WO2018154664A1

WO2018154664A1 - Control device and control method

Info

Publication number: WO2018154664A1
Application number: PCT/JP2017/006660
Authority: WO
Inventors: 寿和加藤; 努元濱; 亮岡部
Original assignee: 三菱電機株式会社
Priority date: 2017-02-22
Filing date: 2017-02-22
Publication date: 2018-08-30
Also published as: JPWO2018154664A1; JP6271103B1

Abstract

An input exclusion unit (212) inputs a preset input value to a plurality of subsystems that are configured to have redundancy, if two or more of these subsystems produce different output values, wherein a correct output value associated with the preset input value is already known. A failure determination control unit (251) acquires a plurality of output values produced by the plurality of subsystems when the preset input value is input to the plurality of subsystems, and compares each of the acquired plurality of output values with the known correct output value associated with the preset input value.

Description

Control apparatus and control method

The present invention relates to a redundant system.

In systems that require high reliability, such as in-vehicle control devices, if a computing system (such as a microcomputer) is duplicated and one of the computing systems fails, computation is performed only with the other normal computing system. The technology that continues is used. In such a duplex system, a function for performing failure diagnosis is essential to determine a failed arithmetic system. In particular, in the case of a method in which the same program is always operated on both computing systems to check whether the outputs from both computing systems match, which computing system failed when an output mismatch occurred? It is necessary to determine

For example, Patent Document 1 discloses a method in which a normal computing system can be selected by majority voting theory even when the outputs of duplicated computing systems do not match. Specifically, in the method of Patent Document 1, a calculation model for realizing a transfer function model from the input to the output of the arithmetic system by a program is added. And in the method of patent document 1, even if a failure occurs in one of the arithmetic systems and the outputs do not match, a normal arithmetic system is selected by the majority theory using the pseudo output output from the calculation model. be able to.
Patent Document 2 discloses a configuration in which each of the duplicated arithmetic systems has a self-diagnosis function. In the configuration of Patent Document 2, one arithmetic system operates as an actual control system, and the other arithmetic system operates as a system that performs self-diagnosis. In the configuration of Patent Document 2, the arithmetic system that operates as an actual control system and the arithmetic system that operates as a system that performs self-diagnosis are alternately switched, thereby realizing a continuous operation and an arithmetic system that has failed. It is possible to detect.

JP 2006-228002 A International publication WO2011 / 074147

In the method of Patent Document 1, it is necessary to model a duplex system including not only software but also hardware. For this reason, in the method of Patent Document 1, the scale of the calculation model becomes larger as the hardware configuration of the duplexed system becomes more complicated. Therefore, in order to execute a program for realizing a calculation model, there is a problem that hardware (such as a microcomputer) having higher performance than a duplex system is required.
In the method of Patent Document 2, one arithmetic system operates as an actual control system, and the other arithmetic system operates as a system that performs self-diagnosis. For this reason, in the method of Patent Document 2, the same program is always operated in both arithmetic systems, and it cannot be confirmed whether or not the outputs of both arithmetic systems match. Moreover, in the method of patent document 2, an arithmetic system performs a self-diagnosis. For this reason, the method of Patent Document 2 has a problem that when the hardware of the arithmetic system fails, the self-diagnosis function is also affected, so that a correct diagnosis cannot be performed and high reliability cannot be guaranteed.

The main object of the present invention is to solve the above problems. More specifically, the present invention determines a normal arithmetic system with a simple hardware configuration in a method for determining whether or not a plurality of output values from a plurality of redundant arithmetic systems match. The main purpose is to make it possible.

The control device according to the present invention includes:
An input management unit for inputting a preset input value with a known correct output value to the plurality of operation systems when a plurality of output values from the plurality of operation systems that are made redundant do not match;
A comparator that acquires a plurality of output values from the plurality of arithmetic systems for the preset input value and compares each of the acquired output values with the correct output value for the preset input value;

According to the present invention, in a method for determining whether or not a plurality of output values from a plurality of redundant computing systems match, a normal computing system is reliably determined with a simple hardware configuration. Can do.

FIG. 3 is a diagram illustrating a hardware configuration example of a control device according to the first embodiment. FIG. 3 is a diagram illustrating a functional configuration example of a control device according to the first embodiment. 6 is a flowchart illustrating an operation example of the control device when the operation mode according to the first embodiment is a normal mode. 5 is a flowchart illustrating an operation example of an input exclusion unit according to the first embodiment. 5 is a flowchart showing an operation example of a failure determination activation unit according to the first embodiment. 5 is a flowchart illustrating an operation example of a failure determination control unit according to the first embodiment. FIG. 4 is a diagram illustrating a functional configuration example of a control device according to a second embodiment. 9 is a flowchart illustrating an operation example of a data collection unit according to the second embodiment.

Hereinafter, embodiments of the present invention will be described with reference to the drawings. In the following description of the embodiments and drawings, the same reference numerals denote the same or corresponding parts.

Embodiment 1 FIG.
In this embodiment, a combination of an input value and a correct output value for the input value is prepared in advance. An input value with a known correct output value prepared in advance will be referred to as a preset input value hereinafter. In this embodiment, when the output values of a plurality of redundant computing systems do not match, a preset input value is input to each computing system. Further, in the present embodiment, the output value from each arithmetic system is compared with the correct output value for the preset input value. As a result, it is possible to determine that the arithmetic system that has output the same output value as the correct output value is the correct arithmetic system.
In the following, as an example of a redundant arithmetic system, a redundant arithmetic system will be described. That is, a configuration in which two arithmetic systems that perform the same arithmetic processing exist will be described.

*** Explanation of configuration ***
FIG. 1 shows a hardware configuration example of the control device 100 according to the first embodiment.
As shown in FIG. 1, the control device 100 has an input synchronous FPGA (Field-Programmable Gate Array) 110, a microcomputer A 120, a microcomputer B 130, and an output verification FPGA 140. The control device 100 is duplicated by a microcomputer A120 and a microcomputer B130.
Note that the processing performed by the control device 100 corresponds to a control method.

The input synchronous FPGA 110 is connected using a plurality of external devices A150 (only one is shown in FIG. 1), CAN (Controller Area Network), SPI (Serial Peripheral Interface), and the like. The input synchronous FPGA 110 receives the input value transmitted from the external device A150, and transmits the input value to the microcomputer A120 and the microcomputer B130 at the same timing.

The microcomputer A120 is hardware for performing main control processing of the control device 100. The microcomputer A120 includes a CPU (Central Processing Unit) 121, a memory 122, an I / O (Input / Output) device 123, and a CAN I / O device 124.
The microcomputer A120 is connected to the input synchronous FPGA 110 and the output verification FPGA 140 using CAN, SPI, or the like. In FIG. 1, since it is assumed that the microcomputer A120 is connected to the input synchronous FPGA 110 and the output verification FPGA 140 by CAN, the CAN I / F 124 is arranged.
The microcomputer B130 is hardware for duplicating the system realized by the microcomputer A120. The internal configuration of the microcomputer B130 is the same as that of the microcomputer A120. For this reason, illustration of the internal configuration of the microcomputer B130 is omitted.

The output verification FPGA 140 is connected to a plurality of external devices B 160 (only one is shown in FIG. 1) using CAN, SPI, or the like. The output verification FPGA 140 compares the output value transmitted from the microcomputer A120 with the output value transmitted from the microcomputer B130. Then, the output verification FPGA 140 transmits one of the output values to the external device B 160 when the two output values match.
Further, the input synchronous FPGA 110 and the output verification FPGA 140 are connected using CAN, SPI, or the like in order to connect an input exclusion unit 212 and a failure determination control unit 251 in FIG.

FIG. 2 shows a functional configuration example of the control device 100 according to the present embodiment. In FIG. 2, solid arrows indicate input values (normal input values and preset input values) or output values. Dashed arrows represent information other than input values and output values.
In FIG. 2, the control device 100 includes an input unit 210, a subsystem A 220, a subsystem B 230, an output verification unit 240, and a failure determination unit 250.

The input unit 210 operates with the input synchronous FPGA 110. The input unit 210 includes an input synchronization unit 211, an input exclusion unit 212, and a failure determination operation state storage unit 213.

The input synchronization unit 211 receives the normal input value transmitted from the external device A 150, synchronizes the timing with the input exclusion unit 212, and transmits the received normal input value to the input exclusion unit 212. The input synchronization unit 211 repeatedly receives normal input values from the external device A 150 and repeatedly transmits normal input values to the input exclusion unit 212.

The input exclusion unit 212 receives a normal input value from the input synchronization unit 211 when the operation mode is the normal mode. Further, the input exclusion unit 212 receives the preset input value from the failure determination control unit 251 when the operation mode is the failure determination mode. The input exclusion unit 212 inputs a normal input value from the input synchronization unit 211 or a preset input value from the failure determination control unit 251 to the subsystem A 220 and the subsystem B 230.
The normal mode is an operation mode of the control device 100 while the output value from the subsystem A 220 and the output value from the subsystem B 230 coincide with each other. In the failure determination mode, the output value from the subsystem A 220 and the output value from the subsystem B 230 do not coincide with each other, and the normally operating subsystem (hereinafter referred to as a normal subsystem) is determined. It is an operation mode of the control device 100 in between. In the failure determination mode, a procedure for determining which one of the subsystem A 220 and the subsystem B 230 is operating normally is performed. A degenerate mode, which will be described later, is an operation mode of the control device 100 after a normal subsystem is found.
The operation modes related to the input exclusion unit 212 are only the normal mode and the failure determination mode. That is, the input exclusion unit 212 switches the operation mode between the normal mode and the failure determination mode. The operation mode is switched when the input exclusion unit 212 sets a value corresponding to the current operation mode in operation mode information stored in a failure determination operation state storage unit 213 described later.
When the output value from the subsystem A 220 does not match the output value from the subsystem B 230, the input exclusion unit 212 receives the failure determination mode setting request from the failure determination control unit 251, and sets the operation mode to the failure determination mode. Set to. The failure mode setting request is a message that the failure determination control unit 251 requests the input exclusion unit 212 to set the operation mode to the failure determination mode. Further, after the normal subsystem is determined, the input exclusion unit 212 receives a normal mode setting request from the failure determination control unit 251 and sets the operation mode to the normal mode. The normal mode setting request is a message that the failure determination control unit 251 requests the input exclusion unit 212 to set the operation mode to the normal mode.
The input exclusion unit 212 corresponds to an input management unit.

The failure determination operation state storage unit 213 stores operation mode information. The operation mode information is control information indicating the current operation mode of the control device 100. Specifically, the operation mode information stored in the failure determination operation state storage unit 213 indicates a value indicating the normal mode or a value indicating the failure determination mode.

Subsystem A220 and Subsystem B230 are duplexed systems. The same program is installed in the subsystem A220 and the subsystem B230. Then, subsystem A 220 and subsystem B 230 receive the same input value, perform arithmetic processing on the received input value, and each output an output value. The subsystem A220 operates with the microcomputer A120, and the subsystem B230 operates with the microcomputer B130. Subsystem A220 and subsystem B230 each correspond to a computing system.

The output verification unit 240 operates with the output verification FPGA 140. The output collation unit 240 includes an output collation control unit 241, a failure determination activation unit 242, and a degenerate mode operation state storage unit 243.

When the operation mode of the control device 100 is the normal mode, the output collation control unit 241 compares the output values transmitted from the subsystem A 220 and the subsystem B 230. When the two output values match, the output collation control unit 241 transmits one of the output values to the failure determination activation unit 242. On the other hand, if the two output values do not match, the output collation control unit 241 does not transmit any output value to the failure determination activation unit 242.
Further, when the operation mode of the control device 100 is the failure determination mode, the output collation control unit 241 discards the output values transmitted from the subsystem A 220 and the subsystem B 230 without comparing them.
Further, when the operation mode of the control device 100 is the degenerate mode, the output collation control unit 241 selects the output value of the normal subsystem and outputs the selected output value to the failure determination activation unit 242.
The output collation control unit 241 can determine which operation mode the control device 100 is in by receiving the current operation mode information from the failure determination activation unit 242. Further, the output verification control unit 241 can select the output value of the normal subsystem by being notified of the normal subsystem from the failure determination activation unit 242.

If the operation mode of the control device 100 is the normal mode, the failure determination activation unit 242 determines whether to perform failure determination according to the comparison result of the output collation control unit 241. Specifically, when the comparison result of the output collation control unit 241 notifies that the output value of the subsystem A 220 matches the output value of the subsystem B 230, the failure determination activation unit 242 It is determined not to perform the determination, and the output value transmitted from the output collation control unit 241 is transmitted to the external device B160. When the comparison result of the output collation control unit 241 notifies that the output value of the subsystem A220 and the output value of the subsystem B230 do not match, the failure determination activation unit 242 performs the failure determination. decide. When performing failure determination, the failure determination activation unit 242 activates the failure determination control unit 251. Moreover, the failure determination activation unit 242 sets the operation mode to the failure determination mode. Furthermore, the failure determination activation unit 242 notifies the output collation control unit 241 that the operation mode has shifted to the failure determination mode.
Further, the failure determination activation unit 242 is notified of the normal subsystem from the failure determination control unit 251. When the normal subsystem is notified, the failure determination activation unit 242 sets the operation mode to the degenerate mode. Further, the failure determination activation unit 242 notifies the output verification control unit 241 of the normal subsystem. Further, the failure determination activation unit 242 outputs the output value received from the output collation control unit 241 to the external device B 160 after the operation mode shifts to the degenerate mode.
Switching of the operation mode is performed when the failure determination activation unit 242 sets a value corresponding to the current operation mode in the operation mode information stored in the degenerate mode operation state storage unit 243 described later.
The failure determination activation unit 242 can determine which operation mode the control device 100 is in by referring to the operation mode information in the degenerate mode operation state storage unit 243.
The failure determination activation unit 242 corresponds to an output management unit.

The degenerate mode operation state storage unit 243 stores operation mode information. The operation mode information stored in the degenerate mode operation state storage unit 243 indicates a value representing the normal mode, a value representing the failure determination mode, or a value representing the degenerate mode.

The failure determination unit 250 operates in the output verification FPGA 140.
The failure determination unit 250 includes a failure determination control unit 251, a preset input value storage unit 252, and a retry count storage unit 253.

The failure determination control unit 251 is activated by the failure determination activation unit 242. When activated, the failure determination control unit 251 transmits a failure determination mode setting request to the input exclusion unit 212. In addition, the failure determination control unit 251 reads a set of preset input values and output values from the preset input value storage unit 252. Then, the failure determination control unit 251 transmits the preset input value to the input exclusion unit 212. When the subsystem A 220 and the subsystem B 230 perform an operation on the preset input value and an output value that is the operation result is output, the output value of the subsystem A 220 and the output value of the subsystem B 230 are set correctly. Compare with output value. Then, the failure determination control unit 251 determines that the subsystem that has output an output value that matches the correct output value is a normal subsystem. In addition, the failure determination control unit 251 notifies the failure determination activation unit 242 of the normal subsystem.
If the normal subsystem cannot be determined even if the output value from the subsystem A 220 and the output value from the subsystem B 230 with respect to the preset input value are compared with the correct output value, the preset input value is repeatedly transmitted to the input exclusion unit 212. . That is, if the number of retries has not reached the upper limit value, the failure determination control unit 251 reads another preset input value and output value pair from the preset input value storage unit 252, and uses the read preset input value as the input exclusion unit 212. Send to. The failure determination control unit 251 determines that the output value from the subsystem A220 and the output value from the subsystem B230 both match the correct output value, or the output value from the subsystem A220 and the output value from the subsystem B230. If neither of them matches the correct output value, the normal subsystem cannot be determined.
The number of retries is stored in the retry number storage unit 253. When the number of retries reaches the upper limit value, the failure determination control unit 251 notifies the failure determination activation unit 242 that failure determination has failed.
It is desirable that the preset input value be a value that can be calculated using as much hardware as possible. By doing in this way, early failure determination becomes possible.
The failure determination control unit 251 corresponds to a comparison unit.

Here, the failure determination unit 250 is realized by the output verification FPGA 140, but the failure determination unit 250 can also be realized by using a low-cost small-scale microcomputer.

*** Explanation of operation ***
Next, an operation example of the control device 100 when the operation mode is the normal mode will be described with reference to FIG.

First, the input synchronization unit 211 receives a normal input value from the external device A150 (step S101).

Next, the input synchronization unit 211 transmits a normal input value to the input exclusion unit 212 (step S102). Since the operation mode is the normal mode, the input exclusion unit 212 transmits the normal input value from the input synchronization unit 211 to the subsystem A 220 and the subsystem B 230 (step S102).

Subsystem A220 and Subsystem B230 each perform a calculation using a normal input value, and transmit an output value that is a calculation result (step S103).

Next, the output collation control unit 241 compares the output value of the subsystem A220 and the output value of the subsystem B230, and transmits the comparison result to the failure determination activation unit 242 (step S104).
When the output value of the subsystem A220 matches the output value of the subsystem B230, the output collation control unit 241 compares the comparison result for notifying that the two output values match and the output of the subsystem A220. One of the value and the output value of the subsystem B 230 is transmitted to the failure determination activation unit 242.
When the output value of the subsystem A 220 and the output value of the subsystem B 230 do not match, the output collation control unit 241 sends a comparison result for notifying that the two output values do not match to the failure determination activation unit 242. Output. In this case, the output collation control unit 241 transmits neither the output value of the subsystem A 220 nor the output value of the subsystem B 230 to the failure determination activation unit 242.

The failure determination activation unit 242 refers to the comparison result of the output collation control unit 241, and determines whether or not failure determination is performed (step S105). Specifically, when the comparison result of the output collation control unit 241 notifies that the output value of the subsystem A 220 matches the output value of the subsystem B 230, the failure determination activation unit 242 Decide not to make a decision. Then, the failure determination activation unit 242 transmits the output value transmitted from the output collation control unit 241 to the external device B160. When the comparison result of the output collation control unit 241 notifies that the output value of the subsystem A 220 and the output value of the subsystem B 230 match, the failure determination activation unit 242 performs the failure determination. decide.

Next, operation examples of the input exclusion unit 212, the failure determination activation unit 242, and the failure determination control unit 251 will be described.
FIG. 4 shows an operation example of the input exclusion unit 212. FIG. 5 shows an operation example of the failure determination activation unit 242. FIG. 6 shows an operation example of the failure determination control unit 251. Note that the order and means of processing may be different as long as the effect obtained by the series of processing does not change.

First, an operation example of the input exclusion unit 212 will be described with reference to FIG.

4 is started when the input exclusion unit 212 receives one of a normal input value, a preset input value, a failure determination mode setting request, and a normal mode setting request.

The input exclusion unit 212 determines whether the received data is an input value (normal input value or preset input value) or a mode setting request (normal mode setting request or failure determination mode setting request) (step S201). . In the case of receiving an input value, the process proceeds to step S202. In the case of receiving a mode setting request, the process proceeds to step S208.

In the case of receiving an input value, the input exclusion unit 212 determines whether the received input value is a normal input value or a preset input value (step S202). If the received input value is a normal input value, the process proceeds to step S203. On the other hand, if the received input value is a preset input value, the process proceeds to step S206.

If the received input value is a normal input value from the input synchronization unit 211, the input exclusion unit 212 determines whether or not the current operation mode is the failure determination mode (step S203). Specifically, the input exclusion unit 212 refers to the operation mode information in the failure determination operation state storage unit 213 and determines whether or not the current operation mode is the failure determination mode.
If the current operation mode is not the failure determination mode, the process proceeds to step S204. On the other hand, if the current operation mode is the failure determination mode, the process proceeds to step S205.

When the current operation mode is not the failure determination mode, since the current operation mode is the normal mode, the input exclusion unit 212 transmits the received input value to both the subsystem A 220 and the subsystem B 230 (step S204). .
On the other hand, when the current operation mode is the failure determination mode, the input exclusion unit 212 discards the normal input value received from the input synchronization unit 211 (step S205).

In step S202, if the received input value is a preset input value from the failure determination control unit 251, then the input exclusion unit 212 determines whether or not the current operation mode is the failure determination mode ( Step S206). Specifically, the input exclusion unit 212 refers to the operation mode information in the failure determination operation state storage unit 213 and determines whether or not the current operation mode is the failure determination mode.
If the current operation mode is not the failure determination mode, the process proceeds to step S205. On the other hand, when the current operation mode is the failure determination mode, the process proceeds to step S207.

When the current operation mode is not the failure determination mode, since the current operation mode is the normal mode, the input exclusion unit 212 discards the preset input value received from the failure determination control unit 251 (step S205).
On the other hand, when the current operation mode is the failure determination mode, the input exclusion unit 212 transmits the received preset input value to both the subsystem A 220 and the subsystem B 230 (step S207).

In step S201, when the mode setting request is received, the operation mode is set to the failure determination mode or the normal mode (step S208). That is, when receiving a failure determination mode setting request, the input exclusion unit 212 sets the operation mode to the failure determination mode. When receiving the normal mode setting request, the input exclusion unit 212 sets the operation mode to the normal mode.

Next, an operation example of the failure determination activation unit 242 will be described with reference to FIG.

5 is started when the failure determination activation unit 242 receives the output value comparison result from the output collation control unit 241.

When the failure determination activation unit 242 receives the comparison result from the output collation control unit 241, it determines whether or not the current operation mode is the degeneration mode (step S301). More specifically, the failure determination activation unit 242 refers to the operation mode information in the degeneration mode operation state storage unit 243 and determines whether or not the current operation mode is the degeneration mode. If the current operation mode is not the degeneration mode, the process proceeds to step S302. If the current operation mode is the degeneration mode, the process proceeds to step S307.

When the current operation mode is not the degeneration mode, the failure determination activation unit 242 determines whether or not the comparison result transmitted from the output verification control unit 241 indicates that the two output values match ( Step S302). If the comparison result indicates that the two output results match, the process proceeds to step S303. If the comparison result indicates that the two output results do not match, the process proceeds to step S304.

If the comparison result indicates that the two output results match, the failure determination activation unit 242 transmits the output value received from the output collation control unit 241 to the external device B160 (step S303).

On the other hand, when the comparison result indicates that the two output results do not match, the failure determination activation unit 242 activates the failure determination control unit 251 in order to perform the failure determination (step S304). More specifically, the failure determination activation unit 242 transmits an activation request to the failure determination control unit 251. Further, the operation mode is set to the failure determination mode (step S304). More specifically, the failure determination activation unit 242 updates the operation mode information in the degenerate mode operation state storage unit 243 to a value indicating the failure determination mode. Furthermore, the failure determination activation unit 242 notifies the output collation control unit 241 that the operation mode has shifted to the failure determination mode. With this notification, thereafter, the output collation control unit 241 does not transmit the output value from any subsystem to the failure determination activation unit 242.

Next, the failure determination activation unit 242 waits for the determination result from the failure determination control unit 251 (step S305), and when the normal subsystem is notified as the determination result of the failure determination control unit 251, the operation of the control device 100 is performed. The mode is shifted to the degenerate mode (step S306). More specifically, the failure determination activation unit 242 updates the operation mode information in the degeneration mode operation state storage unit 243 to a value indicating the degeneration mode. Moreover, the failure determination activation unit 242 notifies the output verification control unit 241 of the normal subsystem. With this notification, the output collation control unit 241 transmits the output value from the normal subsystem to the failure determination activation unit 242 thereafter.

In step S301, when the current operation mode is the degeneration mode, the output value of the normal subsystem received from the output collation control unit 241 is transmitted to the external device B160 (step S307).

Next, an operation example of the failure determination control unit 251 will be described with reference to FIG.

6 is started when the failure determination control unit 251 receives an activation request from the failure determination activation unit 242.

Upon receiving the activation request, the failure determination control unit 251 requests the input exclusion unit 212 to set the operation mode to the failure determination mode (step S401). More specifically, the failure determination control unit 251 transmits a failure determination mode setting request to the input exclusion unit 212.

Next, the failure determination control unit 251 acquires a set of preset input values and output values from the preset input value storage unit 252 (step S402). Then, the failure determination control unit 251 transmits the acquired preset input value to the input exclusion unit 212 (step S403).
Thereafter, it waits for reception of an output value from each subsystem (step S404).

When receiving the output value from each subsystem, the failure determination control unit 251 compares the two received output values with the correct output value of the preset input value (step S405).

Next, the failure determination control unit 251 determines whether there is only one output value that matches the correct output value (step S406). As a result of the determination, if there is only one output value that matches the correct output value, the failure determination is successful. That is, the failure determination control unit 251 treats a subsystem that has transmitted an output value that matches a correct output value as a normal subsystem. In this case, the process proceeds to step S407. If there is not one output value that matches the correct output value (if two output values match the correct output value, neither output value matches the correct output value), the failure determination has failed. . In this case, the process proceeds to step S409.

If there is only one output value that matches the correct output value, the failure determination control unit 251 requests the input exclusion unit 212 to set the operation mode to the normal mode (step S407). More specifically, the failure determination control unit 251 transmits a normal mode setting request to the input exclusion unit 212.
In addition, the failure determination control unit 251 notifies the failure determination activation unit 242 of the subsystem recognized as a normal subsystem (step S408).

If there is not one output value that matches the correct output value, the failure determination control unit 251 performs a failure determination retry. Specifically, the failure determination control unit 251 updates the number of retries stored in the retry number storage unit 253 (step S409), and determines whether or not the number of retries has reached an upper limit (step S410). . If the number of retries has reached the upper limit, the process proceeds to step S411. On the other hand, if the number of retries has not reached the upper limit, the process transitions to step S402. Then, the failure determination control unit 251 performs the processing sequence from step S402 again.

When the number of retries reaches the upper limit value, the failure determination control unit 251 notifies the failure determination activation unit 242 of determination failure (step S411).

*** Explanation of the effect of the embodiment ***
As described above, in this embodiment, when the output values from the subsystems do not match, the failure determination control unit 251 gives the preset input values to the subsystems, and uses the preset input values. To each subsystem. Then, the failure determination control unit 251 compares the output value from each subsystem with the known output value to determine the subsystem that is operating normally. For this reason, in this embodiment, the high-performance hardware for executing the program for realizing the calculation model disclosed in Patent Document 1 is not necessary, and it operates normally only by adding simple hardware. The subsystem to be determined can be determined. In addition, since the failure determination control unit 251 that is a mechanism different from the subsystem that executes the calculation performs the failure determination, it is possible to reliably determine the subsystem that operates normally.

In the above, a redundant arithmetic system has been described as an example of a redundant arithmetic system. However, the technique described in the present embodiment is also applicable to a redundant system with a redundancy higher than triple. Is possible. For example, in a tripled configuration such as subsystem A, subsystem B, and subsystem C, when all the output values of the subsystems do not match, the failure determination control unit 251 sets the preset input values to subsystem A, A normal subsystem can be determined by giving to each of subsystem B and subsystem C.

Embodiment 2. FIG.
In the present embodiment, an example in which normal input values to the subsystem A 220 and the subsystem B 230 are used as preset input values when the output value from the subsystem A 220 matches the output value from the subsystem B 230 will be described. .
In the present embodiment, differences from the first embodiment will be mainly described.
Note that matters not described below are the same as those in the first embodiment.

*** Explanation of configuration ***
The hardware configuration example of the control device 100 according to the second embodiment is the same as the configuration shown in FIG. For this reason, description of the hardware structural example of the control apparatus 100 which concerns on this Embodiment is abbreviate | omitted.

FIG. 7 shows a functional configuration example of the control device 100 according to the second embodiment.
In FIG. 7, a data collection unit 254 is added as compared to the configuration of FIG. The components other than the data collection unit 254 are the same as those shown in FIG. For this reason, description of components other than the data collection unit 254 is omitted. The data collection unit 254 operates on the output verification FPGA 140. The data collection unit 254 corresponds to a designation unit.
In FIG. 7, the notation of the input synchronous FPGA 110, the microcomputer A120, the microcomputer B130, and the output verification FPGA 140 shown in FIG.

The data collection unit 254 collects normal input values input from the input exclusion unit 212 to the subsystem A 220 and the subsystem B 230. When the output collation control unit 241 notifies that the output value of the subsystem A 220 for the normal input value matches the output value of the subsystem for the normal input value, the data collection unit 254 Specify collected normal input values as preset input values. In addition, the data collection unit 254 specifies the output value for the normal input value specified as the preset input value as the correct output value for the preset input value. More specifically, the data collection unit 254 stores the normal input value in the preset input value storage unit 252, thereby designating the normal input value as the preset input value. Further, the data collection unit 254 stores the output value corresponding to the normal input value in the preset input value storage unit 252 in association with the normal input value, thereby designating the output value as a correct output value.
If the number of preset input value and correct output value pairs stored in the preset input value storage unit 252 is equal to or greater than a specified number, the data collection unit 254 sets the oldest preset input value and correct output value pair. , And a set of new preset input values and correct output values is stored in the preset input value storage unit 252.

Also in the present embodiment, the failure determination control unit 251 transmits the preset input value stored in the preset input value storage unit 252 to the input exclusion unit 212 when activated by the failure determination activation unit 242. However, in this embodiment, the failure determination control unit 251 inputs the input value specified as the preset input value by the data collection unit 254 (the input stored in the preset input value storage unit 252 as the preset input value by the data collection unit 254). Value) to the input exclusion unit 212.
Also in this embodiment, the failure determination control unit 251 compares the output value of the subsystem A 220 and the output value of the subsystem B 230 with the correct output value of the preset input value. However, in the present embodiment, the failure determination control unit 251 outputs the output value specified as the correct output value by the data collection unit 254 (the output stored in the preset input value storage unit 252 as the correct output value by the data collection unit 254). Value).

Also in this embodiment, the input exclusion unit 212 inputs the preset input value from the failure determination control unit 251 to the subsystem A 220 and the subsystem B 230. However, in the present embodiment, the input exclusion unit 212 inputs the input value designated as the preset input value by the data collection unit 254 to the subsystem A 220 and the subsystem B 230.

*** Explanation of operation ***
Next, an operation example of the control device 100 according to the present embodiment will be described.
Here, an operation example of the data collection unit 254 will be described with reference to FIG.
The operations of the components other than the data collection unit 254 are the same as those in the first embodiment.

The data collection unit 254 receives normal input values input from the input exclusion unit 212 to the subsystem A 220 and the subsystem B 230 (step S501). The data collection unit 254 stores the received normal input value in the temporary storage area.

Next, the data collection unit 254 receives the comparison result from the output collation control unit 241 (step S502).

Next, the data collection unit 254 refers to the comparison result and determines whether or not the output value of the subsystem A 220 matches the output value of the subsystem B 230 (step S503).
If the output value of subsystem A 220 matches the output value of subsystem B 230, the process transitions to step S504. On the other hand, if the output value of the subsystem A 220 does not match the output value of the subsystem B 230, the process transitions to step S505.
Note that if the output value of the subsystem A 220 matches the output value of the subsystem B 230, the data collection unit 254 selects either the output value of the subsystem A 220 or the output value of the subsystem B 230 in step S502. Are received from the output collation control unit 241 together with the comparison result.

If the output value of the subsystem A 220 matches the output value of the subsystem B 230, the data collection unit 254 sets the combination of the normal input value stored in the temporary storage area and the output value received in step S502. Is stored in the preset input value storage unit 252 (step S504).
On the other hand, if the output value of the subsystem A 220 does not match the output value of the subsystem B 230, the data collection unit 254 discards the normal input value stored in the temporary storage area (step S505).

*** Explanation of the effect of the embodiment ***
As described above, in this embodiment, failure determination using a preset input value and correct output value pair can be performed without preparing a set of preset input values and correct output values in advance.

100 control device, 110 input synchronous FPGA, 120 microcomputer A, 121 CPU, 122 memory, 123 I / O device, 124 CAN I / O device, 130 microcomputer B, 140 output verification FPGA, 150 external device A, 160 external Device B, 210 input unit, 211 input synchronization unit, 212 input exclusion unit, 213 failure determination operation state storage unit, 220 subsystem A, 230 subsystem B, 240 output verification unit, 241 output verification control unit, 242 failure determination activation Unit, 243 degeneration mode operation state storage unit, 250 failure determination unit, 251 failure determination control unit, 252 preset input value storage unit, 253 retry number storage unit, 254 data collection unit.

Claims

An input management unit for inputting a preset input value with a known correct output value to the plurality of operation systems when a plurality of output values from the plurality of operation systems that are made redundant do not match;
A control unit that acquires a plurality of output values from the plurality of arithmetic systems for the preset input value and compares each of the acquired output values with the correct output value for the preset input value; apparatus.
The comparison unit includes:
2. The computing system operating normally in the plurality of computing systems is determined by comparing each of the obtained plurality of output values with the correct output value for the preset input value. Control device.
The input management unit
While a plurality of output values from the plurality of computing systems match, a normal input value is repeatedly input to the plurality of computing systems,
2. The input of the normal input value is stopped and the preset input value is input to the plurality of arithmetic systems after a plurality of output values from the plurality of arithmetic systems become inconsistent. Control device.
The input management unit
3. The control device according to claim 2, wherein the preset input value is repeatedly input to the plurality of operation systems until the comparison unit determines a normal operation system among the plurality of operation systems.
The control device further includes:
After the comparison unit determines the operation system normally operating among the plurality of operation systems, only the output value from the operation system normally operating determined by the comparison unit is externally output. The control device according to claim 2, further comprising: an output management unit that outputs to the output.
The input management unit
When the two output values from the two computation systems that are duplicated do not match, a preset input value with a known correct output value is input to the two computation systems,
The comparison unit includes:
The two output values from the two arithmetic systems for the preset input value are acquired, and each of the acquired two output values is compared with the correct output value for the preset input value. Control device.
The control device further includes:
When a plurality of output values from the plurality of arithmetic systems match the normal input value, the normal input value is designated as the preset input value, and any one of the plurality of output values is correct. It has a specification part that specifies the output value,
The input management unit
The preset input value designated by the designation unit is input to the plurality of arithmetic systems,
The comparison unit includes:
The plurality of output values from the plurality of arithmetic systems for the preset input value are acquired, and each of the acquired plurality of output values is compared with the correct output value specified by the specifying unit. The control device described.
When a plurality of output values from a plurality of redundant computing systems do not match, a computer inputs a preset input value with a known correct output value to the plurality of computing systems,
A control method in which the computer acquires a plurality of output values from the plurality of arithmetic systems for the preset input value, and compares each of the acquired plurality of output values with the correct output value for the preset input value. .