JP6721140B1 - Data processing device, data processing method and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To suppress temporary suspension of a system due to damage of data temporarily saved from a register to a memory. A processor saves data in a register in a first area of a memory in response to a save instruction, and restores data in a first area in the register in response to a restore instruction. After executing the save instruction, the processor writes the data in the first area to each of the second area to the Nth area in the memory. Before executing the return instruction, the processor collates the data in the first area to the data in the N-th area with each other, the data in the majority area matches, and the data in the first area matches the data in the majority area. If the data does not match, the data in the majority area is overwritten in the first area. [Selection diagram] Fig. 3

Description

The present disclosure relates to a data processing device, a data processing method, and a program.

Along with the high integration and miniaturization of semiconductor devices, transient bit errors (soft errors) in memories are rapidly increasing. Data is corrupted due to soft error (data corruption occurs). Soft errors occur, for example, due to collisions of alpha particles and cosmic ray neutrons. Applying soft error-prone memory to the system can cause a temporary outage of the system due to data corruption.

Techniques have been developed to avoid temporary system outages due to data corruption. For example, Japanese Patent Laying-Open No. 2007-18414 (Patent Document 1) discloses a control device that writes the same data to three or more different addresses in a RAM when rewriting variable data in a RAM (Random Access Memory). It is disclosed. When reading a variable by executing a program, the control device reads data from each of three or more different addresses in the RAM. Then, in the case where any one of the data read from three or more different addresses is different from the plurality of other data, the control device determines the different data to be different from the other plurality of addresses. Rewrite with data.

JP 2007-18414 A

When a function process (subroutine) occurs during execution of the main routine, a stack operation is performed to suspend the main routine. The stack operation includes (1) a save operation (so-called Push operation) for temporarily saving the data held in a register incorporated in the processor to the stack area of the RAM at the start of the subroutine processing, and (2) a stack operation at the end of the subroutine processing. It includes a return operation (so-called Pop operation) for returning the data saved in the area to the register. A soft error may occur in the stack area where the data is temporarily saved by the stack operation. However, the code of the stack operation associated with the subroutine processing is automatically generated by the compiler. Therefore, when a general-purpose compiler is used, the technique described in Patent Document 1 cannot be applied to stack operation.

The present disclosure has been made in view of the above problems, and an object of the present disclosure is to provide a data processing device and a data processing device capable of suppressing a temporary stop of a system due to damage of data temporarily saved from a register to a memory. It is to provide a processing method and a program.

According to an example of the present disclosure, a data processing device includes a memory and a processor that executes arithmetic processing using the memory. The processor contains registers. The processor saves the data held in the register in the first area of the memory in response to the save instruction, and restores the data in the first area to the register in response to the restore instruction. The processor executes the first processing after executing the save instruction, and executes the second processing before executing the return instruction. The first process includes a process of writing the data in the first area to each of the second area to the Nth area in the memory. N is an integer of 3 or more. The second process is a process in which the data in the first region to the Nth region are collated with each other, and the data in the majority region of the first region to the Nth region are the same, and the first region Processing of overwriting the data of the majority area on the first area when the data of the area does not match the data of the majority area.

According to this disclosure, even if a soft error occurs in the first area where the data is temporarily saved according to the save instruction, the data in the first area is restored before the execution of the return instruction. Therefore, correct data is restored to the register according to the restore instruction. As a result, it is possible to prevent the system from being temporarily stopped due to the damage of the data temporarily saved in the memory from the register.

In the above disclosure, the first area is included in the stack area set in the memory. The processor identifies the first area by referring to the stack pointer set in the stack area before and after the execution of the save instruction.

According to this disclosure, the processor can correctly specify the first area in the memory in which the data is temporarily saved from the register.

In the above disclosure, the save instruction is issued to call a function process. The return instruction is issued after the function processing is completed. The processor starts the second processing in response to the completion of the function processing. According to this disclosure, the data in the first area can be restored immediately before the execution of the return instruction.

According to an example of the present disclosure, a data processing device includes a memory and a processor that executes arithmetic processing using the memory. The processor contains registers. The data processing method of the data processing device includes first to fourth steps. The first step is a step in which the processor saves the data held in the register in the first area of the memory in response to the save instruction. The second step is a step in which the processor executes the first process after executing the save instruction. The third step is a step in which the processor executes the second process before executing the return instruction. The fourth step is a step in which the processor restores the data in the first area to the register in response to the restore instruction. The first process includes a process of writing the data in the first area to each of the second area to the Nth area in the memory. N is an integer of 3 or more. The second process is a process in which the data in the first region to the Nth region are collated with each other, and the data in the majority region of the first region to the Nth region are the same, and the first region Processing of overwriting the data of the majority area on the first area when the data of the area does not match the data of the majority area.

According to an example of the present disclosure, a program causes a computer to execute the above data processing method. With these disclosures as well, it is possible to prevent the system from being temporarily stopped due to the damage of the data temporarily saved in the memory from the register.

According to the present disclosure, it is possible to suppress a temporary stop of the system due to the damage of the data temporarily saved in the memory from the register.

It is a schematic diagram showing the whole composition of a control system concerning an embodiment. It is a figure which shows the outline of the data restoration process in the safety IO unit which concerns on embodiment. It is a schematic diagram which shows the hardware structural example of a safety IO unit. It is a figure which shows the area|region of a main memory. It is a figure which shows an example of the writing process of the data to a main memory. It is a figure which shows an example of the reading process of the data from the main memory. It is a figure which shows the process performed after Push operation. It is a figure which shows the process performed before Pop operation. It is a schematic diagram which shows the hardware structural example of standard PLC. It is a schematic diagram which shows the hardware structural example of safety PLC. It is a schematic diagram which shows the hardware structural example of a coupler.

Embodiments of the present invention will be described in detail with reference to the drawings. It should be noted that the same or corresponding parts in the drawings are denoted by the same reference characters and description thereof will not be repeated.

§1 Application example In various fields such as aerospace systems, automobiles, medical equipment, communication equipment, and industrial equipment, it is desired to suppress temporary suspension of the system due to a memory soft error. The present disclosure may be applied to systems in such various fields. Hereinafter, a control system incorporated in the FA (factory automation) field will be described as an application example of the present disclosure, but the application example of the present disclosure is not limited to the control system.

FIG. 1 is a schematic diagram showing the overall configuration of a control system according to an embodiment. The control system 1 illustrated in FIG. 1 includes a standard PLC (programmable logic controller) 100, a safety PLC 200, one or more couplers 300, and one or more safety IO units 400 as main components. These devices included in the control system 1 are data processing devices that execute various tasks.

The standard PLC 100 executes standard control for an arbitrary control target according to a standard control program created in advance. “Standard control” is a general term for processes for controlling a controlled object in accordance with predetermined required specifications. The control target is, for example, a servo motor or a robot.

The safety PLC 200 executes safety control for an arbitrary control target independently of the standard PLC 100. The safety PLC 200 illustrated in FIG. 1 is connected to the standard PLC 100 via a local bus. “Safety control” is a general term for processing for preventing human safety from being threatened by equipment or machinery. The “safety control” is designed so as to satisfy the requirements for realizing the safety function defined in IEC 61508 and the like.

The coupler 300 mediates the exchange of data between the standard PLC 100 and the safety IO unit 400. The coupler 300 is electrically connected to the standard PLC 100 via the field network 2. The field network 2 is a communication medium for realizing data transmission for FA. In the field network 2, frame transmission is possible at a predetermined cycle, and the data arrival time for each node in the network is guaranteed. As an example of a protocol that guarantees such a data arrival time, EtherCAT (registered trademark) is adopted for field network 2 in control system 1 according to the present embodiment.

The coupler 300 transmits the data received from the standard PLC 100 to the safety IO unit 400, and when receiving the data from the safety IO unit 400, prepares to store the received data in the frame that arrives next.

The safety IO unit 400 is connected to the safety PLC 200 or the coupler 300 via a local bus. Further, any safety device (not shown) is connected to the safety IO unit 400. Safety devices include light curtains, emergency stop buttons and safety door switches.

The safety IO unit 400 receives an input signal from the safety device and provides the input signal to the safety PLC 200. Alternatively, the safety IO unit 400 receives an input signal from the safety device and provides the input signal to the standard PLC 100 via the coupler 300. The input signal provided to the standard PLC 100 is provided to the safety PLC 200.

Further, the safety IO unit 400 outputs an output signal to the safety device in response to a command from the safety PLC 200. Alternatively, the safety IO unit 400 outputs an output signal to the safety device in response to a command from the safety PLC 200 via the coupler 300 and the standard PLC 100.

The safety IO unit 400 executes arithmetic processing regarding acceptance of an input signal from the safety device, provision of the input signal, output of an output signal to the safety device, and the like in each predetermined cycle.

The safety PLC 200 executes safety control according to the input signal provided from the safety IO unit 400. For example, the safety PLC 200 shuts off the power supply to the control target of the standard PLC 100 and temporarily stops the control system 1 when an input signal indicating the intrusion of a person is provided from the safety device which is the light curtain. Alternatively, the safety PLC 200 shuts off the power supply to the control target of the standard PLC 100 and temporarily stops the control system 1 when an input signal indicating pressing of the button is provided from the safety device which is the emergency stop button.

In this way, the safety IO unit 400 is directly involved in safety control for preventing human safety from being threatened. Therefore, the safety PLC 200 is designed to temporarily stop the control system 1 even when a failure or abnormality occurs in the safety IO unit 400.

In the safety IO unit 400, when a function process (subroutine) occurs during execution of the main routine, the data held in the register incorporated in the processor is temporarily saved in the main memory, and the saved data is stored after the completion of the function process. Is restored to the register. The saving of the data held in the register to the main memory is executed according to the Push instruction which is a saving instruction. The restoration of the saved data to the register is executed according to the Pop instruction which is a restoration instruction.

When a soft error occurs in the area where the data is temporarily saved in the main memory, the temporarily saved data is damaged. If the safety IO unit 400 continues to operate without the damaged data being restored, the safety PLC 200 cannot execute safety control normally. Therefore, even if the data temporarily saved in the main memory is damaged, the safety IO unit 400 has a function of restoring the data.

FIG. 2 is a diagram showing an outline of data restoration processing in the safety IO unit according to the embodiment. The processor 402 and the main memory 404 shown in FIG. 2 are included in the safety IO unit 400. The processor 402 has a register 403 built therein.

The processor 402 saves the data held in the register 403 to the area 404a of the main memory 404 in response to the Push instruction (step S1).

After executing the Push instruction, the processor 402 writes the data in the area 404a to each of two areas 404b and 404c in the main memory 404, which are different from the area 404a (step S2). As a result, the data temporarily saved from the register 403 is tripled in the main memory 404.

The processor 402 collates the data in the areas 404a, 404b, and 404c with each other before executing the Pop instruction (step S3).

Further, the processor 402 determines that the data of the majority (that is, two) areas of the areas 404a to 404c match and that the data of the area 404a does not match the data of the majority area. The data is overwritten on the area 404a (step S4). When a soft error occurs in the area 404a between the completion of step S2 and the start of step S3, the data in the area 404a does not match the data in the areas 404b and 404c. Therefore, the data in the areas 404b and 404c are overwritten in the area 404a. As a result, the data corruption in the area 404a is repaired.

After that, the processor 402 restores the data in the area 404a to the register 403 according to the Pop instruction (step S5).

As described above, even if a soft error occurs in the area 404a between the completion of step S2 and the start of step S3, the data in the area 404a is restored in step S4. Therefore, correct data is restored in the register 403 unless a soft error occurs in the area 404a between the completion of step S4 and the start of step S5. As a result, it is possible to prevent the system from being temporarily stopped due to the damage of the data temporarily saved in the main memory 404 from the register 403.

§2 Concrete example <Hardware configuration of safety IO unit>
FIG. 3 is a schematic diagram showing a hardware configuration example of the safety IO unit. The safety IO unit 400 illustrated in FIG. 3 includes a processor 402, a main memory 404, a storage 410, a local bus controller 420, and a safety IO module 430. These components are connected via a processor bus 440.

The processor 402 corresponds to an arithmetic processing unit that executes control arithmetic operations related to signal input/output and management functions required to realize safety control, and is configured by a CPU, MPU (Micro Processing Unit), and the like. The processor 402 has a register 403 built therein. The register 403 temporarily holds the calculation result by the processor 402, and holds an address when reading and writing the main memory 404.

The main memory 404 is configured by a volatile memory such as DRAM or SRAM. The SRAM uses a flip-flop as a structure of a storage unit, and has an advantage that it does not require a refresh operation and can operate at a higher speed than a DRAM. Therefore, it is preferable to use the SRAM as the main memory 404.

A DRAM having a stacked type structure has a high soft error resistance. On the other hand, in the SRAM having the flip-flop structure, the soft error resistance decreases due to the miniaturization. Therefore, when using the main memory 404 configured by a highly integrated SRAM for increasing the capacity, a soft error is likely to occur in the main memory 404. Hereinafter, it is assumed that the main memory 404 is an SRAM.

The storage 410 is composed of, for example, a nonvolatile storage device such as SSD or HDD. The storage 410 stores an executable program 41 for realizing the IO function, a writing/reading program 42, and a collation repair program 43.

The local bus controller 420 exchanges data with a device (for example, the safety PLC 200, the coupler 300) to which the safety IO unit 400 is connected via the local bus.

The safety IO module 430 is electrically connected to the safety device, receives an input such as a detection result by the safety device, and outputs a signal to the safety device.

<Main memory>
FIG. 4 is a diagram showing an area of the main memory. As shown in FIG. 4, the main memory 404 includes a stack area 405, a data area 406 and a text area 407. The stack area 405 is an area for temporarily saving the data held in the register 403. The data area 406 is an area in which variables and the like are arranged. The text area 407 is an area where the program is expanded.

The processor 402 executes the instructions of the program expanded in the text area 407 line by line. The processor 402 reads the value of the variable from the data area 406 or writes the value of the variable in the data area 406 according to the instruction content.

The program expanded in the text area 407 (such as the executable program 41 shown in FIG. 3) is generated by the compiler. The compiler generates a Push instruction when calling a function process (subroutine) during execution of the main routine, and generates a Pop instruction after completion of the function process. The processor 402 temporarily saves the data held in the register 403 in the stack area 405 according to the Push instruction. The processor 402 restores the data saved in the stack area 405 to the register 403 according to the Pop instruction.

A stack pointer SP is set in the stack area 405. The stack pointer SP indicates the start address of the data placed in the stack area 405. In other words, the stack pointer SP indicates the address of the data finally placed in the stack area 405. When new data is placed in the stack area 405, the stack pointer SP is updated.

<Processing for data area of main memory>
The writing and reading of data to and from the data area 406 of the main memory 404 are executed by the processor 402 according to the writing/reading program 42.

FIG. 5 is a diagram showing an example of a process of writing data to the main memory. As shown in FIG. 5, the processor 402 copies the target data twice when writing the target data indicating the value of the designated variable in the data area 406 of the main memory 404, and generates two copy data. ..

The processor 402 writes the target data in the partial area 406a of the data area 406 and also writes two copy data in the partial areas 406b and 406c, respectively. The addresses of the partial areas 406a, 406b, 406c are managed in association with variables. The processor 402 writes the data in the partial areas 406a, 406b, and 406c using the address. As a result, the data is tripled in the main memory 404.

Immediately after the writing, the data in the partial areas 406a, 406b, and 406c are the same. However, a soft error may occur in any of the partial regions 406a, 406b, and 406c due to the influence of cosmic rays or neutron rays, for example.

FIG. 6 is a diagram showing an example of a process of reading data from the main memory. As shown in FIG. 6, the processor 402 reads data from the partial areas 406a, 406b, and 406c in the data area 406 of the main memory 404, and collates the data read from the partial areas 406a, 406b, and 406c with each other. Specifically, the processor 402 copies the data of the partial areas 406a, 406b, and 406c to the register 403, and collates the data copied to the register 403.

When no soft error has occurred in any of the partial areas 406a, 406b, 406c, all the data read from the partial areas 406a, 406b, 406c match. Therefore, the processor 402 continues the arithmetic processing using the value indicated by the data read from the partial area 406a when all the data read from the partial areas 406a, 406b, and 406c match.

Even if a soft error occurs in one of the partial areas 406a, 406b, and 406c, the data read from the remaining two partial areas match. Therefore, in response to the data read from two regions excluding one partial region among the partial regions 406a, 406b, and 406c matching, the processor 402 matches the data read from the two partial regions. Then, the data read from the one partial area is rewritten. As a result, the data read from the one partial area on the register 403 is restored. After that, the processor 402 continues the arithmetic processing using the value indicated by the data read from the partial area 406a on the register 403.

Further, the processor 402 overwrites the data read from the two partial areas on the one partial area in the data area 406 of the main memory 404. As a result, the data of the one partial area is restored on the main memory 404 as well.

Thus, even if a soft error occurs in one of the partial areas 406a, 406b, and 406c, the data in the one partial area is restored in the reading process.

<Process executed in association with stack operation>
As described above, the processor 402 temporarily saves the data held in the register 403 in the stack area 405 according to the Push instruction (Push operation). According to the Pop instruction, the processor 402 restores the data saved in the stack area 405 to the register 403 (Pop operation). Here, instead of the Push instruction, it is conceivable to issue an instruction to temporarily save the data held in the register 403 to three partial areas in the stack area 405. Then, instead of the Pop instruction, the data in the three partial areas in the stack area 405 are collated with each other, and when the data in the majority partial areas among the three partial areas match, the data in the majority partial areas are matched. It is conceivable to issue an instruction to return the register to the register 403. However, Push and Pop instructions are generated by the compiler. Therefore, as long as a general-purpose compiler is used, the above instructions cannot be issued in place of the Push instruction and the Pop instruction.

Therefore, the safety IO unit 400 executes the following processing in association with the stack operation. The following processing associated with the stack operation is executed by the processor 402 according to the collation repair program 43.

FIG. 7 is a diagram showing a process executed after the Push operation. FIG. 7 shows processing that is executed after the Push instruction for calling the function processing 20 is issued and the Push operation according to the Push instruction is issued.

The processor 402 monitors the stack pointer SP in the stack area 405. The processor 402 refers to the stack pointer SP before and after the stack operation to identify the partial area 405a of the stack area 405 in which the data is saved by the Push operation (step S11).

The processor 402 writes the two pieces of copy data obtained by copying the data of the specified partial area 405a into the two partial areas 406d and 406e in the data area 406 (step S12).

As a result, in the main memory 404, the data temporarily saved in the stack area 405 by the Push operation is tripled.

FIG. 8 is a diagram showing a process executed before the Pop operation. FIG. 8 shows a process executed before the Pop operation corresponding to the Push operation shown in FIG. 7.

The processor 402 recognizes the completion of the function process 20 by executing the line “functionExit();” indicating the completion of the function process 20 called after the Push instruction (step S21). After the completion of the function processing 20, the Pop instruction is issued to return to the main routine. Therefore, the processor 402 executes the following steps S22 and S23 after completing the function processing.

When recognizing the completion of the function process 20, the processor 402 collates the data in the partial area 405a of the stack area 405 and the two partial areas 406a and 406b of the data area 406 with each other (step S22).

The processor 402 restores the partial areas 405a, 406d, 406e according to the collation result of the data of the partial areas 405a, 406d, 406e (step S23).

During the period from the completion of step S12 shown in FIG. 7 to the start of step S22 of FIG. 8, if no soft error has occurred in any of the partial areas 405a, 406d, 406e, the partial areas 405a, 406d, 406e are read. All of the data matched. In this case, since the partial areas 405a, 406d, and 406e do not need to be repaired, the process of step S23 is omitted.

Even if a soft error occurs in one of the partial areas 405a, 406d, and 406e, the data read from the remaining two partial areas match. Therefore, the processor 402 determines that the data read from the two partial areas corresponds to the data read from the two partial areas except one of the partial areas 405a, 406d, and 406e. Overwrites one partial area. As a result, the data of the one partial area is restored.

Specifically, when the data in the partial areas 406d and 406e match and the data in the partial area 405a does not match the data in the partial areas 406d and 406e, the data in the partial areas 406d and 406e are overwritten in the partial area 405a. In FIG. 8, the data “00103333” in the partial area 405a does not match the data “00003333” in the partial areas 406d and 406e. Therefore, the data “00003333” in the partial areas 406d and 406e is overwritten in the partial area 405a. As a result, the data in the partial area 405a is restored.

The data in the partial areas 406d and 406e is used to determine whether or not a soft error has occurred in the partial area 405a and to repair the partial area 405a. Therefore, when the data in the partial areas 405a and 406d match and the data in the partial area 406e does not match the data in the partial areas 405a and 406d, the restoration of the data in the partial area 406e may be omitted. Similarly, when the data in the partial areas 405a and 406e match and the data in the partial area 406d does not match the data in the partial areas 405a and 406e, the restoration of the data in the partial area 406d may be omitted.

After that, the processor 402 restores the data in the partial area 405a to the register 403 according to the Pop instruction. As described above, even if a soft error occurs in the partial area 405a between the completion of step S12 and the start of step S22, the data in the partial area 405a is restored by steps S22 and S23. Therefore, it is possible to suppress the temporary stop of the control system 1 caused by the soft error in the stack area 405 in which data is temporarily saved according to the stack operation.

If the data in the partial areas 405a, 406d, and 406e are different from each other, it cannot be determined which data is correct. Therefore, the processor 402 may perform error notification when the data in the partial areas 405a, 406d, and 406e are different from each other.

<Hardware configuration of other devices>
(Standard PLC hardware configuration)
FIG. 9 is a schematic diagram showing a hardware configuration example of a standard PLC. The standard PLC 100 illustrated in FIG. 9 includes a processor 102, a main memory 104, a storage 110, a field network controller 108, and a local bus controller 116. These components are connected via the processor bus 118.

The processor 102 mainly corresponds to an arithmetic processing unit that executes a control arithmetic operation related to standard control, is configured by a CPU, a GPU, or the like, and has a register 103 built therein. The processor 102 reads a program (for example, the system program 1102 and the standard control program 1104) stored in the storage 110, expands the program in the main memory 104, and executes the program, thereby performing a control operation according to a control target, and It realizes various processes as will be described later.

The main memory 104 is configured by a volatile memory such as a DRAM (Dynamic Random Access Memory) or an SRAM (Static Random Access Memory). The storage 110 is composed of, for example, a nonvolatile storage device such as an SSD (Solid State Drive) or an HDD (Hard Disk Drive).

The storage 110 stores a system program 1102 for realizing a basic function, a standard control program 1104 created according to a control target, and setting information 1106 for defining processing in the standard PLC 100.

The field network controller 108 exchanges data with an arbitrary device (for example, the coupler 300) via the field network 2.

The local bus controller 116 exchanges data with an arbitrary unit (for example, the safety PLC 200) connected to the standard PLC 100 via the local bus.

(Hardware configuration of safety PLC)
FIG. 10 is a schematic diagram showing a hardware configuration example of the safety PLC. The safety PLC 200 illustrated in FIG. 10 includes a processor 202, a main memory 204, a storage 210, and a local bus controller 216. These components are connected via a processor bus 218.

The processor 202 mainly corresponds to a calculation processing unit that executes a control calculation related to safety control, and is configured by a CPU, GPU, and the like. The processor 202 includes a register 203.

The main memory 204 is configured by a volatile memory such as DRAM or SRAM. The storage 210 is composed of, for example, a nonvolatile storage device such as SSD or HDD.

The storage 210 stores a system program 2102 for realizing a basic function, a safety program 2104 created according to a required safety function, and setting information 2106 for defining processing in the safety PLC 200. It

The local bus controller 216 exchanges data with the safety IO unit 400 connected to the safety PLC 200 via the local bus.

(Hardware configuration of coupler)
FIG. 11 is a schematic diagram showing a hardware configuration example of the coupler. The coupler 300 illustrated in FIG. 11 includes a processor 302, a main memory 304, a storage 310, a field network controller 308, and a local bus controller 316. These components are connected via a processor bus 318.

The processor 302 mainly corresponds to an arithmetic processing unit that executes a control arithmetic operation for operating the coupler 300, and includes a CPU, a GPU, and the like. The processor 302 includes a register 303.

The main memory 304 is composed of a volatile memory such as DRAM or SRAM. The storage 310 is composed of, for example, a nonvolatile storage device such as SSD or HDD.

The storage 310 stores a system program 3102 for realizing a basic function and setting information 3106 for defining a process in the coupler 300.

The field network controller 308 exchanges data with an arbitrary device (for example, the standard PLC 100) via the field network 2.

The local bus controller 316 exchanges data with the safety IO unit 400 connected to the coupler 300 via the local bus.

<Action/effect>
As described above, the safety IO unit 400 that is a data processing device includes the main memory 404 and the processor 402 that executes arithmetic processing using the main memory 404. The processor 402 has a register 403 built therein. The processor 402 saves the data held in the register 403 to the partial area 405a of the stack area 405 in the main memory 404 in response to the Push instruction. The processor 402 restores the data in the partial area 405a to the register 403 in response to the Pop instruction. The processor 402 executes the first processing after executing the Push instruction, and executes the second processing before executing the Pop instruction. The first process includes a process of writing the data in the partial area 405a to each of the partial areas 406d and 406e of the data area 406 in the main memory 404. The second process includes a process of collating the data in the partial areas 405a, 406d, and 406e with each other. The second processing is further performed in accordance with the fact that the data in the partial areas 406d and 406e match and the data in the partial area 405a does not match the data in the partial areas 406d and 406e. The process includes overwriting data in the partial area 405a.

According to the above configuration, even if a soft error occurs in the partial area 405a in which the data is temporarily saved according to the Push instruction, the data in the partial area 405a is restored before the execution of the Pop instruction. Therefore, correct data is restored in the register 403 according to the Pop instruction. As a result, it is possible to prevent the system from being temporarily stopped due to the damage of the data temporarily saved in the main memory 404 from the register 403.

The partial area 405a is included in the stack area 405 set in the main memory 404. The processor 402 identifies the partial area 405a by referring to the stack pointer SP set in the stack area 405 before and after the execution of the Push instruction. As a result, the processor 402 can correctly specify the partial area 405a in the main memory 404 in which the data is temporarily saved from the register 403.

The Push instruction is issued to call the function process 20. The Pop instruction is issued after the function processing 20 is completed. The processor 402 starts the second processing described above in response to the completion of the function processing 20. As a result, the data in the partial area 405a can be restored immediately before the execution of the Pop instruction.

<Modification 1>
In the above description, the processor 402 writes the copy data obtained by copying the data temporarily saved in the partial area 405a in response to the Push instruction to the two partial areas 406a and 406b in the data area 406, respectively. did. However, the processor 402 may write the copy data of the data in the partial area 405a into three or more partial areas in the data area 406. As a result, the data temporarily saved in the stack area 405 according to the Push instruction is multiplexed.

For example, the processor 402 writes the copy data of the data in the partial area 405a to the second partial area to the Nth partial area in the data area 406. N is an integer of 4 or more. Then, the processor 402 collates the data in the partial area 405a and the data in the second partial area to the Nth partial area with each other before executing the Pop instruction. In the processor 402, the data of the majority area of the partial area 405a and the second to N-th partial areas match, and the data of the partial area 405a does not match the data of the majority partial area. Accordingly, the data of the majority of the partial areas is overwritten on the partial area 405a. As a result, even if a soft error occurs in the partial area 405a, the data in the partial area 405a is restored.

<Modification 2>
Like the safety IO unit 400, the standard PLC 100, the safety PLC 200, and the coupler 300 may perform the processing shown in FIGS. 7 and 8 in association with the stack operation. Accordingly, the standard PLC 100, the safety PLC 200, and the coupler 300 can also repair the damage of the data temporarily saved in the stack area in accordance with the stack operation. As a result, the frequency of stopping the control system 1 is suppressed.

§3 Appendix As described above, the present embodiment includes the following disclosures.

(Structure 1)
A data processing device (400),
A memory (404),
A processor (402) for executing arithmetic processing using the memory (404),
The processor (402) includes a register (403),
The processor (402) is
In response to the save instruction, save the data held in the register (403) to the first area (404a, 405a) of the memory (404),
In response to a restore instruction, restore the data in the first area (404a, 405a) to the register (403),
The processor (402) executes a first process after the execution of the save instruction and a second process before the execution of the return instruction,
In the first processing, the data in the first area (404a, 405a) is transferred from the second area (404b, 404c, 406d, 406e) in the memory (404) to the Nth area (404b, 404c, 406d, 406e), including the process of writing
N is an integer of 3 or more,
The second processing is
A process of collating the data of the first region (404a, 405a) to the Nth region (404b, 404c, 406d, 406e) with each other;
Data of a majority of the first area (404a, 405a) to the N-th area (404b, 404c, 406d, 406e) is the same, and the data of the first area (404a, 405a) is the same. Processing for overwriting the data of the majority area on the first area (404a, 405a) when the data does not match the data of the majority area.

(Configuration 2)
The first area (405a) is included in the stack area (405) set in the memory (404),
The configuration (1), wherein the processor (402) identifies the first area (404a, 405a) by referring to a stack pointer set in the stack area (405) before and after the execution of the save instruction. Data processing equipment.

(Structure 3)
The save instruction is issued to call a function process,
The return instruction is issued after completion of the function processing (20),
The data processing device according to configuration 1 or 2, wherein the processor (402) starts the second processing in response to completion of the function processing (20).

(Structure 4)
A data processing method of a data processing device (400), comprising:
The data processing device (400) is
A memory (404),
A processor (402) for executing arithmetic processing using the memory (404),
The processor (402) includes a register (403),
The data processing method is
A step in which the processor (402) saves the data held in the register (403) to a first area (404a, 405a) of the memory (404) in response to a save instruction;
The processor (402) executing a first process after executing the save instruction;
The processor (402) performing a second process before executing a return instruction;
The processor (402) restores the data in the first area (404a, 405a) to the register in response to the restore instruction,
In the first processing, the data in the first area (404a, 405a) is transferred from the second area (404b, 404c, 406d, 406e) in the memory (404) to the Nth area (404b, 404c, 406d, 406e), including the process of writing
N is an integer of 3 or more,
The second processing is
A process of collating the data of the Nth region from the first region (404a, 405a) with each other;
Data of a majority of the first area (404a, 405a) to the N-th area (404b, 404c, 406d, 406e) is the same, and the data of the first area (404a, 405a) is the same. A data processing method of overwriting the data of the majority area on the first area (404a, 405a) when the data does not match the data of the majority area.

(Structure 5)
A program that causes a computer to execute the data processing method according to configuration 4.

Although the embodiments of the present invention have been described, it should be considered that the embodiments disclosed this time are illustrative in all points and not restrictive. The scope of the present invention is shown by the claims, and is intended to include meanings equivalent to the claims and all modifications within the scope.

1 control system, 2 field network, 20 function processing, 41 executable program, 42 writing/reading program, 43 collation and repair program, 100 standard PLC, 102, 202, 302, 402 processor, 103, 203, 303, 403 register, 104, 204, 304, 404 main memory, 108, 308 field network controller, 110, 210, 310, 410 storage, 116, 216, 316, 420 local bus controller, 118, 218, 318, 440 processor bus, 200 safety PLC , 300 coupler, 400 safety IO unit, 404a to 404c area, 405 stack area, 405a, 406a to 406e partial area, 406 data area, 407 text area, 430 safety IO module, 1102, 2102, 3102 system program, 1104 standard control Program, 1106, 2106, 3106 Setting information, 2104 Safety program.

Claims (5)

A data processing device,
Memory and
A processor that executes arithmetic processing using the memory,
The processor includes a register,
The processor is
In response to the save instruction, save the data held in the register to the first area of the memory,
In response to a restore instruction, restore the data in the first area to the register,
The processor executes a first process after the execution of the save instruction and a second process before the execution of the return instruction,
The first process includes a process of writing the data in the first area to each of the second area to the Nth area in the memory,
N is an integer of 3 or more,
The second processing is
A process of collating data in the first region to the Nth region with each other;
The data of the majority area of the first area to the Nth area matches, and the data of the first area does not match the data of the majority area. A data processing device including the process of overwriting the first area with the above data. The first area is included in a stack area set in the memory,
The data processing device according to claim 1, wherein the processor identifies the first area by referring to a stack pointer set in the stack area before and after execution of the save instruction. The save instruction is issued to call a function process,
The return instruction is issued after completion of the function processing,
The data processing device according to claim 1, wherein the processor starts the second processing in response to completion of the function processing. A data processing method of a data processing device, comprising:
The data processing device,
Memory and
A processor that executes arithmetic processing using the memory,
The processor includes a register,
The data processing method is
The processor saves the data held in the register in a first area of the memory in response to a save instruction;
The processor executing a first process after executing the save instruction;
The processor performing a second process before executing a return instruction;
The processor restores the data in the first area to the register in response to the restore instruction,
The first process includes a process of writing the data in the first area to each of the second area to the Nth area in the memory,
N is an integer of 3 or more,
The second processing is
A process of collating data in the first region to the Nth region with each other;
The data of the majority area of the first area to the Nth area matches, and the data of the first area does not match the data of the majority area. A data processing method for overwriting the first area with the above data. A program that causes a computer to execute the data processing method according to claim 4.

Images