JP2016018291A - Control device and control method therefor - Google Patents

Abstract

PROBLEM TO BE SOLVED: To solve the problem that in a control device for executing the same processing by a plurality of processors, and for detecting malfunction by collating results, and for stopping the output of data to the outside, a deviation is generated in time when processing necessary for the output of data to the outside or the stop of the output of data or the input of data from the outside is performed between the plurality of processors due to task switching, and input/output processing is not performed as expected.SOLUTION: A plurality of processors are configured to perform processing for inhibiting task switching before performing processing necessary for the output of data to the outside or the stopping the output of data, or the input of data from the outside.SELECTED DRAWING: Figure 2

Description

  The present invention relates to a control device and a control method thereof.

  In a control device that requires high safety, a fail-safe mechanism is used. For example, there is a technique in which processing devices are duplicated, the processing results of the respective devices are collated and compared, and output to the outside only when the processing results match. In this case, if one of the devices fails, no erroneous output is made to the outside, so safety is ensured.

  As background art of this technical field, there is JP-A-2003-177801 (Patent Document 1). This publication “Self-diagnosis and mutual diagnosis of calculation result signals taken from other control calculation units and self-calculation result signals, and normal / abnormal self-diagnosis results and normal / abnormal mutual diagnosis. Diagnostic means for sending the result to an external determination circuit, and the PI / O unit includes first and second switching circuits in series for each path connecting the controlled object and each control calculation unit, The first open / close path is controlled so that the output means of the corresponding control calculation unit is closed by a control signal to be an actual control system and is opened in the standby system, and the external determination circuit is connected to each control calculation unit. Each determination unit includes a self-diagnosis result from a corresponding control calculation unit, a self-diagnosis result from a non-corresponding control calculation unit, and a mutual diagnosis result, and a self-diagnosis result of the corresponding control calculation unit. Is abnormal or is not supported When all of the self-diagnosis results are normal and all of the mutual diagnosis results to the corresponding control calculation unit in the non-corresponding control calculation unit are abnormal, the second switching path of the corresponding PI / O unit is until then. It is assumed that a control signal for switching from closing to opening is generated. "

JP 2003-177801 A

  In Patent Document 1, a plurality of control arithmetic units execute the same processing, and the result is collated (mutual diagnosis) to detect a malfunction and stop the output of data to the outside. A multiplexing device is described that prevents the output of erroneous data due to a failure of the system.

  However, in the multiplexing device disclosed in Patent Document 1, when multitask processing is performed in which a plurality of tasks are processed in a time-sharing manner, data output to the outside between the plurality of processing devices or output stop or external There is a possibility that the processing time required for data input from the computer is shifted in time and erroneous processing is performed.

  In order to solve the above problems, for example, the configuration described in the claims is adopted.

  The present application includes a plurality of means for solving the above-described problems. To give an example, the first processing apparatus and the second processing apparatus that perform multitasking, the processing result of the first processing apparatus, and In the dual control device that checks the processing result of the second processing device and outputs the processing result if they match, and stops outputting the processing result if they do not match, the first processing device and the second processing device Each of the two processing devices prohibits task switching in a time zone before and after performing a predetermined process.

  According to the present invention, it is possible to suppress the occurrence of a time lag in the output of data to the outside, the stop of the output, or the input processing of data from the outside due to task switching, and improve the reliability. A control device can be provided.

  Problems, configurations, and effects other than those described above will be clarified by the following description of embodiments.

It is a 1st example of a block diagram of a control system to which the present invention is applied. It is a 1st Example of the processing flow when one task is performed with the processing apparatuses 101 and 102 of the control system of FIG. When the processing flow of FIG. 2 is adopted, it is an example of an execution order of processing when another task is activated while one task is being executed. It is a 2nd Example of the processing flow at the time of performing one task with the processing apparatuses 101 and 102 of the control system of FIG. It is a 3rd Example of the processing flow when one task is performed with the processing apparatuses 101 and 102 of the control system of FIG. FIG. 9 is a fourth embodiment of a processing flow when one task is executed by the processing apparatuses 101 and 102 of the control system of FIG. 1. FIG. 5 is an example of an execution order of processing in a case where the output number comparison does not match and becomes an infinite loop when the processing flow of FIG. 4 is adopted. FIG. 9 is a fifth embodiment of a processing flow when one task is executed by the processing devices 101 and 102 of the control system of FIG. 1. It is a figure which shows that the case where it becomes an infinite loop of FIG. 7 can be prevented when the process flow of FIG. 8 is employ | adopted. It is a 6th example of a block diagram of a control system to which the present invention is applied. 11 is an example of a processing flow when one task is executed by the processing apparatuses 1001 and 1002 of the control system of FIG. It is a 7th Example of a block diagram of the control system to which this invention is applied. 13 is an example of a processing flow when one task is executed by the processing devices 1201 and 1202 of the control system in FIG. 12.

    First, the case of a conventional multiprocessor that performs multitasking will be described using a specific example.

  Consider a case where two tasks, task 1 and task 2, are executed in each of a plurality of control arithmetic units A, B, and C. Task 2 has a higher priority than task 1, and if the condition for starting task 2 is satisfied during execution of task 1, task 1 processing is interrupted and task 2 processing is started. As a condition for starting task 2, it is conceivable that it is started at a constant cycle by a timer, or by an interrupt from the PI / O unit.

  Since there is a difference in operation timing between each of the plurality of control arithmetic units A, B, and C, the control arithmetic unit A ends the mutual diagnosis of task 1, outputs the mutual diagnosis result, and outputs the data to the PI / O unit. While the task 2 is activated after the output, the control arithmetic units B and C may start the task 2 after the mutual diagnosis is completed and before the output of the mutual diagnosis result. In this case, even if the control arithmetic units B and C detect an abnormality in the control arithmetic unit A by mutual diagnosis, the mutual diagnosis result is not output, so the contact of the interface to the PI / O unit remains closed. Thus, there is a possibility that abnormal data from the control arithmetic unit A is output to the PI / O unit.

  In addition, there is a problem regarding the input timing of data used for control calculation. Since there is a difference in operation timing among the plurality of control calculation units, task 2 is started after input in the control calculation unit A, whereas in the control calculation units B and C, the task is input before input. 2 may be activated. In this case, input is performed after the task 2 ends and returns to the task 1 in the control calculation units B and C. However, since there is a large difference in input time from the control calculation unit A, there is a large difference in the input value. May occur, and the control calculation unit A may be erroneously determined to be abnormal.

  As described above, when performing multi-system processing that performs multi-task processing, processing tasks may be different in each system due to task interruption. Therefore, the present application is based on the technical idea of aligning the processing tasks and processing operations of the entire system by temporarily prohibiting task switching before and after the processing operations to be executed with the processing tasks aligned. It is. Further, when task switching is prohibited and the processing task data is different from the other system, it is further important that the processing task with the other system is aligned by permitting task switching of the own system.

  Hereinafter, examples will be described with reference to the drawings.

  FIG. 1 is a first embodiment of a configuration diagram of a control system to which the present invention is applied.

  The control system of the present embodiment includes a first processing device 101, a second processing device 102, an output stop switch 131, a switch control circuit 134, a control terminal 132, and a device 133.

  The first processing device 101 includes a CPU 111, a RAM 112, a ROM 113, a transmission circuit 114, a reception circuit 115, and an interface circuit 116.

  The second processing device 102 includes a CPU 121, a RAM 122, a ROM 123, a receiving circuit 125, and an interface circuit 126. The CPU 111 and the CPU 121 have a function of performing multitask processing for processing a plurality of tasks in a time division manner.

  The receiving circuit 115 receives data from the control terminal 132 via the transmission path 145 and writes the data to the RAM 112 via the bus 117.

  The CPU 111 executes the following processing according to the program stored in the ROM 113. First, the CPU 111 reads the data written by the receiving circuit 115 to the RAM 112 via the bus 117, performs a predetermined control process, and then writes the processing result to the RAM 112 via the bus 117.

  The CPU 111 also reads out the processing result of the CPU 121 stored in the RAM 122 via the bus 117, the interface circuit 116, the transmission path 149, the interface circuit 126, and the bus 127, and collates it with its own processing result. Note that the processing result to be collated includes information indicating which task the processing result is, and information for identifying them when collating a plurality of times in one task. These pieces of information are equivalent to data identification numbers to be described later, but the information representation method may be the same as the data identification numbers, or may be different as long as they can be identified. Since it is only necessary to know which task the processing result belongs to, an identification number corresponding to the task itself may be included, and when the CPU 111 or 121 processes the task, the task corresponding to the output result can be identified. An identification number may be added or output separately.

  When the collation is completed, the CPU 111 writes the collation result in the switch control circuit 134 via the interface circuit 116 and the transmission path 147. If the collation result indicates a match, the CPU 111 generates transmission data according to a predetermined format from the processing result written in the RAM 112 and writes it in the RAM 112. On the other hand, if the collation result indicates a mismatch, the CPU 111 stops the process.

  The CPU 111 also writes the task identification number and data identification number in the RAM 112 in accordance with the processing flow described below. The CPU 111 also reads out task identification numbers and data identification numbers stored in the RAM 122 via the bus 117, the interface circuit 116, the transmission path 149, the interface circuit 126, and the bus 127 according to a processing flow described later.

  In this embodiment, the processing result is collated by software executed by the CPU 111, but a method of collating by hardware is also conceivable. As a result, the processing speed can be improved.

  In this embodiment, the processing result of the CPU 121 stored in the RAM 122 is read by software executed by the CPU 111, but the processing result stored in the RAM 122 is transferred to the RAM 112 by hardware, and the CPU 111 transfers the processing result of the CPU 121 transferred to the RAM 112. A method of reading the processing result is also conceivable. As a result, the processing speed can be improved.

  When the interface circuit 116 receives a request from the CPU 111 via the bus 117, the processing result, task identification number, or data identification number stored in the RAM 122 is transmitted via the transmission path 149, the interface circuit 126, and the bus 127. Read and output to CPU 111. When the interface circuit 116 receives a request from the CPU 111, the interface circuit 116 writes the collation result into the switch control circuit 134 via the transmission path 147. Further, when the interface circuit 116 receives a request from the interface circuit 126 via the transmission line 149, the processing result, task identification number, or data identification number stored in the RAM 112 is read and output to the interface circuit 126.

  When the transmission circuit 114 receives a transmission request from the CPU 111 via the bus 117, the transmission data read by the CPU 111 in the RAM 112 is read via the bus 117 and transmitted to the output stop switch 131 via the transmission path 141.

  The operations of the reception circuit 125 and the interface circuit 126 are the same as the operations of the reception circuit 115 and the interface circuit 116, respectively.

  Although the operation of the CPU 121 is almost the same as the operation of the CPU 111, the generated transmission data is not used, so that the generation of the transmission data can be omitted.

  The switch control circuit 134 sends a control signal for the transmission stop switch 131 to the signal line 144 based on the collation result received from the interface circuit 116 via the transmission path 147 and the collation result received from the interface circuit 126 via the transmission path 148. Output to.

  The transmission stop switch 131 is controlled to be ON when both of the collation results received from the interface circuit 116 and the interface circuit 126 are coincident, and is controlled to be OFF when either or both are inconsistent. .

  The transmission stop switch 131 controls ON / OFF of the switch according to the control signal received from the signal line 144. When the switch is ON, the transmission data received from the transmission path 141 is output to the transmission path 142 as it is. When the switch is OFF, nothing is output to the transmission line 142, and the transmission line 142 is in an idle state.

  The control terminal 132 performs a predetermined process on the data received from the transmission path 142, generates a control signal for the device 133, and outputs the control signal to the signal line 143. The control terminal 132 also determines that an abnormality has occurred in the processing device 101 or the processing device 102 when data is not output to the predetermined time transmission path 142, and performs control for safely stopping the device 133. The signal is output to the signal line 143. The control terminal 132 also captures a signal indicating the state of the device 133 via the signal line 146, performs a predetermined process, and transmits the signal to the transmission line 145.

  Although this embodiment has only one control terminal, it is also possible to have a plurality of control terminals. In that case, a relay circuit may be provided in the transmission paths 142 and 145 as necessary. Similarly, in the present invention, a description is given using a dual system control device, but the present invention can also be applied to a system using a plurality of triple control devices.

  FIG. 2 is a first example of a processing flow when one task is executed by the processing devices 101 and 102 of the control system of FIG. Hereinafter, the operation of the processing apparatus 101 will be described.

  In step 201, the CPU 111 reads the data written in the RAM 112 by the receiving circuit 115 via the bus 117.

  In step 202, the CPU 111 performs a predetermined control process and writes the processing result to the RAM 112 via the bus 117.

In step 203, the CPU 111 reads out the processing result of the CPU 121 stored in the RAM 122 via the bus 117, the interface circuit 116, the transmission path 149, the interface circuit 126, and the bus 127. Confirm. If the CPU 121 has completed the process of step 202, the RAM
The processing result of the CPU 121 read from 122 is collated with its own processing result. CPU12
If 1 has not finished the process of step 202, the process result of the CPU 121 stored in the RAM 122 is repeatedly read until the process is finished.

  In step 204, the CPU 111 performs processing for prohibiting task switching. Since task switching usually occurs due to an interrupt from a timer incorporated in the CPU 111, the receiving circuit 115, or the like, task switching can be prohibited by setting the CPU 111 to an interrupt disabled state. When task switching is prohibited, the CPU continues processing the task that started processing while the task switching is prohibited. As another method, the RAM 112 is provided with an area for storing information indicating whether task switching is permitted or prohibited, and software or hardware that controls task switching refers to the information to suppress task switching as necessary. A way to do this is also conceivable.

  In step 205, the CPU 111 writes the identification number of the data to be output to the RAM 112 via the bus 117. As a method for assigning data identification numbers, it is necessary to identify at least which task is currently being executed. In addition, it is necessary to be able to represent a state in which no data identification number is written. Although an example in which output is performed only once in one task is shown here, output may be performed multiple times in one task. However, in order for the collation process between the processing apparatus 101 and the processing apparatus 102 to be performed correctly, the execution order of the multiple outputs needs to be the same in the processing apparatus 101 and the processing apparatus 102. In that case, the same or different data identification numbers may be used for a plurality of outputs. This is because if the output is the same task, the collation process confirms that the data is the same, and therefore there is no need to distinguish between the data identification numbers.

  In step 206, the CPU 111 reads out the data identification number of the processing device 102 stored in the RAM 122 via the bus 117, interface circuit 116, transmission path 149, interface circuit 126, and bus 127.

  In step 207, the CPU 111 compares the data identification number of its own device with the data identification number of the processing device 102. If they match, the process proceeds to step 208, and if they do not match, the process proceeds to step 212.

  In step 208, the CPU 111 writes the verification result into the switch control circuit 134 via the interface circuit 116 and the transmission path 147. If the collation result indicates a match, the process proceeds to step 209. If the collation result indicates a mismatch, the process is stopped.

  In step 209, transmission data according to a predetermined format is generated from the processing result written by the CPU 111 in the RAM 112 and written in the RAM 112. Thereafter, the CPU 111 outputs a transmission request to the transmission circuit 114 via the bus 117. Upon receiving the transmission request, the transmission circuit 114 reads the transmission data written in the RAM 112 by the CPU 111 and transmits the transmission data to the output stop switch 131 via the transmission path 141.

  In step 210, the CPU 111 deletes the identification number of the data written in the RAM 112. The data identification number is erased by writing a value indicating that the data identification number is not written.

  In step 211, processing for permitting task switching is performed. If the CPU 111 is set in the interrupt disabled state in step 204, the interrupt is enabled. If information prohibiting task switching is written in the RAM 112 in step 204, the information is rewritten to a value permitting task switching. When step 211 ends, the process for one time of this task ends.

  The processing content of step 212 is the same as the processing content of step 210.

  The processing content of step 213 is the same as the processing content of step 211. When step 213 is completed, the routine proceeds to step 204.

  The operation of the processing apparatus 102 is the same. However, since the processing device 102 has no transmission circuit, a transmission request from the CPU 121 is not output. Further, since the transmission data generated by the CPU 121 is not used, it is not necessary to generate transmission data.

  FIG. 3 shows an example of processing execution order when another task is activated during execution of one task when the processing flow of FIG. 2 is adopted. In this example, the priority of the task 2 is higher than that of the task 1, and the task 1 is switched to the task 2 while the task 1 is being executed. The processing device 102 starts task 2 earlier.

  At time a, the processing apparatus 101 compares the output data identification numbers. However, the data identification numbers of the processing apparatuses 102 are not stored, and therefore there is a mismatch. Thereafter, when task switching is permitted, the processing device 101 is switched to task 2 and can execute the same task as the processing device 102.

  At time c, the processing devices 101 and 102 compare the output data identification numbers, and since both are executing task 2, the data identification numbers match, and the processing after the verification result writing can proceed.

  At time d, the processing devices 101 and 102 compare the output data identification numbers. Since both are executing task 1, the data identification numbers match, and the processing after the verification result writing can proceed.

  As shown in FIG. 3, even if the timing of task switching is different between the processing device 101 and the processing device 102, the processing after the verification result writing can be performed at the processing device 101 and the processing device 102 at substantially the same time. .

  FIG. 4 is a diagram showing a second embodiment of a processing flow when one task is executed by the processing devices 101 and 102 of the control system of FIG. The process of the step of the same code | symbol as FIG. 2 is the same as that of FIG.

  In the processing flow of FIG. 2, the verification result is not erased after the verification result is written in the switch control circuit 134 in step 208. However, in the processing flow of FIG. A process for deleting the verification result 414 is added. In step 414, the CPU 111 writes a value for erasing the verification result into the switch control circuit 134 via the interface circuit 116 and the transmission path 147. The value for deleting the collation result is a value for turning off the output stop switch 131, and may be the same as the value indicating the mismatch or may be another value.

  While the control device 101 and the control device 102 are operating normally, the output stop switch 131 remains ON. In this embodiment, the control device 101 becomes abnormal in this state, and erroneous data is transferred to the transmission line 141. Even if there is a malfunction that is output to the control terminal 131, erroneous data can be blocked by the control terminal 131, and the safety is further improved.

  FIG. 5 is a third embodiment of a processing flow when one task is executed by the processing devices 101 and 102 of the control system of FIG. The process of the step of the same code | symbol as FIG. 2, FIG. 4 is the same as that of FIG. 2, FIG.

  In the processing flow of FIG. 4, output is performed at approximately the same time by the processing devices 101 and 102, but input is not necessarily performed at the same time. FIG. 5 is different from FIG. 4 in that processing for prohibiting task switching is performed before input in step 201.

  Steps 515, 516, 517, 518, 519, 520, and 521 are the same as steps 204, 205, 206, 207, 212, 213, and 210 in FIG. However, the input data identification number is used instead of the output data identification number. The method for determining the input data identification number is the same as the method for determining the output data identification number in FIG. According to this flow, it is possible to guarantee that the input is performed at almost the same time in the processing apparatuses 101 and 102.

  FIG. 6 is a diagram showing a fourth embodiment of a processing flow when one task is executed by the processing devices 101 and 102 of the control system of FIG. The process of the step of the same code | symbol as FIG.2, FIG.4, FIG.5 is the same as that of FIG.2, FIG.4, FIG.5.

  FIG. 6 differs from FIG. 5 in that task switching is once permitted after input. Thereby, in the process flow of FIG. 5, it becomes possible to execute a task with a higher priority earlier in the period from step 515 to step 211.

  Steps 622 and 623 are the same as steps 521 and 211 in FIG. 5, except that they are performed immediately after the input processing in step 201. By permitting task switching in step 623, if a task with a higher priority is requested during the period from step 515 to step 623, a task with higher priority after execution of step 623 can be executed. In addition, it is possible to minimize the delay of the activation time of tasks with high priority.

  In the processing flow of FIG. 6, the identification number of the input data and the identification number of the output data are used, but it is preferable that both can be distinguished. For this purpose, different values may be assigned for input and output, or the storage locations of the RAMs 112 and 122 may be different locations.

  FIG. 8 is a fifth embodiment of a processing flow when one task is executed by the processing devices 101 and 102 of the control system of FIG. The process of the step of the same code | symbol as FIG. 2, FIG. 4 is the same as that of FIG. 2, FIG.

  First, FIG. 7 is used to show an example of the execution order of processes in the case where the output number comparison does not match and an infinite loop occurs when the processing flow of FIG. 4 is adopted.

  This case is a case where the end timing of the collation processing of the processing apparatus 102 is delayed from the processing apparatus 101. At times a, c, and e, the processing device 101 compares the output data identification numbers. However, since the state where the identification number of the processing device 102 is deleted is read and compared, there is a mismatch. At the times b, d, and f, the processing device 102 compares the output data identification numbers. However, since the state where the identification number of the processing device 101 is deleted is read and compared, there is a mismatch. Thereafter, the same processing is continued, resulting in an infinite loop.

FIG. 8 shows a processing flow for preventing the infinite loop of FIG.
In step 825, the CPU 111 writes the task identification number in a predetermined location in the RAM 112. At that time, if there is another task suspended to execute this task, the task identification number of the suspended task will be lost, so it is necessary to save the task identification number of the suspended task. is there.

  Step 824 is processing for storing the task identification number of the interrupted task. The CPU 111 reads the task identification number written in the RAM 112 and copies it to the save area of the RAM 112.

  Step 828 is processing for restoring the task identification number of the interrupted task saved in step 824. In step 824, the CPU 111 reads the task identification number copied to the save area of the RAM 112 and writes it in a predetermined location in the RAM 112.

  In step 826, the CPU 111 reads out the task identification number and data identification number of the processing device 102 stored in the RAM 122 via the bus 117, interface circuit 116, transmission path 149, interface circuit 126, and bus 127. In order to shorten the processing time, it is preferable that both the task identification number and the data identification number can be read by one reading, for example, the task identification number and the data identification number are stored in the upper bit and the lower bit of a data word that can be read at a time. If the task identification number and the data identification number cannot be read out once, only the data identification number is read out at step 826, and the task identification number is read out at step 827.

  In step 827, the CPU 111 compares the task identification number of its own device with the task identification number of the processing device 102. If they match or the priority of the task of the own device is high, the process proceeds to step 826, and if the priority of the task of the own device is low, the process proceeds to step 212.

  FIG. 9 is a diagram showing that the case of the infinite loop of FIG. 7 can be prevented when the processing flow of FIG. 8 is adopted.

  At time a, the processing device 101 compares the data identification numbers and does not match, but at time b, the task identification numbers are compared and matched, so the processing device 101 does not delete the data identification numbers. For this reason, when the data identification number is written in the processing device 102, the comparison of the data identification numbers is coincident (time c, d), and the process of writing the collation result can proceed.

  In FIG. 8, a change was made to prevent an infinite loop based on FIG. 4, but a processing flow for preventing an infinite loop can be constructed based on FIGS. 2, 5, and 6 as well. Is possible.

  FIG. 10 is a sixth embodiment of a configuration diagram of a control system to which the present invention is applied. Components having the same reference numerals as those in FIG. 1 are the same as those in FIG.

  The present embodiment is characterized in that the switch control circuit 134 of FIG. 1 is deleted and the output stop switch 131 is controlled by the signal line 1044 from the interface circuit 1026.

  The interface circuit 1016 is the same as the interface circuit 116 in FIG. 1 except that the transmission line 147 connected to the switch control circuit 134 in FIG. 1 is deleted.

  The interface circuit 1026 is the same as the interface circuit 126 in FIG. 1 except that the transmission line 148 connected to the switch control circuit 134 in FIG. 1 is changed to a signal line 1044 connected to the output stop switch 131. . When the interface circuit 1026 receives an output stop switch control request from the CPU 124 via the bus 127, the interface circuit 1026 outputs a value instructed by the request to the signal line 1044.

  FIG. 11 is an example of a processing flow when one task is executed by the processing devices 1001 and 1002 of the control system of FIG. The process of the step of the same code | symbol as FIG. 2 is the same as that of FIG.

  This processing flow is obtained by replacing steps 208 and 414 in FIG. 4 with steps 1129 and 1130.

  Step 1129 is processing performed only by the processing device 1002. The CPU 124 outputs an output stop switch control request to the interface circuit 1026 via the bus 127, and outputs a value for turning on the output stop switch 131 to the signal line 1044. .

  Step 1130 is processing performed only by the processing device 1002. The CPU 124 outputs an output stop switch control request to the interface circuit 1026 via the bus 127, and outputs a value at which the output stop switch 131 is turned off to the signal line 1044. .

  11 is based on the processing flow of FIG. 4, but it is also possible to construct a processing flow corresponding to FIG. 10 by making the same changes based on FIGS.

  FIG. 12 is a seventh embodiment of the configuration diagram of the control system to which the present invention is applied. Components having the same reference numerals as those in FIG. 1 are the same as those in FIG.

  The present embodiment is characterized in that the switch control circuit 134 of FIG.

  The interface circuit 1216 is the same as the interface circuit 116 in FIG. 1 except that the transmission line 147 connected to the switch control circuit 134 in FIG. 1 is deleted.

  The interface circuit 1226 is the same as the interface circuit 126 in FIG. 1 except that the transmission line 148 connected to the switch control circuit 134 in FIG. 1 is deleted.

  The transmission circuit 1224 is similar to the transmission circuit 114.

  The collation circuit 1235 receives the transmission data of the processing devices 1201 and 1202 from the transmission lines 1241 and 1250, and outputs a value that turns on the output stop switch 131 to the signal line 1244 if they match, and if they do not match. Outputs a value at which the output stop switch 131 is OFF to the signal line 1244.

  FIG. 13 is an example of a processing flow when one task is executed by the processing devices 1201 and 1202 of the control system of FIG. The process of the step of the same code | symbol as FIG. 2 is the same as that of FIG.

  In this processing flow, steps 203, 208, and 414 are deleted from the processing flow in FIG. 4 and step 209 is replaced with step 1331.

  Step 1331 is the same as Step 209 in FIG. 2, but the processing device 1302 as well as the processing device 1301 performs processing for outputting transmission data from the transmission circuit 1224.

  Although FIG. 13 is based on the processing flow of FIG. 4, it is also possible to construct a processing flow corresponding to FIG. 12 by making the same changes based on FIGS.

101 First processing device 102 Second processing device 131 Output stop switch 132 Control terminal 134 Switch control circuit 204 Step 205 for prohibiting task switching Step 206 for writing data identification number Step 206 for reading data identification number written by other device Step 208 for comparing data identification numbers of own device and other device Step 209 for writing collation result Step 209 for outputting data Step 212 for deleting output data identification number 213 Step for permitting task switching 825 Step for writing task identification number 826 and others Step 827 for reading out the task identification number and data identification number written by the apparatus. Step for comparing the task identification numbers of the own apparatus and other apparatuses.

Claims (8)

Having a first processing device and a second processing device for performing multitasking;
Collating the processing result of the first processing device and the processing result of the second processing device,
If they match, output the processing result,
In the case of a mismatch, in the dual control device that stops the output of the processing result,
Each of the first processing device and the second processing device prohibits task switching in a time zone before and after performing a predetermined process. In the dual system control device according to claim 1,
Each of the tasks has an identification number corresponding to the task,
Each of the first processing device and the second processing device compares the identification numbers in the time zone prohibiting task switching and before performing the predetermined processing,
The dual system control device, wherein the predetermined processing is performed when the identification numbers match. In the dual control device according to claim 2,
Each of the first processing device and the second processing device compares the identification numbers in the time zone prohibiting task switching and before performing the predetermined processing,
When the identification numbers do not coincide with each other, the comparison result of the identification numbers is deleted, and task switching is permitted. In the dual control device according to claim 3,
After allowing the task switching,
A dual system control device for performing the task switching prohibition and comparing the identification numbers. The dual control device according to any one of claims 2 to 4,
After performing the predetermined processing and before allowing task switching,
A dual control apparatus, wherein the comparison result of the identification number is deleted. The dual control device according to any one of claims 1 to 5,
Each of the first processing device and the second processing device is:
A dual-system control device that repeats reading of the processing result of the partner until the processing of the partner processing device is completed when collating. The dual control device according to any one of claims 1 to 6,
The dual control apparatus is characterized in that the predetermined process is at least one of an output process of the process result and an input process of data for performing the process. In the dual system control method of the first processing apparatus and the second processing apparatus for performing multitasking,
Collating the processing result of the first processing device and the processing result of the second processing device,
If they match, prohibit task switching,
It is prepared for each task to be processed by each of the first processing device and the second processing device, and compares each identification number that can identify the task,
If they match, perform the specified process to allow task switching,
A control method for a dual control device, wherein in the case of mismatch, the comparison result of the identification numbers is erased to permit task switching.