JPWO2015011792A1 - Field programmable gate array and control device - Google Patents

Abstract

The present invention provides a highly-available system in an FPGA that multiplexes processors by executing restoration of an error processor and synchronization processing of another operating processor while suppressing interruption of system processing. The purpose is to provide. For example, the field programmable gate array according to the present invention includes an internal memory, a plurality of processors each executing a process having the same contents, and an output from the plurality of processors. A memory update circuit that detects an error of at least one processor and outputs a determination signal indicating in which processor the error has occurred; and when receiving the determination signal, selects an internal memory of the processor in which the error has occurred; And a memory write-back circuit that writes back the contents of the internal memory of another normal processor to the internal memory and recovers from an error.

Description

  The present invention relates to a field programmable gate array and a control device.

  As a system mainly used in a recent field programmable gate array (hereinafter referred to as FPGA), there is an SRAM (Static Random Access Memory) type.

  The SRAM type FPGA has a feature that, when the power is turned on, an arbitrary logic circuit can be realized by an LUT (Look Up Table) composed of SRAM.

  However, because of this characteristic, when a temporary failure called a soft error in which the SRAM bit temporarily changes due to external noise or cosmic rays radiated from the air, the configuration differs from the desired circuit. As a result, the system may malfunction or the device may stop.

  Against this background, a technique for increasing the availability when a processor is built in an SRAM type FPGA has been proposed.

For example, in Non-Patent Document 1, in an SRAM type FPGA, the processor is tripled inside the FPGA and a large number of processor outputs are written to the shared memory. Even if a failure occurs in any one of the processors, the FPGA An example of a system that outputs correct values is described.

IEICE Transactions D Vol. J92-D No. 12 pp. 2105-2113

  In industrial control systems such as plants, railways, and aircraft that require extremely high reliability to ensure the safety of human lives and the environment, even if a failure or abnormality occurs in the system, the system should not be stopped as much as possible. Increased availability is required. Therefore, in a control device that performs control inside such a system, it is required to improve reliability and availability.

  Until now, ASIC (Application Specific Integrated Circuit) has been mainly used for such a control apparatus.

  However, in recent years, it has become difficult to newly develop ASICs for industrial control systems with a small number of manufacturing due to soaring manufacturing costs accompanying miniaturization of semiconductor processes.

  On the other hand, FPGAs put into practical use in the 1980's have been integrated and performance increased by miniaturization, and the price has been increased, so attempts to use them in industrial control systems with a small number of manufacturing have begun. In order to use an SRAM type FPGA, which is said to be more susceptible to soft errors than ASICs, for industrial use, it is possible to detect a failure in a circuit in the FPGA and also to detect a failure. Availability is required.

  Here, in the technique of Non-Patent Document 1, in order to restore a processor that has caused a soft error, it is necessary for all the processors to perform a restoration process that synchronizes the internal state with another normal processor. There was a problem that the main processing of the system stopped.

  The present invention provides a highly-available system in an FPGA that multiplexes processors by executing restoration of an error processor and synchronization processing of another operating processor while suppressing interruption of system processing. The purpose is to provide.

  In order to solve the above problems, for example, the configuration described in the claims is adopted.

  The subject includes a plurality of means for solving the above-mentioned problem. To give an example, each of the subjects includes an internal memory, and a plurality of processors each executing and outputting a process having the same contents, and the plurality A memory update circuit that detects an error of at least one processor from an output of the processor and outputs a determination signal indicating which processor has the error; and an internal of the processor in which the error occurs when the determination signal is received A memory write-back circuit that selects a memory and writes back the contents of the internal memory of another normal processor to the internal memory to recover from an error.

  According to the present invention, when a processor is multiplexed in a system using an FPGA, it is possible to recover and synchronize a failed processor while reducing interruption of the main processing of the system.

  Problems, configurations, and effects other than those described above will become apparent from the following description of embodiments.

2 is an example of an FPGA including a plurality of processors according to the first exemplary embodiment. It is a figure which shows the example of the value of the failure processor display signal output from FPGA of FIG. 1, and a returning processor display signal. This is an example in which a circuit for restoring the internal memory of the processor is mounted on the FPGA incorporating the plurality of processors in the first embodiment. FIG. 4 is a diagram illustrating an example of a memory update circuit illustrated in FIG. 3. FIG. 4 is a diagram illustrating an example of a return memory illustrated in FIG. 3. FIG. 4 is a diagram illustrating an example of a memory write-back circuit illustrated in FIG. 3. 6 is an example of a timing chart in the case where the contents of the internal memory of a failed processor are written back at a higher speed than in a non-failed processor in the FPGA according to the first embodiment. FIG. 10 is an example in which a circuit for writing back an updated part during restoration of an internal memory of a failed processor in the second embodiment is mounted. It is a figure which shows an example of the difference memory during a return shown in FIG. It is a figure which shows an example of the difference update circuit shown in FIG. FIG. 9 is a diagram illustrating an example of a memory write-back circuit illustrated in FIG. 8. It is an example which showed a mode that the information of the internal memory of a processor returned. It is the figure which showed an example of the processing chart in case a temporary failure generate | occur | produces in one processor during a several processor operation | movement, and it resets. FIG. 10 is a diagram illustrating an example of assigning a failed processor in a partially reconfigurable FPGA to another area in the FPGA according to the third embodiment. It is the figure which showed an example of the processing chart in case a permanent failure generate | occur | produces in one processor during a several processor operation | movement, and a processor is allocated to another area | region and it returns. In Example 4, it is an example of the industrial control system which controls a substation installation with the control apparatus which mounts FPGA of this invention, and its control apparatus.

  Hereinafter, examples will be described with reference to the drawings.

  FIG. 1 is a diagram illustrating an example of an FPGA incorporating three processors.

  The processor A (2), the processor B (3), and the processor C (4) built in the FPGA (1) are mounted with the same logic circuit, perform the same processing, and output the same value.

  The majority circuit 10 outputs a large number of outputs of the processor A (2), the processor B (3), and the processor C (4) as a control output signal 101 to the outside. If a failure occurs in one of the processors and the output differs from the other two processors, the different values are not output by majority vote.

  The majority circuit 10 outputs a failed processor display signal 102 and a returning processor display signal 103.

  FIG. 2 shows examples of signal values of the failed processor display signal 102 and the returning processor display signal 103.

  FIG. 2A is a diagram illustrating a display signal of the failed processor display signal 102. The majority circuit 10 performs majority processing on the outputs of the processor A (2), the processor B (3), and the processor C (4), and when the output of one of the processors is different from the outputs of the other processors, A processor that outputs a different output is determined to be faulty. Here, an example of output of the 3-bit failed processor display signal 102 is shown in which the failed processor display signal 102 outputs 0 if the corresponding processor has not failed and outputs 1 if the corresponding processor has failed. It is a thing.

  In FIG. 2A, bit 2 of the failed processor display signal 102 is 1 if the processor A (2) has failed, and bit 1 of the failed processor display signal 102 is set if the processor B (3) has failed. 1 indicates that if the processor C (3) has failed, bit 0 of the failed processor display signal 102 becomes 1.

  FIG. 2B is a diagram showing a display signal of the returning processor display signal 103. When the majority circuit 10 determines that any one of the processors A (2), B (3), and C (4) has failed, the majority circuit 10 determines whether or not the failed processor is returning and displays the returning processor. The signal 103 is output. Here, the returning processor display signal 103 outputs 0 when the corresponding processor is not recovering, and outputs 1 when the corresponding processor is recovering. Output of the 3-bit returning processor display signal 103 An example is shown.

  In FIG. 2B, bit 2 of the returning processor display signal 103 is 1 if the processor A (2) is returning, and the returning processor display signal 103 if the processor B (3) is returning. If bit 1 is 1 and the processor C (4) is recovering, it indicates that bit 0 of the returning processor display signal 103 is 1.

  As described above, in the FPGA according to the present invention, in the configuration in which processors are multiplexed to increase availability, a processor that has failed is detected by a majority circuit, and a signal indicating that a failure is occurring and a signal indicating that a failure is occurring are detected. Is output to the outside, and other processors continue to operate even when the failed processor recovers.

  With these things, it is possible to confirm from the outside that the processor inside the FPGA has failed and is recovering. If the failure and recovery are repeated, the device can be safely stopped and replaced quickly. It becomes possible to use it as a guideline.

  In the first embodiment, an example is shown in which three processors are mounted in the FPGA. However, a configuration in which three or more processors are mounted may be employed.

  Next, an example of a system for recovering a failed processor in an FPGA that internally includes the processor of the present invention will be described more specifically.

  FIG. 3 is an example in which a circuit for restoring the internal memory of the processor is mounted on the FPGA incorporating the plurality of processors in the first embodiment. The FPGA (1) shown in FIG. 3 is an SRAM type, and can be partially reconfigured so that a part of the FPGA can be rewritten while the FPGA is operating.

  The FPGA (1) includes a processor A (2) having an internal memory A (6). There are a processor B (3) and a processor C (4) having the same configuration as the processor A (2), and these three processors constitute a triple system.

  Each processor performs processing by reading from and writing to the internal memory held by each processor.

  At this time, the memory write signal A (111) of the processor A (2) is input to the memory update circuit 12. Similarly, the memory write signal B (112) of the processor B (3) and the memory write signal C (113) of the processor C (4) are also input to the memory update circuit 12.

  A specific example of the memory update circuit 12 is shown in FIG.

  FIG. 4 is a diagram illustrating an example of the memory update circuit. In the memory update circuit 12 shown in FIG. 4, the memory write signal A (111) from the processor A (2), the memory write signal B (112) from the processor B (3), and the memory write signal from the processor C (4). C (113) is input to the majority circuit 14 operating with clock 1 (201), and if there is an error in the memory write signal from any processor due to a failure or the like, it is output as the majority decision signal 106. The value of the majority decision signal 106 indicates which processor has failed.

  The write control signal 104 is output by the majority of the memory write signals 111, 112, and 113.

  The read control signal 105 output from the value of the majority decision signal 106 and the value of the write control signal 104 via the memory mismatch determination circuit 31 includes processor identification information indicating which processor has failed and its internal memory. Indicates address information.

  In FIG. 3, the write control signal 104 and the read control signal 105 output from the memory update circuit 12 are input to the return memory 11. As in FIG. 1, the majority circuit 14 outputs a control output signal 101, a failed processor display signal 102, and a returning processor display signal 103.

  FIG. 5 is a diagram illustrating a specific example of the return memory 11. The write instruction unit 16 in the return memory of FIG. 5 receives the write control signal 104, operates with the clock 1 (201), and outputs the write instruction signal 116 to the RAM (15) as the memory portion.

  The RAM (15) of the return memory 11 is written by the write instruction unit 16 with the same contents as the internal memory of the processor when the processor mounted on the FPGA is operating normally without a failure.

  When a failure occurs in any of the processors, the read control signal 105 has a value different from that during normal operation based on the majority decision signal 106 output from the majority circuit 14 shown in FIG. That is, when no failure occurs, the read control signal 105 is not output. However, when a failure occurs in any of the processors, the memory mismatch determination circuit 31 indicates which processor has failed and which internal memory. Whether a failure is detected by the address is received as a read control signal 105. The read instruction unit 17 in FIG. 5 receives the read control signal 105, operates with a clock 2 (202) having a faster frequency than the clock 1 (201), and outputs the read instruction signal 117 to the RAM (15). To do.

  Receiving the read instruction signal 117, the RAM (15) outputs the requested address and data information as read data 118 to the return write control unit 18. The return write control unit 18 also operates at a clock 2 (202) faster than the clock 1 (201), and outputs a return write control signal 115.

  At this time, the bus width of the return write control signal 115 is wider than the bus width of the write control signal 104.

  In FIG. 3, the return write control signal 115 output from the return memory 11 and the majority decision signal 106 output from the memory update circuit 12 are input to the memory write back circuit 13.

  In the present embodiment, the read instruction unit 17 has been described as requesting an address to be read out to the RAM (15). However, a specific address is not requested, and reading is sequentially performed from the first address of the RAM (15). It can also be made.

  FIG. 6 is a diagram showing a specific example of the memory write-back circuit 13. In the memory write-back circuit 13, there is a decoder 19 that operates at a clock 2 (202) that is faster than the clock 1 (201). The decoder 19 includes a majority decision signal 106 and a return write control signal 115. Based on the value of the write command 121, the write command indicating the write timing of the processor that needs to be written back to the internal memory of the failed processor is validated. When the processor A (2) fails, the write command A (124) of the processor A (2) is enabled, and when the processor B (3) fails, the write command B (125) of the processor B (3) is enabled. If the processor C (4) fails, the write command C (126) of the processor C (4) is validated.

  The write data 122 that is the data to be written back to each write command and the write address 123 that is the address of the internal memory to which the data is written back are output to each processor as a write-back control signal. Selects processor internal memory and writes back. The write back control signal A (107) of the processor A (2), the write back control signal B (108) of the processor B (3), and the write back control signal C (109) of the processor C (4) are input to each processor. The

  FIG. 7 shows a timing chart in which the recovery memory 11 and the internal memory of the failed processor are written in the FPGA shown in FIGS.

  The timing chart shown at the top of FIG. 7 is an example showing the write timing of the return memory 11.

  The return memory operates in synchronization with clock 1 (201), and one data phase corresponds to one address phase. For example, the data D1 written to the return memory 11 with respect to the address A1 in the cycle C1 is written in the cycle C2.

  The timing chart shown at the bottom of FIG. 7 shows the timing at which the internal memory of the processor is written while a certain processor fails and recovers.

  Here, the clock 2 (202) has a frequency twice that of the clock 1 (201), and the bus width of the return write control signal 115 is twice the bus width of the write control signal 104.

  While the failed processor is recovering, the internal memory is written in synchronization with the clock 2 (202) and the bus width is doubled. Therefore, the data D1 and D2 that are four times continuous with respect to the address A1 in the cycle C11. , D3, D4 can be written to the internal memory, and the writing is completed in cycle C13. That is, when the write start point address A1 is designated in C11, the clock 2 (202) is doubled in frequency and doubled in bus width, so that data D1, D2, D3, and D4 that are four times in total are C12, Written at C13. Next, in C14, the address written four times from A1 is advanced to specify A5, and D5, D6, D7, and D8 are written in D15 and D16. As described above, in this embodiment, while the write data to the internal memory of the processor that is operating normally is written to the return data, the failed processor overwrites the correct memory data from the return memory at high speed, thereby A normal processor can continue to operate while the processor is restored, and it is possible to realize a highly available system that does not stop the main process even if a processor in the FPGA partially fails.

  In the present embodiment, the description has been made using the FPGA. However, the feature described in the present embodiment can be applied to a control device in which processors other than the FPGA are multiplexed.

  Next, in the FPGA of the present invention, an example in which only the updated part of the internal memory of the failed processor is rewritten to restore the failed processor at high speed while continuing the system operation.

  FIG. 8 shows an example in which a circuit for writing back an updated part during restoration of the internal memory of the failed processor in the second embodiment is mounted. In the FPGA (1) of FIG. 8, a returning difference memory 20 and a difference update circuit 21 are added as compared with FIG. Further, the return write control signal 115 from the return memory 11 is input to the difference update circuit 21, and the majority decision signal 106 from the memory update circuit 12 is input to the changed memory write back circuit 27, and the memory write back circuit 27 is provided with interrupt signals 151, 152, 153 from 27 to each processor, and further, the part for exchanging the write address 132 and the updated write data 133 between the returning difference memory 20 and the return memory 11 is different. Yes.

  FIG. 9 shows a specific example of the returning difference memory 20.

  The update write address 127 input to the returning difference memory 20 indicates an address written in the internal memory of the processor that has not failed. This update write address 127 is a clock 2 (which is faster than the clock 1 (201)). The address is stored in the address FIFO (24) as the write address 130 via the update address instruction unit 22 operating in (202).

  While the internal memory of the failed processor in the FPGA is being restored, the address updated in the internal memory of the normal operating processor that has not failed is stored in the address FIFO (24).

  The update write timing signal 128 input to the returning difference memory 20 indicates the timing of requesting an update to the internal memory of the failed processor, and this update write timing signal 128 is faster than the clock 1 (201). A write address instruction signal 131 is input to the address FIFO (24) through the update write instruction unit 23 that operates at the clock 2 (202).

  Each time this write address instruction signal 131 becomes valid, the write address 132 is input from the address FIFO (24) to the update write control unit 25 operating at the clock 2 (202), and the write address 132 is input to the return memory 11. Send. When the return memory 11 receives the write address 132, it transmits the data corresponding to the address to the update write control unit 25 as the update write data 133. The update write control unit 25 receives the internal memory address and the write request. The write command, the update write data, and the update selection signal are output together as an update write control signal 129. FIG. 10 shows a specific example of the difference update circuit 21.

  The difference update circuit 21 includes a selector 26 that selects the input return write control signal 115 and the updated write control signal 129 and outputs them as a memory write back signal 141.

  The selector 26 determines the signal based on the update selection signal 134 of the update write control signal 129 output from the returning difference memory in FIG. 8. When the entire internal memory of the failed processor is restored in order, When the return write control signal 115 is selected and the recovery of the entire internal memory is completed and only the updated difference of the internal memory of the normal processor is updated during that time, the update write control signal 129 is selected and the memory write The return signal 141 is output.

  FIG. 11 shows a specific example of the changed memory write-back circuit 27 in the FPGA (1) of FIG. Compared with the memory write-back circuit 13 shown in FIG. 6, the memory write-back circuit 27 shown in FIG. 11 has the inputted return write signal 115 become the memory write-back signal 141, and the address FIFO update end determination circuit 30. And the portion provided with the interrupt signal to each processor is different.

  The memory write-back signal 141 corresponds to the return write control signal 115 in FIG. Accordingly, the write-back write command 142 corresponds to the write command 121, the write-back write data 143 corresponds to the write data 122, and the write-back write address 144 corresponds to the write address 123.

  According to the value of the update selection signal 134, the address FIFO update end determination circuit 30 makes the address FIFO (24) in the returning difference memory 20 of FIG. 9 empty and writes back to all the updated memory addresses. When it is performed, the interrupt signal A (151) is simultaneously output to the processor A (2), the interrupt signal B (152) is output to the processor B (3), and the interrupt signal C (153) is simultaneously output to the processor C (4).

  FIG. 12 shows how the internal memory of the processor in the FPGA shown in FIGS. 8 to 11 is updated. FIG. 12 shows the internal memory space of any one of the plurality of processors built in the FPGA, and the shaded area indicates the address where the data has been updated.

  FIG. 12A shows the internal memory space during normal operation in which no failure has occurred, and the order of the internal memory space to be rewritten varies depending on the program. FIG. 12A shows an example in which the parts A01, A02, and A03 are rewritten in order.

  FIG. 12B is a diagram in which a failure occurs in the processor, and only the processor is reset to update the contents of the internal memory. As shown in the embodiments so far, the internal memory update at the time of return is performed with a high speed clock and a wide bus width. In FIG. 12 (b), assuming that the return is performed at a speed four times that of the memory write operation in the normal operation, the memory area of 8 spaces is restored twice from A11 and A12 in order from the top of the memory space. An example is shown. That is, when the head addresses of A11 and A12 are designated, data for four addresses are written at a time.

  Further, FIG. 12C shows an example in the case where the restoration is completed to the end of the memory space in two times A13 and A14. Here, as shown in FIGS. 12B and 12C, the internal memory spaces of other normally operating processors are out of order even while all the areas of the internal memory space are restored. There is a possibility of rewriting, and the rewritten address is stored in the address FIFO (24) shown in FIG. From this information, the memory address to be further updated can be known, so that the memory space including the memory address to be updated is rewritten to A21, A22, and A23 at a quadruple speed as shown in FIG.

  If it is determined from the result of the address FIFO update end determination circuit 30 that the address FIFO (24) is emptied and all the internal memory spaces of the failed processor coincide with the contents of the normal processor internal memory space, the synchronization is completed. As shown in FIG. 12E, the process returns to normal processing again and the memory space is rewritten according to the program.

  By doing this, the contents of the internal memory space of the failed processor are synchronized with the contents of other processors even if the internal memory contents of the processor that is operating normally are rewritten while the internal memory space of the failed processor is restored. It becomes possible to make it.

  FIG. 13 shows an example of a processing chart of the processor A (2), the processor B (3), and the processor C (4) in the FPGA (1) shown in FIG.

  The processor A (2), the processor B (3), and the processor C (4) are the same circuit, and execute the same normal process 1 (S01) while no failure occurs.

  When a temporary failure such as a soft error occurs in the processor C (4), the processor A (2) and the processor B (3) continue the normal processing 1 (S01), and the value of the internal memory is also necessary during the processing. Updated.

  On the other hand, the processor C (4) in which the temporary failure has occurred shifts to the return process S02 and updates the entire area of the internal memory C (8) in the processor C (4) with the contents of the shared memory 11.

  After the completion of the return process S02, the difference process for writing back the part updated in the internal memory of the processor A (2) and the processor B (3) to the internal memory C (8) of the processor C (4) during the return process S02. S03 is executed.

  When the difference processing is completed and the contents of the internal memory C (8) of the processor C (4) match the contents of the internal memories of the processor A (2) and the processor B (3), the processor A (2) and the processor B ( 3) The interrupt process S04 enters the processor C (4) at the same time, and all the contents including the internal registers in each processor become the same among the three processors, and the subsequent normal process 2 (S05) is executed.

  Since this interrupt processing S04 can be realized only by a branch interrupt prepared in advance in the processor, the system does not need to interrupt normal processing.

  In this embodiment, the example in which the internal memory in the processor is updated has been described. However, a circuit that similarly updates a register file including the memory may be added and mounted.

  By implementing the FPGA and the processor according to the present invention, even if a temporary failure occurs in the processor, the failed processor is returned to the multiplexed state without interrupting the system processing and multiplexed. Can be reconfigured.

  Next, in the FPGA of the present invention, an example in the case of recovery when a permanent failure occurs in the processor will be shown.

  FIG. 14 is a diagram illustrating an example of assigning a failed processor in a partially reconfigurable FPGA to another area in the FPGA according to the third embodiment. The FPGA (1) in FIG. 14 is an SRAM type and can be partially reconfigured, and is implemented with a circuit as shown in FIG. 8, but the FPGA operates when performing logic synthesis on the processor built in the FPGA. This is implemented by specifying the same processor circuit so that it can be assigned to another area.

  In the FPGA (1) of FIG. 14, when the processor C (4) is mounted, an example is shown in which the same circuit is allocated in the FPGA by the configuration so that the processor D (5) can be mounted.

  When a permanent failure that cannot be recovered occurs in the processor C (4) of FIG. 14, the processor D (5) is dynamically allocated in the FPGA and the memory write-back circuit 27 The write-back control signal C (109) is input to the processor D (5), the memory write signal D (114) is assigned from the processor D (5), and the memory update circuit 12 is substituted for the memory write signal C (113). Enter and reconfigure.

  An example of a processing chart by reconfiguration of the processor in the FPGA is shown in FIG.

  In FIG. 15, processor A (2), processor B (3), and processor C (4) execute normal processing 1 (S11) as in FIG. 13 when no failure has occurred.

  When a permanent failure occurs in the processor C (4), the processor C (4) executes the recovery process S12 to restart the processor, and tries to restore the contents of the internal memory C (8).

  However, even if recovery is attempted a plurality of times, if a failure has occurred with the majority decision signal from the majority decision circuit, it is determined that the failure is permanent, and a new area in the FPGA is used instead of the processor C (4). The processor D (5) is configured, and the return process S13 is performed to update the entire area of the internal memory D (9) in the processor D (5) with the contents of the shared memory 11. An area for constructing the processor D is secured in the FPGA.

  After completion of the return process S13, the portion updated in the internal memory of the processor A (2) and the processor B (3) during the return process S12 and the return process S13 is stored in the internal memory D (9) of the processor D (5). The difference process S03 for writing back is executed.

  When the difference processing is completed and the contents of the internal memory D (9) of the processor D (5) match the contents of the internal memories of the processor A (2) and the processor B (3), the processor A (2) and the processor B ( 3) The interrupt process S15 enters the processor D (5) at the same time, and all the contents including the internal register in each processor become the same among the three processors, and the subsequent normal process 2 (S16) is executed.

  In this example, the processor C (4) fails and is reconfigured in another area. However, the processor A (2) and the processor B (3) may fail and be reconfigured. In addition, a reconstruction area may be allocated in advance to a plurality of processors.

  As a result, by using a reconfigurable FPGA, even if a permanent failure occurs in any of a plurality of processors configured in the FPGA, the memory contents of the reconfigured processor in another area are stored. Can be matched with the memory contents of another operating processor, and it is possible to reconfigure the multiplexing by returning the failed processor while continuing the processing without interrupting the processing of the system. .

  FIG. 16 shows an example when the present invention is applied to an industrial control system using a control device having an FPGA of the present invention.

  The industrial control system in FIG. 16 controls the substation equipment 304. An instruction from the control terminal 301 is transmitted to the control device 302, and the instruction is transmitted from the internal FPGA (1) via the I / O device 303 to control the substation equipment.

  If a failure occurs in a part of the FPGA (1) that processes the instruction from the control terminal 301 and is transmitted to the substation equipment 304, the substation equipment may not operate normally and serious damage may occur.

  Therefore, in the FPGA (1), as shown in the present invention, the processor A (2), the processor B (3), and the processor C (4) are multiplexed so that a failure occurs in a part of the processor. However, it is possible to restore the failed processor and reconfigure multiplexing while continuing to operate with a normal processor.

Thereby, the availability of the substation equipment is increased, and maintenance and the like can be performed while the substation equipment is operating.
Thus, by applying the FPGA of the present invention, it becomes possible to realize a system with high reliability and high availability in an industrial control system or the like.

In addition, this invention is not limited to an above-described Example, Various modifications are included. For example, the above-described embodiments have been described in detail for easy understanding of the present invention, and are not necessarily limited to those having all the configurations described. Further, a part of the configuration of one embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of one embodiment. Further, it is possible to add, delete, and replace other configurations for a part of the configuration of each embodiment.

1 Field programmable gate array (FPGA)
2, 3, 4, 5 Processor 6, 7, 8, 9 Internal memory
10, 14 Majority decision circuit 11 Memory for restoration 12 Memory update circuit 13, 27 Memory write-back circuit 15 RAM
20 difference memory 21 during restoration difference update circuit 301 control terminal 302 control device 303 I / O device 304 substation

Claims (11)

A plurality of processors each including an internal memory and each executing and outputting a process of the same content;
A memory update circuit that detects an error of at least one processor from outputs of the plurality of processors and outputs a determination signal indicating which processor has caused the error; and
A memory write-back circuit that selects an internal memory of a processor in which an error has occurred when receiving the determination signal, writes back the contents of the internal memory of another normal processor to the internal memory, and recovers from the error; Programmable gate array. The field programmable gate array of claim 1,
A return memory in which data similar to the internal memory of the plurality of processors is written by a control signal from the memory update circuit;
The field programmable gate array according to claim 1, wherein the memory write-back circuit writes the predetermined data read from the return memory back to the internal memory of the processor in which the error has occurred and performs a return process. The field programmable gate array of claim 2,
A first clock for operating the plurality of processors;
A second clock for operating reading of data from the return memory and write back by the memory write back circuit,
The field programmable gate array, wherein the second clock operates at a higher frequency than the first clock. The field programmable gate array of claim 2,
A first bus through which the output from the processor to the memory update circuit is sent;
A second bus to which output from the memory update circuit to the return memory is sent; and a third bus to which output from the return memory to the memory write back circuit is sent;
A fourth bus to which the output from the memory write-back circuit to the processor is sent;
The field programmable gate array according to claim 1, wherein the third bus or the fourth bus has a bus width wider than that of the first bus or the second bus. The field programmable gate array of claim 1,
Multiplexed by at least three processors,
The field updateable gate array, wherein the memory update circuit detects an error by determining a majority of outputs of the at least three processors and determines which processor has an error. The field programmable gate array of claim 1,
The field-programmable gate array, wherein the memory write-back circuit updates the entire internal memory of the processor in which the error has occurred to match the contents with the internal memory of the normal processor. The field programmable gate array of claim 2,
A difference memory during return for storing the address of the internal memory updated by continuous operation of the normal processor during the return process;
A difference update circuit that selects data updated during the return process based on an address indicated by the difference memory during return and issues a write-back instruction to the internal memory of the processor in which the error has occurred; and
A field programmable gate array comprising: The field programmable gate array of claim 7,
The differential update circuit, after the predetermined data is written back by the memory write-back circuit, further selects the data updated during the return processing, and writes back to the internal memory of the processor in which the error has occurred And
When the memory write-back circuit confirms that the contents of the internal memories of the plurality of processors match, the memory write-back circuit generates an interrupt process for the plurality of processors, matches the states of the plurality of processors, and continues the operation. A field programmable gate array characterized by the above. The field programmable gate array of claim 1,
When an error occurs in at least one of the plurality of processors, the same circuit as the processor in which the error has occurred is reconfigured and connected to a pre-assigned area in a field programmable gate array. Field programmable gate array. A plurality of processors each including an internal memory and each executing and outputting a process of the same content;
A memory update circuit that detects an error of at least one processor from outputs of the plurality of processors and outputs a determination signal indicating which processor has caused the error; and
A memory write-back circuit that, when receiving the determination signal, selects an internal memory of a processor in which an error has occurred, writes back the contents of the internal memory of another normal processor to the internal memory, and recovers from the error apparatus. In a control device for controlling equipment using a field programmable gate array multiplexed by a plurality of processors having an internal memory,
The field programmable gate array is:
A memory update circuit that detects an error of at least one processor from outputs of the plurality of processors and outputs a determination signal indicating which processor has caused the error; and
A memory write-back circuit that receives the determination signal and writes back the contents of the internal memory of another normal processor to the internal memory of the processor in which the error has occurred, and recovers from the error,
The control device is characterized in that the normal processor continues to operate during the return processing of the processor in which the error has occurred.

Images