S31, the determination unit 110 determines that there is no possibility of malfunction, and determines in S32 whether the fragile state continues. If the weak state continues in S32, the determination unit 110 repeats the process from S31, and if the weak state does not continue, the determination unit 110 repeats the process from S30. In addition, since the occurrence time is included in the vulnerability notification and the disturbance notification, the determination unit 110 can include the time at which a malfunction may occur in the warning notification in S33. It is also possible to display a timing chart regarding the occurrence and termination of the vulnerability notification and disturbance notification.

  In the above description, the case where the control parameter to be extracted is the motor acceleration is taken as an example. However, when the control parameter to be extracted is the motor current value, the motor current value is obtained in S22 of FIG. Specifically, the motor current is set by two signals of 1-bit signal A and signal B, and the relationship between the values of the two signals and the output current is shown in FIG. When the parameter extraction unit 104 is notified of a change in the value of the signal A or the signal B from the HUB 302, the parameter extraction unit 104 performs an update notification including the current value obtained from the values of the signal A and the signal B to the vulnerability determination unit 105. For example, if the motor current value is 66% or less, the vulnerability determination unit 105 can determine that the state is a weak state.

  If the control parameter to be extracted is an excitation pattern, the parameter extraction unit 104 extracts an excitation pattern (2-phase excitation, 1-2 phase excitation, etc.) in S22 of FIG. The vulnerability determination unit 105 is notified. The vulnerability determination unit 105 determines whether the motor is in a fragile state from the notified excitation pattern according to the determination criterion information 106. In this case, the determination criterion information 106 indicates that, for example, it is determined that the state is weak when it is not two-phase excitation.

  The above embodiment has been described by taking a two-phase stepping motor as an example, but the present invention can be applied by associating the state of the control signal with the fragile state even with other types of motors. For example, when the motor is a DC motor, it can be assumed that the motor is in a fragile state until the motor reaches a steady rotational speed from a stopped state. Furthermore, since the verification target motor can be distinguished by the component ID, one or more motors to be verified at the same time may be included. Furthermore, the verification target component can be any component that can determine the possibility of malfunction due to the relationship between the state and the disturbance.

  As described above, every time there is a change in the value of the control signal from the control unit simulator 301, it is determined whether or not it is in a fragile state based on a predetermined control parameter. Furthermore, it is determined from the simulated operation of the apparatus simulator 303 whether or not a predetermined disturbance has occurred. If a predetermined disturbance occurs in the fragile state, it is determined that there is a possibility of a malfunction. With this configuration, it is possible to detect whether or not there is a possibility of malfunction of the motor by the control software. Therefore, the problem of motor control can be notified to the user at the time of program operation verification, and verification efficiency can be improved.

<Second embodiment>
In the first embodiment, when a disturbance occurs in the fragile state, it is determined that there is a possibility of malfunction. However, the degree of possibility of causing a motor step-out or the like may vary depending on the type of disturbance. For example, when the motor is in a weak state of acceleration / deceleration, there is little possibility of motor step-out even if a disturbance occurs when the paper enters a predetermined position on the conveyance path, but the roller driven by the motor This is a case where there is a possibility of motor step-out when a disturbance occurs in contact with the paper. Also, depending on the type of fragile state, the possibility of malfunction is different even with the same disturbance. For example, the weak state that the motor is accelerating / decelerating can be further classified into two state types, that is, within the rated range and out of the rated range, but the possibility of motor step-out for the same disturbance differs depending on this state type. In this embodiment, the presence / absence of a malfunction is detected by a combination of the disturbance type and the state type of the weak state. Hereinafter, the present embodiment will be described focusing on differences from the first embodiment.

  FIG. 9 is a configuration diagram of the possibility detecting unit 102 in the present embodiment. The difference from the possibility detection unit 102 of the first embodiment is that the vulnerability detection unit 103 is provided with a type determination unit 114, the disturbance detection unit 107 is provided with a disturbance type notification unit 116, and the determination unit 110 performs malfunction condition information 111. Is to hold.

  The type determination information 115 is obtained by classifying the fragile states according to the value of the control parameter, and an example thereof is shown in FIG. FIG. 10A shows a case where the control parameter is a motor current value, which is classified into three state types A, B, and C according to the motor current value. The type determination unit 114 in FIG. 9 determines the type of the fragile state from the control parameter value included in the update notification from the parameter extraction unit 104 and the type determination information 115. The type determination unit 114 notifies the determination unit 110 of the determined state type. This state type notification includes information indicating the state type and the time when the state type has changed.

  The disturbance type notification unit 116 notifies the determination unit 110 of the type of disturbance that has occurred or ended when a disturbance occurs or ends. For example, the disturbance type can be specified using an event management number included in the event notification. The disturbance type notification includes information indicating the disturbance type and its change time.

  In the present embodiment, the determination unit 110 determines the possibility of malfunction for each disturbance type. For this reason, the determination unit 110 holds malfunction condition information 111 whose example is shown in FIG. The determination unit 110 recognizes the presence / absence of the vulnerable state and its type based on the vulnerability notification and the vulnerability type notification from the vulnerability detection unit 103. Further, the disturbance and the type of the disturbance are recognized by the disturbance notification and the disturbance type notification. When a disturbance occurs in the fragile state, the determination unit 110 further determines the possibility of the operation failure using the operation failure condition information 111 based on the state type of the fragile state and the type of the disturbance. For example, it is assumed that the malfunction condition information 111 is as shown in FIG. 10B, and a fragile state of state type B has occurred. In this state, when the disturbance of the type indicated by the number 1 occurs, the type B is not described in the state type corresponding to the disturbance type of the number 1 in FIG. It is determined that there is no possibility of failure. On the other hand, when a disturbance of the type indicated by number 2 occurs, type B is described in the state type corresponding to the disturbance type of number 2 in FIG. It is determined that there is a possibility.

  For example, depending on the state type, it may be determined that there is a possibility of malfunction regardless of the presence or absence of disturbance. For example, if the motor acceleration is an abnormal acceleration that is not rated, the state type of the weak state is defined as “Z”, and the determination unit 110 generates a disturbance when the state type is “Z”. It can also be determined that there is a possibility of malfunction regardless of the presence or absence.

  As described above, by determining the possibility of operation failure according to the state type and disturbance type of the fragile state, the determination accuracy can be improved, and the efficiency of operation verification of the control software is improved.

<Third embodiment>
During the acceleration / deceleration of the motor, a load torque (hereinafter referred to as self-load) due to the motor's own inertia moment (hereinafter referred to as self-inertia) is generated in the motor. Therefore, in the embodiment described above, the occurrence of disturbance during motor acceleration / deceleration is used as a criterion for determining the possibility of malfunction such as motor step-out. However, in order to further improve the determination accuracy, it is possible to consider the relationship between the direction of self-load and disturbance and the rotation direction of the motor. Therefore, in the present embodiment, the motor self-load and the direction of disturbance with respect to the motor are taken into consideration in the determination of the possibility of motor step-out.

  The configuration of the possibility detection unit 102 of the present embodiment is the same as that of the first embodiment. In the present embodiment, the parameter extraction unit 104 obtains the acceleration of the motor, and the vulnerability determination unit 105 determines the direction of self-load by determining whether the acceleration is positive or negative, that is, whether the vehicle is accelerating or decelerating. Specifically, when accelerating, the self-load direction is opposite to the motor rotation direction. This is because during the acceleration of the motor, the force that continues to rotate at a constant speed acts in the direction opposite to the rotation direction of the motor with respect to the rotational force of the motor that increases the rotation speed. On the other hand, if the motor is decelerating, the direction of self-load is the same as the rotation direction of the motor. This is because during motor deceleration, a force that continues to rotate at a constant speed acts in the same direction as the motor rotation direction with respect to the rotation force of the motor that attempts to decrease the rotation speed. The vulnerability determination unit 105 performs vulnerability notification including the direction of self-load.

  In the present embodiment, the disturbance detection unit 107 has disturbance factor information 108 whose example is shown in FIG. In the disturbance direction of FIG. 11, -1 indicates that the rotation direction of the motor and the disturbance direction are opposite directions, and 1 indicates that they are the same direction. In the present embodiment, the disturbance determination unit 109 includes information indicating the disturbance direction in the disturbance notification. Further, the determination unit 110 determines that there is a possibility of malfunction if the self-load direction notified by the vulnerability notification and the disturbance direction notified by the disturbance notification are the same.

  As described above, the presence / absence of the possibility of motor operation failure is determined in consideration of the self-load generated by the rotational motion of the motor itself and the direction of disturbance given to the motor by the control target device. This reduces the possibility of erroneous detection of a state where there is no possibility of motor malfunction, that is, a state where the control software is not defective, and properly detects the possibility of motor malfunction during control software verification. Can do.

[Other Embodiments]
The present invention can also be realized by executing the following processing. That is, software (program) that realizes the functions of the above-described embodiments is supplied to a system or apparatus via a network or various storage media, and a computer (or CPU, MPU, etc.) of the system or apparatus reads the program. To be executed.

Claims (9)

A control unit simulator for executing control software;
A device simulator for simulating the operation of the control target device of the control software;
First determination means for determining whether a predetermined control parameter of a verification target part of the control target device satisfies a predetermined condition based on a control signal output from the control unit simulator to the device simulator;
Second determination means for determining whether a predetermined disturbance affecting the operation of the verification target part is generated in the verification target part from a simulated operation of the apparatus simulator;
Third determination means for determining that the verification target part may have a malfunction if the predetermined disturbance occurs when a predetermined control parameter of the verification target part satisfies a predetermined condition;
The verification apparatus characterized by comprising.   The third determination unit includes a state type that classifies the state of the verification target part based on a value of a predetermined control parameter of the verification target part, and a disturbance type that is a type of disturbance that affects the operation of the verification target part. The state type notified from the first determination unit, the disturbance type notified from the second determination unit, and the possibility that the verification target component is malfunctioning based on the held relationship. The verification apparatus according to claim 1, wherein it is determined whether there is any.   The verification apparatus according to claim 1, wherein the verification target component is a motor.   The verification apparatus according to claim 3, wherein the predetermined control parameter of the verification target component includes at least one of a motor acceleration, a motor current value, and a motor excitation pattern.   The verification apparatus according to claim 3, wherein the predetermined control parameter of the verification target component is a direction of a torque generated in the motor during acceleration / deceleration of the motor. The predetermined disturbance determined by the second determination means is a direction of a force applied to the motor from the outside,
6. The method according to claim 5, wherein the third determination unit determines that there is a possibility of malfunction of the motor if the direction of the torque generated in the motor and the direction of the force applied to the motor are the same. The verification device described.   The verification apparatus according to claim 1, wherein the third determination unit notifies a user of the verification apparatus that there is a possibility of malfunction in the verification target part.   The verification apparatus according to claim 1, wherein the control target apparatus is an image forming apparatus.   A program that causes a computer to function as the verification apparatus according to claim 1.

Images