JP6774095B2 - Redundancy device - Google Patents

Description

The present invention relates to a redundant device, and is particularly suitable for use in a device for preventing the function of the system from stopping even when an abnormality occurs.

Generally, a nurse call system is used in hospitals and long-term care facilities. The nurse call system is used when a hospital patient needs the support of a doctor or nurse, or when a caregiver in a nursing facility needs the support of a caregiver, the patient or care recipient (hereinafter, simply ". This system is designed so that a "patient") can call a doctor, a nurse, or a caregiver (hereinafter, simply referred to as a "nurse") by pressing a call button or the like.

This type of nurse call system is required to have high reliability, and it is not allowed that the function of the nurse call is stopped for a long time due to the occurrence of a failure or the like. Therefore, a nurse call system has been devised in which the nurse call can be continued by switching to the sub device when the main device becomes inoperable by duplicating (redundant) the equipment (for example, Patent Documents 1 and 1). 2).

The nurse call system described in Patent Document 1 is provided with a plurality of control devices and corridor light control devices so that the system can function even if the control device and the corridor light control device become inoperable. There is. Specifically, the nurse call system described in Patent Document 1 includes a plurality of nurse call slave units in a hospital room, a nurse call master unit, a plurality of corridor lights, and a main control device and a main controller for controlling the nurse call operation. It is composed of a corridor light control device, a sub-control device that operates when the main control device becomes inoperable, and a sub-corridor light control device.

In the nurse call system described in Patent Document 2, when the nurse call controller is operating normally, the nurse call controller is in charge of communication with the nurse call slave unit. On the other hand, when the nurse call controller fails, the nurse call processing device is used as a substitute for the nurse call controller so that the nurse call processing device is in charge of communication with the nurse call slave unit.

Further, there is also known a technique in which one of two processors (CPUs) is used as a working processor and the other is used as a standby processor, and when an abnormality occurs in the working processor, the processor is switched to the standby processor and used. (See, for example, Patent Documents 3 and 4).

In the fault tolerance server described in Patent Document 3, a processor error occurs when various error information transmitted from the active processor, the standby processor, and the memory / I / O control unit is recorded in the error information storage unit. Notify the duplication control unit of the fact. When an error is detected in the active processor, standby processor, or memory / I / O controller, the duplex control unit separates the CPU module from its own system and isolates it, and the processor that caused the error transfers to another processor. After switching, the isolated CPU module unit is incorporated into the own system.

The safety-related signal processing system described in Patent Document 4 includes two duplicated CPUs, and is configured to mutually monitor failures and perform predetermined failure processing when a failure is detected. .. The two CPUs are connected to wireless control units corresponding to their respective redundant systems (A system / B system) so that communication data can be transmitted through their respective wireless lines. Further, the two CPUs periodically collate each other's safety-related signal input state and communication processing state through the CPU mutual monitoring line, and detect a failure of the other CPU.

Further, a system in which the operating power supply of the system is made redundant is also known (see, for example, Patent Document 5). In the two-system input power supply device described in Patent Document 5, power supply input is performed from two different systems, and when an abnormality occurs in one power supply input, the reliability of the power supply equipment system is improved by switching to the other input system. It is designed so that it can be secured.

Further, a redundancy technique using a CPU and an FPGA (Field-Programmable Gate Array) is also known (see, for example, Patent Documents 6 and 7). The signal processing apparatus described in Patent Document 6 includes an operating system (FPGA) that executes the same signal processing on an input acoustic signal and a standby system (a signal processing module executed on a CPU). Has. Then, when a signal indicating an error is detected from the operating system, the system is switched to the standby system to operate.

Further, in the system described in Patent Document 7, when a failure occurs in each board, the control circuits (CPU, FPGA, BMC, SFP, PXH) on each board detect the failure and notify the maintenance PC. If the power supply is also stopped, the BMC will be powered by the battery when the operator operates the manual switch.

Japanese Unexamined Patent Publication No. 2010-200066 Japanese Unexamined Patent Publication No. 2006-180991 Japanese Unexamined Patent Publication No. 2011-28481 JP-A-2007-26010 JP-A-2002-34177 JP 2015-35203 JP-A-2010-266777

As shown in Patent Documents 1 to 7, by making the system redundant, it is possible to switch to the standby system and operate the system when an abnormality occurs in the active system so that the system function does not stop. .. However, even if the abnormality that is occurring is a minor or temporary abnormality and the operation of the active system can be continued as it is, the system is switched to the standby system, so the system operation rate drops due to unnecessary switching. There was a problem that it could be done.

In the safety-related signal processing system described in Patent Document 4, if a transmission error happens to occur even in one line, the entire system will fail and there is a risk of lowering the operating rate of the system in order to solve the problem. In addition, when communication data is exchanged via two wireless lines and communication data can be normally received on at least one line, it is driven using the safety-related signal state indicated by the first normally received communication data. It is designed to perform stop control processing.

In the system described in Patent Document 4, even if a transmission error is detected in one of a plurality of redundant wireless lines, it is not treated as a failure, and communication is normally performed in any one of the lines. If so, the system can operate normally. However, in order to realize this, it is necessary to always send and receive both communication data through two wireless lines corresponding to the redundant system (A system / B system), so switching from the active system to the standby system. There was a problem that there was a lot of waste rather than doing.

The present invention has been made to solve such a problem, and it is necessary to prevent the switching from the active system to the standby system immediately due to a minor abnormality or a temporary abnormality. The purpose is to prevent a decrease in the operating rate of the system due to the above.

In order to solve the above-mentioned problems, in the present invention, the operating state of the main control circuit section of the working system is monitored, and when it is detected that the main control circuit section is inoperable, the main control circuit section waits. Communication of the first data with the main control circuit unit and the communication of the second data with the main control circuit unit when switching to the sub control circuit unit of the system for operation. 3 systems are communicated using the 2nd communication path for performing communication and the 3rd communication path for notifying the main control circuit unit of the power supply status with the main control circuit unit. When it is detected that the main control circuit unit is inoperable in the above communication path, the main control circuit unit is switched to the sub control circuit unit.

According to the present invention configured as described above, the main control circuit unit is inoperable in any of three or more communication paths due to the occurrence of a minor abnormality or a temporary abnormality. Even if it is detected, if it is not detected that the main control circuit unit is inoperable in more than half or the majority of the communication paths, the main control circuit unit of the active system is switched to the sub control circuit unit of the standby system. Is not done. That is, the switching from the main control circuit unit to the sub control circuit unit is performed only when it is detected that the main control circuit unit is inoperable in the communication path of more than half or the majority. As a result, it is possible to prevent the system operation rate from being lowered due to unnecessary switching due to a minor abnormality or a temporary abnormality.

It is a figure which shows the whole configuration example of the nurse call system to which the redundancy apparatus of this embodiment is applied. It is a figure which shows the circuit structure example of the controller by this embodiment.

Hereinafter, an embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a diagram showing an overall configuration example of a nurse call system to which the redundancy device of the present embodiment is applied. The redundancy device of the present embodiment is adapted to switch to the sub-control circuit section of the standby system and operate when an abnormality occurs in the main control circuit section of the active system that controls the nurse call system. ..

As shown in FIG. 1, the nurse call system of the present embodiment includes a nurse call master unit 1, a controller 2, a corridor light 3, a wall-embedded slave unit 4, and a nurse call slave unit 5. .. A plurality of corridor lights 3 are connected in series on the same trunk line wired from the controller 2, and a wall-embedded handset 4 is connected to each of the corridor lights 3.

The nurse call master unit 1 notifies a nurse of a call from a patient (nurse call slave unit 5), and the nurse operates a response to the call, and is installed in, for example, a nurse center. That is, when the nurse call master unit 1 receives the call signal sent from the nurse call slave unit 5, it executes a predetermined call operation. The calling operation is performed by displaying the patient information of the patient who made the call on the display and outputting the ringing tone from the speaker.

The controller 2 is arranged between the nurse call master unit 1 and the corridor light 3, and controls calls and data transmission / reception. As will be described in detail later with reference to FIG. 2, the controller 2 of the present embodiment has a redundant circuit configuration inside thereof.

The corridor light 3 is installed outside the vicinity of the entrance of each hospital room. The corridor light 3 includes a liquid crystal display device 3a and a calling light 3b such as an LED. The liquid crystal display device 3a displays patient information such as the patient name in the hospital room. The liquid crystal display device 3a is in a non-display state or a standby screen display state when the patient (nurse call slave unit 5) is not called, and when the patient calls, the patient's liquid crystal display device 3a is in the non-display state or the standby screen display state. Patient information is displayed. Further, when a patient in the hospital room makes a call using the nurse call slave unit 5, the call is notified by lighting or blinking of the call light 3b.

The wall-embedded handset 4 is embedded and installed in each bedside wall of the hospital room. The wall-embedded handset 4 has a connection terminal for the nurse call handset 5. The nurse call slave unit 5 is connected to the connection terminal of the wall-embedded slave unit 4. The nurse call slave unit 5 includes a call button for the patient to call the nurse, and a microphone and a speaker used by the patient to have a conversation with the nurse.

FIG. 2 is a diagram showing a circuit configuration example of the controller 2 according to the present embodiment. Note that FIG. 2 shows only the circuit configuration according to the present invention, and the circuit configuration of the portion not related to the present invention is not shown. As shown in FIG. 2, the controller 2 includes a control system redundant circuit unit 21, a switching control unit 22, a control system redundant power supply unit 23, and a monitor system redundant power supply unit 24.

The control system redundant circuit unit 21 includes a main control circuit unit 21M and a sub control circuit unit 21S as a redundant configuration. The main control circuit unit 21M is the circuit unit of the active system, and the sub control circuit unit 21S is the circuit unit of the standby system. That is, in the normal state, the main control circuit unit 21M operates, and when an abnormality occurs in the main control circuit unit 21M, the sub control circuit unit 21S operates in place of the main control circuit unit 21M.

The main control circuit unit 21M controls communication for transmitting a call from the nurse call slave unit 5 to the nurse call master unit 1. The main control circuit unit 21M also controls the communication path between the nurse call master unit 1 and the nurse call slave unit 5. The communication and the control of the call path are performed by the FPGA (for communication) 201M.

When an abnormality occurs in the main control circuit unit 21M and the sub control circuit unit 21S is switched to, the sub control circuit unit 21S performs the same control as the main control circuit unit 21M. That is, the sub-control circuit unit 21S controls the communication for transmitting the call from the nurse call slave unit 5 to the nurse call master unit 1. The sub-control circuit unit 21S also controls the communication path between the nurse call master unit 1 and the nurse call slave unit 5. The communication and the control of the call path are performed by the FPGA (for communication) 201S.

The switching control unit 22 monitors the operating state of the main control circuit unit 21M, and when it detects that the main control circuit unit 21M is in an inoperable state, switches from the main control circuit unit 21M to the sub control circuit unit 21S. Control to operate. The operating state of the main control circuit unit 21M is monitored by communication using three communication paths M1 to M3 between the main control circuit unit 21M and the switching control unit 22. The details will be described later.

In the present embodiment, the switching control unit 22 also monitors the operating state of the sub control circuit unit 21S, and sub-controls from the main control circuit unit 21M only when it detects that the sub control circuit unit 21S is in an operable state. It is controlled to switch to the circuit unit 21S and operate. The monitoring of the operating state of the sub-control circuit unit 21S is performed by communication using the three communication paths S1 to S3 between the sub-control circuit unit 21S and the switching control unit 22. The details will be described later.

The control system redundant power supply unit 23 includes a control system main power supply 23M and a control system auxiliary power supply 23S as a redundant configuration. The control system main power supply 23M is an active power supply that supplies power to the main control circuit unit 21M or the sub control circuit unit 21S, and the control system sub power supply 23S is the main control circuit unit 21M or the sub control circuit unit 21S. It is a standby power supply that supplies power to the power supply. That is, normally, the control system main power supply 23M operates, and when an abnormality occurs in the control system main power supply 23M, the control system sub power supply 23S operates in place of the control system main power supply 23M.

For example, if there is no abnormality in the main control circuit unit 21M and the control system main power supply 23M and the control system main power supply 23M can operate normally, the control system main power supply 23M supplies power to the main control circuit unit 21M. On the other hand, although there is no abnormality in the control system main power supply 23M, when an abnormality occurs in the main control circuit unit 21M, the main control circuit unit with respect to the sub control circuit unit 21S switched from the main control circuit unit 21M. 21M supplies power.

Further, although there is no abnormality in the main control circuit unit 21M, when an abnormality occurs in the control system main power supply 23M, the control system sub power supply 23S switched from the control system main power supply 23M supplies power to the main control circuit unit 21M. Supply. If an abnormality occurs in both the main control circuit unit 21M and the control system main power supply 23M and neither of them can operate, the control system sub power supply 23S switched from the control system main power supply 23M is used as the main control circuit unit 21M. Power is supplied to the sub-control circuit unit 21S switched from.

The main control circuit unit 21M (the sub control circuit unit 21S when the main control circuit unit 21M is switched to the sub control circuit unit 21S) monitors the operating state of the control system main power supply 23M, and the control system main power supply 23M When it is detected that the operation is inoperable, the control system main power supply 23M is switched to the control system sub power supply 23S to control the operation.

The monitor system redundant power supply unit 24 includes a monitor system main power supply 24M and a monitor system auxiliary power supply 24S as a redundant configuration. The monitor system main power supply 24M is a working power supply that supplies power to the switching control unit 22, and the monitor system sub power supply 24S is a standby power supply that supplies power to the switching control unit 22. That is, normally, the monitor system main power supply 24M operates, and when an abnormality occurs in the monitor system main power supply 24M, the monitor system sub power supply 24S operates in place of the monitor system main power supply 24M.

The switching control unit 22 monitors the operating state of the monitor system main power supply 24M, and when it detects that the monitor system main power supply 24M is inoperable, it switches from the monitor system main power supply 24M to the monitor system auxiliary power supply 24S. Control to operate.

Next, monitoring of the operating state (detection of the occurrence of an abnormality) and switching between the main and sub sides will be described in detail. Here, monitoring of the operating state of the main control circuit unit 21M will be described.

The switching control unit 22 communicates with the main control circuit unit 21M using three or more communication paths, and detects that the main control circuit unit 21M is inoperable in two or more communication paths. In this case, the main control circuit unit 21M is switched to the sub control circuit unit 21S to control the operation. In the present embodiment, the operating state of the main control circuit unit 21M is monitored by communication using the three communication paths M1 to M3.

That is, the switching control unit 22 communicates the second data with the first communication path M1 for communicating the first data with the main control circuit unit 21M and the second data with the main control circuit unit 21M. Three systems of communication are performed using the third communication path M3 that communicates with the communication path M2 of 2 and the main control circuit unit 21M regarding the notification of the power supply status to the main control circuit unit 21M. Then, when it is detected that the main control circuit unit 21M is inoperable in two or more communication paths, the main control circuit unit 21M is switched to the sub control circuit unit 21S for operation.

In order to form the above three communication paths M1 to M3, the main control circuit unit 21M includes a CPU 202M (corresponding to the first circuit unit) that controls the entire operation of the main control circuit unit 21M and a main control circuit unit 21M. It is equipped with an FPGA (for monitoring) 203M (corresponding to the second circuit unit) for monitoring the operating state of the above. The FPGA (for monitor) 203M has a function of monitoring the power supply state from the control system redundant power supply unit 23 to the main control circuit unit 21M. On the other hand, the switching control unit 22 is an FPGA (for a monitor) for monitoring the operating state of the CPU 202C (corresponding to the third circuit unit) that controls the overall operation of the switching control unit 22 and the main control circuit unit 21M. It is equipped with 203C (corresponding to the fourth circuit section).

The first communication path M1 is formed between the CPU 202M included in the main control circuit unit 21M and the CPU 202C included in the switching control unit 22. In the first communication path M1, serial communication of the first data is performed. The first data is data for confirming whether or not the main control circuit unit 21M is operating normally, and the data value (content) thereof is arbitrary. The switching control unit 22 determines that the main control circuit unit 21M is in an inoperable state when the communication of the first data cannot be performed via the first communication path M1.

The second communication path M2 is formed between the FPGA (for monitor) 203M included in the main control circuit unit 21M and the FPGA (for monitor) 203C included in the switching control unit 22. In the second communication path M2, the second data is communicated. The second data is also data for confirming whether or not the main control circuit unit 21M is operating normally, and the data value (content) thereof is arbitrary. The second data may have the same contents as the first data. The switching control unit 22 determines that the main control circuit unit 21M is in an inoperable state when the communication of the second data cannot be performed via the second communication path M2.

The third communication path M3 is formed between the FPGA (for monitor) 203M included in the main control circuit unit 21M and the FPGA (for monitor) 203C included in the switching control unit 22. In the third communication path M3, communication related to notification of the power supply status is performed. As described above, the FPGA (for monitor) 203M has a function of monitoring the power supply state. With this function, when the FPGA (for monitor) 203M detects an abnormality in the control system main power supply 23M, this is notified to the FPGA (for monitor) 203C of the switching control unit 22 via the third communication path M3. At the same time, switching to the control system auxiliary power supply 23S is performed. Upon receiving this notification, the switching control unit 22 determines that the main control circuit unit 21M is in an inoperable state.

As described above, the switching control unit 22 communicates in three systems using the three communication paths M1 to M3 shown above, and the main control circuit unit 21M is inoperable in the communication paths of two or more systems. When it is detected, the main control circuit unit 21M is switched to the sub control circuit unit 21S for operation.

Further, the switching control unit 22 further communicates with the sub control circuit unit 21S using the three communication paths S1 to S3. Then, it is detected that the main control circuit unit 21M is inoperable in the communication paths of two or more systems in the communication paths M1 to M3, and the communication paths of two or more systems in the communication paths S1 to S3. When it is detected that the sub control circuit unit 21S is in an operable state, the main control circuit unit 21M is switched to the sub control circuit unit 21S for operation.

The monitoring of the operating state of the sub control circuit unit 21S has the same contents as the monitoring of the operating state of the main control circuit unit 21M. That is, the first communication path S1 is formed between the CPU 202S included in the sub-control circuit unit 21S and the CPU 202C included in the switching control unit 22. In the first communication path S1, serial communication of the first data is performed. The switching control unit 22 determines that the sub-control circuit unit 21S is inoperable when the first data cannot be communicated via the first communication path S1.

The second communication path S2 is formed between the FPGA (for monitor) 203S included in the sub-control circuit unit 21S and the FPGA (for monitor) 203C included in the switching control unit 22. In the second communication path S2, the second data is communicated. The switching control unit 22 determines that the sub control circuit unit 21S is in an inoperable state when the communication of the second data cannot be performed via the second communication path S2.

The third communication path is formed between the FPGA (for monitor) 203S included in the sub control circuit unit 21S and the FPGA (for monitor) 203C included in the switching control unit 22. In the third communication path S3, communication related to notification of the power supply status is performed. When the FPGA (for monitor) 203S detects an abnormality in the control system main power supply 23M, it is notified to the FPGA (for monitor) 203C of the switching control unit 22 via the third communication path S3 and is controlled. Switching to the system auxiliary power supply 23S is performed. Upon receiving this notification, the switching control unit 22 determines that the sub control circuit unit 21S is in an inoperable state.

As described in detail above, in the present embodiment, when the operating state of the main control circuit unit 21M of the active system is monitored and it is detected that the main control circuit unit 21M is in an inoperable state, the main control circuit unit 21M When switching from to to the standby system sub-control circuit unit 21S to operate, the switching control unit 22 communicates with the main control circuit unit 21M using three communication paths M1 to M3, and two or more systems. When it is detected that the main control circuit unit 21M is inoperable in the communication path, the main control circuit unit 21M is switched to the sub control circuit unit 21S to operate.

According to the present embodiment configured in this way, even if it is detected that the main control circuit unit 21M is inoperable in one communication path due to the occurrence of a minor abnormality or a temporary abnormality, the active system The main control circuit unit 21M of the above is not switched to the sub control circuit unit 21S of the standby system. That is, only when it is detected that the main control circuit unit 21M is inoperable in two or more communication paths, the main control circuit unit 21M is switched to the sub control circuit unit 21S. As a result, it is possible to prevent the operation rate of the nurse call system from being lowered due to unnecessary switching due to a minor abnormality or a temporary abnormality.

Here, the inoperable state of the main control circuit unit 21M is not detected in the first communication path M1 and the second communication path M2, and the inoperable state of the main control circuit unit 21M is detected only in the third communication path M3. If so, the main control circuit unit 21M is not switched to the sub control circuit unit 21S. Even in this case, since the control system main power supply 23M is switched to the control system sub power supply 23S, the main control circuit unit 21M can obtain the necessary power supply from the control system sub power supply 23S and operate. is there.

In the above embodiment, the main control circuit unit 21M and the switching control unit 22 communicate with each other using three communication paths, and the main control circuit unit 21M cannot operate in two or more communication paths. Although an example of switching to the sub-control circuit unit 21S when it is detected is described, the operating state of the main control circuit unit 21M may be monitored by using four or more communication paths. Also in this case, similarly to the above embodiment, when it is detected that the main control circuit unit 21M is inoperable in the majority communication path, the sub control circuit unit 21S is switched to. Alternatively, switching to the sub-control circuit unit 21S may be performed when it is detected that the main control circuit unit 21M is inoperable in more than half of the communication paths.

Further, in the above embodiment, the sub-control circuit unit 21S and the switching control unit 22 communicate with each other using three communication paths, and the sub-control circuit unit 21S can operate in two or more communication paths. Although an example of switching to the sub-control circuit unit 21S when it is detected is described, the operating state of the sub-control circuit unit 21S may be monitored by using four or more communication paths. Also in this case, similarly to the above embodiment, when it is detected that the sub-control circuit unit 21S is in an operable state in the majority communication path, the sub-control circuit unit 21S is switched to the sub-control circuit unit 21S. Alternatively, switching to the sub-control circuit unit 21S may be performed when it is detected that the sub-control circuit unit 21S is in an operable state in more than half of the communication paths.

Further, in the above embodiment, the second communication path M2 and the third communication path are between the FPGA (for monitor) 203M included in the main control circuit unit 21M and the FPGA (for monitor) 203C included in the switching control unit 22. Although an example of forming M3 has been described, the present invention is not limited thereto. For example, the FPGA for forming the second communication path M2 and the FPGA for forming the third communication path M3 may be separately configured.

Further, in the above embodiment, a CPU is used as an example of the first circuit unit and the third circuit unit, and an FPGA is used as an example of the second circuit unit and the fourth circuit unit. Not limited.

Further, in the above embodiment, both the operating state of the main control circuit unit 21M and the operating state of the sub control circuit unit 21S are monitored, and the main control circuit unit 21M is in an inoperable state in two or more communication paths. Further, an example of switching from the main control circuit unit 21M to the sub control circuit unit 21S when it is detected that the sub control circuit unit 21S is in an operable state in two or more communication paths has been described. The present invention is not limited to this. For example, when it is detected that the main control circuit unit 21M is inoperable in more than half or more than half of the communication paths, the main control circuit unit 21M is switched to the sub control circuit unit 21S, and then more than half of them. Alternatively, when it is detected that the sub-control circuit unit 21S is in an inoperable state in a majority of communication paths, an error notification may be performed.

Further, in the above embodiment, an example of applying the redundant device of the present embodiment to the nurse call system has been described, but the system to which the redundant device of the present embodiment can be applied is not limited to the nurse call system. ..

In addition, the above embodiments are merely examples of embodiment of the present invention, and the technical scope of the present invention should not be construed in a limited manner. That is, the present invention can be practiced in various ways without departing from its spirit or its main features.

2 Controller 21 Control system redundant circuit unit 21M Main control circuit unit 21S Sub control circuit unit 22 Switching control unit 23 Control system redundant power supply unit 23M Control system main power supply 23S Control system auxiliary power supply 24 Monitor system redundant power supply unit 24M Monitor system main power supply 24S monitor system auxiliary power supply 202M, 202S CPU (first circuit section)
203M, 203S FPGA (for monitor) (second circuit part)
202C CPU (third circuit part)
203C FPGA (for monitor) (4th circuit part)

Claims (2)

It is a redundant device designed to switch to the sub control circuit section of the standby system and operate when an abnormality occurs in the main control circuit section of the active system that controls the system.
The operating state of the main control circuit unit is monitored, and when it is detected that the main control circuit unit is in an inoperable state, the main control circuit unit is switched to the sub control circuit unit for operation. Switching control unit and
It is provided with a main power supply of an active system and a sub power supply of a standby system that supply power to the main control circuit unit or the sub control circuit unit .
When the operation is switched by the main control circuit unit or the switching control unit, the sub control circuit unit monitors the operating state of the main power supply and detects that the main power supply is inoperable. , Control to switch from the main power supply to the sub power supply to operate,
The switching control unit is a first communication path for communicating the first data with the main control circuit unit, and a second communication for communicating the second data with the main control circuit unit. Communication of three systems is performed using a third communication path that communicates with the path and the notification of the power supply status to the main control circuit unit with the main control circuit unit, and two or more communication paths are performed. at when it is detected that the main control circuit unit is inoperative, redundant and wherein the operating switch to the sub-control circuit unit from the main control circuit unit. The main control circuit unit includes a first circuit unit that controls the overall operation of the main control circuit unit and a second circuit unit that monitors the operating state of the main control circuit unit. The circuit unit 2 has a function of monitoring the power supply state to the main control circuit unit.
The switching control unit includes a third circuit unit that controls the overall operation of the switching control unit, and a fourth circuit unit that monitors the operating state of the main control circuit unit.
The switching control unit is a first communication path for communicating the first data between the first circuit unit and the third circuit unit, the second circuit unit and the fourth circuit. The second communication path for communicating the second data with the unit, and the communication regarding the notification of the power supply status between the second circuit unit and the fourth circuit unit are performed. When three systems of communication are performed using the third communication path and it is detected that the main control circuit unit is inoperable in two or more communication paths, the main control circuit unit performs the sub-control. The redundancy device according to claim 1 , wherein the redundant device is operated by switching to a circuit unit.