WO2020175060A1

WO2020175060A1 - Computation device and recording medium

Info

Publication number: WO2020175060A1
Application number: PCT/JP2020/004324
Authority: WO
Inventors: 若菜竹下; 貴広池田
Original assignee: 日立オートモティブシステムズ株式会社
Priority date: 2019-02-27
Filing date: 2020-02-05
Publication date: 2020-09-03
Also published as: JP2020140343A; JP7082584B2

Abstract

A computation device is provided with: a storage unit for storing, for a fault tree having a plurality of nodes, at least one of the plurality of nodes being related to a safety function, a condiguration of the fault tree before a change, a configuration of the fault tree after the change, and information indicating a node tested in a past for each safety function; a safety function specifying unit for specifying, on the basis of information relating to the change of the fault tree, a safety function affected by the change; a re-test node specifying unit for specifying, on the basis of the configuration of the fault tree after the change and the node tested in the past, a re-test node, which is a node for testing again the safety function specified by the specifying unit, the node being tested in the past; and a new test node specifying unit for specifying, on the basis of the configuration of the fault tree after the change and the node tested in the past, a new test node, which is a node to be tested newly.

Description

Specification

Title of invention: arithmetic unit, recording medium

Technical field

The present invention relates to an arithmetic device and a recording medium.

Background technology

[0002] In recent years, functional safety development is being adopted in fields such as automobiles, construction machinery, and railways. Functional safety is the concept of safety in which the risk of accidents is reduced to an acceptable level by adding safety functions to products. Functional safety is standardized by S.O. and I.E.C., and there is an increasing demand for conformity with standards as a development requirement for products related to human life.

[0003] In functional safety development, it is essential to identify accidents that may occur and their factors. Risk analysis techniques are used to identify accidents and their causes. Risk analysis methods include a top-down analysis method that takes an accident that may occur as an input and identifies the factors leading to it, and a bottom-up analysis method that identifies an accident that may occur due to a possible failure in the system as an input. is there. Functional safety development typically uses a combination of both top-down and bottom-up analysis methods. A typical top-down analysis method is Fault Tree Analysis (FTA). A typical bottom-up analysis method is FMEA (Fa i lure Mode and Effect Analysis).

[0004] Regarding a fault tree, there is a method of automating the generation of the fault tree. In Patent Document 1, information on a hazard occurrence scenario is extracted from the HAZ○P worksheet and processed, and the information is recorded in the items of initiating event, intermediate event, protective measure, hazard and impact level, and the impact level is the key. as a hazard ^_ list creating means for creating a hazard over list was descending sort, against the hazard of interest recorded in the hazard ^_ list, each initiating event, without regard to whether there is a defense A causal relationship between the events from the initiating event to the hazard that is the top event is constructed as a logical structure, and the logical structure of the causal relationship between the events is prevented. \¥02020/175060 2 (:171?2020/004324

For the event when there is a control means, the event and the defense means function failure event are combined with 8 N 0 gates, and the defense means function failure event is connected in advance according to the type of the protection means. The basic events related to the failure of the registered defense function are combined with 〇[¾ge_rule, and the 〇[¾ge_rule is linked to the defense means function failure event, and the target hazard has multiple different cause events. In this case, the same intermediate event existing in the logical structure of the causal relationship between the events corresponding to each initiating event is identified, and a plurality of causal events (lower levels) that generate the intermediate event are combined with 〇[¾ge_rule]. , 〇 [¾ge_rule is connected to the intermediate event, and the hazard is expressed by expressing the logical structure of the causal relationship between the event related to the target hazard and the event with a fault tree. A fault tree as a fault event, and a fault tree creating means for expressing the fault tree graphically, and a fault occurrence frequency registered in advance for the cause event and basic event in the fault-tree. Disclosed is a process risk assessment support apparatus, characterized by comprising: a hazard occurrence frequency calculation means for calculating the occurrence frequency of a target hazard.

[0005] In functional safety development, when there is a change in design, it is essential to identify the scope of impact of the change and whether or not the change affects safety. Therefore, the risk analysis results are always corrected and updated when the design is changed. The impact of updates to the risk analysis on the product must be analyzed as well, and any potential impact should be retested.

[0006] Assuming the time of redesign or design change, when a change is made to the original design, the functional safety development makes a review of the risk analysis and a correction accompanying the change. In addition, it is necessary to analyze the effect of changes and retest and revalidate the affected areas. Areas requiring retesting and revalidation are identified as follows. First, based on the traceability information between risk analysis and requirements, the requirements and functions affected by the changes are identified. Next, the test cases linked by traceability are acquired from the requirements and functions, it is judged whether retest is necessary, and if necessary, retest is performed. Large systems or complex systems \¥02020/175060 3 卩(: 171?2020/004324

In the case of a system, the examination and implementation of test cases that require re-testing will take a great deal of time.

Prior art documents

Patent literature

[0007] Patent Document 1: Japanese Patent Laid-Open No. 2 0 1 2 — 9 8 8 20

Summary of the invention

Problems to be Solved by the Invention

[0008] In the invention described in Patent Document 1, it is necessary to consider all test cases with the change of the fault tree.

Means for solving the problem

[0009] The arithmetic unit according to the first aspect of the present invention has a plurality of nodes, and at least one node of the plurality of nodes is a fault tree associated with a safety function. Configuration, the configuration of the fault tree after the change, and a storage unit that stores information indicating the nodes that have been tested in the past for each safety function, and the effect of the change based on the information about the change of the fault tree. The safety function identifying unit that identifies the safety function, and the safety function identified by the safety function identifying unit is tested again based on the configuration of the changed failure tree and the node that has been tested in the past. A retest node identifying unit that identifies a retest node that is the node that has been tested in the past, a configuration of the fault tree after the change, and a node that has been tested in the past. Based on this, a new test node specifying unit that specifies a new test node that is a new test target node is provided.

A recording medium according to a second aspect of the present invention has a plurality of nodes, at least one node of the plurality of nodes is a fault tree associated with a safety function, the configuration of the fault tree before change, A computer having a storage unit for storing the configuration of the fault tree after the change and information indicating the nodes tested in the past for each of the safety functions, based on the information regarding the change of the fault tree. \¥02020/175060 4 卩 (: 171?2020/004324

Identifying the safety function affected by the change, and based on the configuration of the failure tree after the change and the node tested in the past, the safety function for re-testing the identified safety function. A retest node that is a node that has been tested in the past, and a new test target based on the configuration of the changed failure tree and the node that was tested in the past. A program for executing and identifying a new test node, which is a node, is recorded and is computer readable.

Effect of the invention

[0010] According to the present invention, it is possible to reduce the number of test cases required for changing a fault tree.

Brief description of the drawings

[001 1] [Fig. 1] Hardware configuration of arithmetic unit 1

[Figure 2] Functional configuration diagram of computing unit 1

[Figure 3] Diagram showing an example of node information 91

[Figure 4] Diagram showing an example before and after changing the fault tree

[Figure 5] Example of existing test information 92

[Figure 6] Example of new test information 93

[FIG. 7] A flow chart showing the overall processing of the arithmetic unit 1 in the first embodiment.

[Figure 8] Flow chart showing the processing of the new test node identification unit 1 2

[Figure 9] Flow chart showing the new core processing

[Figure 10] Flow chart showing the processing of the retest node identification unit 13

[Fig. 11] Flow chart showing core processing of retesting

[Fig. 12] Diagram showing an example of the count number and target node list

[Figure 13] Flow chart showing the decision process

[FIG. 14] A diagram showing how a program is read from the outside in Modification 2 [FIG. 15] A diagram showing an example of existing test information 92 8 in the second embodiment [FIG. 16] In the second embodiment Flowchart showing the overall processing of arithmetic unit 1 \¥02020/175060 5 卩 (: 171?2020/004324

MODE FOR CARRYING OUT THE INVENTION

[0012] — First Embodiment

The first embodiment of the arithmetic unit will be described below with reference to FIGS. 1 to 13. In this embodiment, a fault insertion test is performed as the fault test. The fault insertion test is a test that causes a fault event and tests that the safety function operates normally.

[0013] (Hardware configuration)

FIG. 1 is a hardware configuration diagram of an arithmetic unit 1 according to the present invention. The processing unit 1 is the central processing unit 〇 II 2, the non-volatile and read-only 〇 !\/! 3 and the volatile readable/writable [¾ !\/1 4] Interface 8 and a non-volatile readable/writable storage unit 9.

The program is stored in advance. 〇 112 is

The functions described below are realized by expanding the program stored in 8 IV! 4 and executing it.

[0014] The interface 8 is a communication interface for exchanging information with the outside through communication, or an interface capable of reading a physical medium. The communication interface is, for example, a wired communication module corresponding to 丨巳跳巳802.3 or a wireless communication module corresponding to wireless !_8 1\1 or 4°. The storage unit 9 is, for example, a hard disk drive or a flash memory. The storage unit 9 stores the information described later in advance. However, the information stored in the storage unit 9 may be input from the outside via the interface 8.

[0015] (Functional configuration)

FIG. 2 is a functional configuration diagram of the arithmetic unit 1. However, FIG. 2 also shows the information stored in the storage unit 9. The computing device 1 has, as its functions, a safety function specifying unit 11, a new test node specifying unit 12 and a retest node specifying unit 13. These features are 0 II 2

It is realized by executing the program stored in. The storage unit 9 stores node information 91, existing test information 92, and new test information 93. \¥02020/175060 6 卩(: 171-12020/004324

[0016] The safety function specifying unit 11, the new test node specifying unit 12 and the retest node specifying unit 13 store the node information 91 stored in the storage unit 9 and the existing test information 92. Perform calculation as the target and create new test information 93. That is, in FIG. 2, the storage unit 9 stores the node information 91, the existing test information 92, and the new test information 93, of which the node information 91 and the existing test information 92 are stored. Is the information that has been created in advance, and the new test information 93 is the information that is newly created.

The safety function identification unit 11 identifies the safety function affected by the change based on the information about the change in the failure tree. The new test node specifying unit 12 specifies a retest node that is a node that has been tested in the past, which is a node for testing the safety function specified by the safety function specifying unit 11 again. The new test node identifying unit 12 identifies a new test node based on the changed fault tree configuration and the nodes tested in the past. The retest node identification unit 13 identifies a new test node which is a node to be newly tested. The retest node identification unit 13 identifies the retest node based on the changed fault tree configuration and the nodes tested in the past.

[0018] The failure tree is a tree structure composed of risk events such as failure events, abnormal events, and security risk events. The fault tree also includes tree structures created by other risk analysis methods. That is, the fault tree may be a tree structure composed of nodes that represent risk events. The fault tree consists of multiple nodes that represent events.

[0019] The node information 91 stores information on each node that constitutes the failure tree. No

-The information on the node is the information that can specify the position in the fault tree for each node. In the present embodiment, the node information 91 also stores the identifier of the safety function corresponding to each node. The node information 91 may be created by a human or may be created by a known automatic process. The existing test information 92 may be created by a human, may be created by a known automatic process, or may be created by the computing device 1 in the past. \¥02020/175060 7 卩(: 171?2020/004324

[0020] That is, the new test information 9 3 may be treated as the existing test information 9 2 as follows. For example, first, the node information 91 is updated, and the arithmetic unit 1 creates new test information 93. Then, it is assumed that the test described in the created new test information 93 is executed and the node information 91 is updated again. In this case, the arithmetic unit 1 may treat the new test information 9 3 previously created as the existing test information 9 2 and create new test information 9 3 again.

[0021] The existing test information 92 describes the contents of the tests executed in the past.

The information stored in the existing test information 92 and the new test information 93 is of the same type. The existing test information 92 and the new test information 93 may use the same description format or different description formats.

[0022] (Node information)

FIG. 3 is a diagram showing an example of the node information 91 stored in the storage unit 9. However, FIG. 3 is merely an example of the node information 91, and the information storage is not limited to the tabular format. The node information 91 is composed of multiple records, and each record has a node gate, an upper gate 0, a lower gate 0, a safety function gate, and an old and new field. Each record stores information about the node specified by the information stored in the node field (hereinafter referred to as the “target node”). Although the type of gate is not shown in the example shown in FIG. 3, information about the type of gate may be included in FIG. 3, or only the information indicating the type of gate may be separately included in the storage unit 9. Good.

[0023] In the "node entrance" field, an identifier for identifying the target node is stored. The “upper gate entrance” field stores an identifier that identifies the upper gate of the target node. However, when there is no upper gate, a symbol indicating that there is no such gate, for example, "1" is stored. The field of "lower gate entrance" stores an identifier for identifying the lower gate of the target node. However, when there is no subordinate gate, a symbol indicating that it does not exist, for example, "1" is stored.

[0024] The field of "safety function" is the safety function for the event of the target node. \¥02020/175060 8 卩 (: 171?2020/004324

An identifier for identifying is stored. However, if there is no safety function for the event of the target node, a symbol indicating that fact, for example, "1" is stored. In addition, in the field of "safety function", instead of the identifier that identifies the safety function for the event of the target node, any one of the safety requirement, safety requirement, and design information for the event of the target node is stored. Good.

[0025] The "old" and "old" fields store information indicating whether the target node is an existing node or has been added or deleted due to a change. The example shown in Figure 3 shows that the change added three nodes. However, the "old" and "old" fields are not mandatory configurations, and the "old and new" fields may not be provided if there is node information 91 before and after the change.

[0026] (Example of fault tree)

Figure 4 shows an example before and after the change of the fault tree, and corresponds to Figure 3 above. Strictly speaking, Fig. 4 is a diagram visually showing only the structure of the fault tree shown in Fig. 3 〇 The fault tree shown in Fig. 4 is from 1\1 1 0 1 to 1\1 1 1 3 1 3 nodes,

It consists of all 6 gates from ◦ 11 to ◦ 16. Gate 1\1 1 0 1 is the highest node, and the lower in the figure, the lower the node. In Fig. 4, the structure of the fault tree before the change is shown by the solid line, and the structure of the fault tree added by the change is shown by the broken line. That is, no node was deleted in the modification of the example shown in Fig. 4. There are two types of gates, 80 gates and O gates. In the example shown in Fig. 4, the type of gate indicates the type of gate. In the example shown in FIG. 4, only the gate 0 13 is 80 gates, and the other 5 gates are 0 gates.

[0027] The upper node is connected to the lower node by a gate. 〇[¾ge_] means that the event of the upper node will occur if any one of the events of the lower node occurs. Eight N 0 gates 203 means that when all of the events of the lower node occur, the events of the upper node occur. For example, the gate 〇 1 1 is a gate, so the node !\1 1 0 2 and node !\1 1 0 3 \¥02020/175060 9 ((171?2020/004324

If any event occurs, the event of node 1\11 01 will occur. In the following, nodes that do not have a lower gate are called “terminal nodes”, and nodes other than the terminal nodes are called “non-terminal nodes”. In the example shown in FIG. 4, nodes N 104, N 106, N 108, N 109, N 110, N 1 12 and N 1 13 are end nodes.

[0028] In the following, nodes that are vertically related to each other with the gate interposed are referred to as "one-stage higher node". For example, in the example shown in FIG. 4, the node one level above the node N 110 is node 107.

[0029] In the example shown in FIG. 4, a node N 1 1 1, a gate ◦ 1 6, a node 1\11 1 2 and a node 1\11 1 3 are added below the gate 0 1 3 by a change. .. There is no change that the game 0 13 has 80 nodes. Before the change, the event of node 1\11 03 occurred when both the event of node 1\11 0 6 and node 1\11 07 occurred, but after the change, in addition to these two events, the node If the event of 1\11 11 does not occur, the event of node 1\! 10 03 does not occur.

[0030] (Existing test information)

FIG. 5 is a diagram showing an example of the existing test information 92 and corresponds to FIG. 3 described above. The existing test information 92 is composed of multiple records. Each record of the existing test information 92 has a field of a test case, a safety function, and a failure entry field. Each record stores information about the test case (hereinafter referred to as “target test case”) specified by the information stored in the “test case mouth” field.

[0031] The identifier of the target test case is stored in the field of "test case mouth". The field of "Safety function mouth" stores an identifier that identifies the safety function to be tested in the target test case. The field of "fault insertion point" stores the identifier of the node corresponding to the fault event generated in the target test case.

[0032] In the example shown in the first record of Fig. 5, the safety case with the safety function mouth of "31" is tested in the test case with the mouth of "chome 1". \¥02020/175060 10 units (：171?2020/004324

It is shown. In addition, the test case shows that the fault event corresponding to node N 1 0 4 and node 1\1 108 is generated.

[0033] (new test information)

FIG. 6 is a diagram showing an example of new test information 93, which corresponds to FIG. 3 described above. The structure of the new test information 93 is the same as that of the existing test information 92, so the description is omitted.

[0034] (Float)

The operation of the arithmetic unit 1 will be described below with reference to FIGS. 7 to 13. Further, in the following description of the flow chart, a specific operation will be supplementarily described with reference to the examples shown in FIGS.

[0035] (Float chart overall treatment)

FIG. 7 is a flow chart showing the overall processing of the arithmetic unit 1 in the first embodiment. When the arithmetic unit 1 receives a configuration change for an existing faulty tree from the outside via the interface 8, it starts the process shown in FIG. However, the process shown in Fig. 7 may be started when a command to start the process is received from the outside with the configuration of the old and new fault trees and the existing test information 92 stored in the storage unit 9 in advance. When the process shown in FIG. 7 is started, the storage unit 9 stores the node information 91 and the existing test information 92.

[0036] In the flow chart described below, "passage flags" are individually set for all the nodes constituting the fault tree and used for the calculation. The pass flag is a variable that takes two values, true and false, and is used only in the flow chart described below. The information of the passage flag is stored in [1/8/1/4].

[0037] The safety function identification unit 11 of the arithmetic unit 1 first refers to the node information 91 and identifies the safety function affected by the change in the configuration of the faulty tree (3701). The affecting safety function is the safety function associated with all the nodes that pass through when changing in order from the place where the change was made to the highest node. In the example shown in Fig. 4, the nodes N 1 0 3 and N 1 0 1 exist when descending from the added fault tree toward the top node. And the node !\1 1 0 1 is the safety function I port. \¥02020/175060 11 卩(：171? 2020/004324

No node |\! 10 3 has only the safety function 0 "3 2", so 37 01 specifies "3 2".

[0038] Next, the arithmetic unit 1 refers to the existing test information 92 in the storage unit 106 and identifies the node set at the fault injection location. In the example shown in FIG. 5, nodes N 104, N 106, N 08, and node 1\! 109 are specified as the nodes set in the failure location.

Next, the arithmetic unit 1 sequentially selects all the safety functions specified in 3701 as “target safety functions”, and executes the processing existing between 3703 and 3708, that is, 3704 to 3707. For example, if the safety functions identified in 3701 are 37 and 38, first execute 3704 to 3707 by setting the target safety function to 37, then set the target safety function to 3 and set 370 4 to 3707. Execute. In the example shown in FIG. 3, since the safety function specified in 3701 is only 32, 3704 to 3707 are executed only once.

[0040] The processing of 3704 to 3707 is as follows. First, false is set in the transit flags of all nodes (3704). Next, the new test node identification unit 12 identifies a node to be newly tested, that is, a new test node {~! 05). Details of the 3705 will be described later with reference to FIG. Next, the retest node identification unit 13 identifies the node to be retested, that is, the retest node, from the nodes tested in the past (3706). Details of the 3706 will be described later with reference to FIG.

[0041] Then, the arithmetic unit 1 creates a test case in which the nodes identified by 3705 and 3706 are set as the failure injection points (3707). The specific operation of the 3707 will be described later. The above is the processing contents of 3704 to 3707. Finally, the arithmetic unit 1 outputs the test case created in 3707 (3709) and ends the processing shown in FIG.

[0042] (Float chart new test node identification unit)

FIG. 8 is a flow chart showing the processing of the new test node identification unit 12 and a flow chart showing the details of 3705 in FIG. First a new test no \¥02020/175060 12 卩(：171?2020/004324

The de-identifying unit 12 identifies the top node related to the change in the failure tree (3801). In the example shown in Fig. 3 and Fig. 4, since nodes 1\1 1 1 1 to 1\1 1 1 3 and gate 0 16 are added, the top node related to the change is node 1\! 1 1 1. is there . If not only node 1\! 1 1 1 ~ 1\1 1 1 3 but also node 1\1 1 0 8 was added due to changes, node 1\1 1 0 8 and Node 1\1 1 1 1 1 is identified.

Next, the new test node specifying unit 12 executes the processes of 380 3 and 380 4 by using all the highest-rank nodes specified in 380 1 as target nodes.

In 380 3, the new test node identification unit 12 executes new core processing to identify the node that is the target of the new test. Details of 380 3 will be described later with reference to FIG. In 380 4, the new test node identification unit 12 records the list output in 380 3. When the new test node identification unit 12 completes the processes of 380 3 and 380 4 for all the top-level nodes identified in 380 1, the list recorded in 380 4 is After outputting (3806), the processing shown in FIG. 8 is terminated. The list output in 380 6 is used in 370 in FIG.

[0044] (Float Chart New Core Treatment)

FIG. 9 is a flow chart showing the novel core treatment, and is a flow chart showing the details of 380 3 in FIG. In the process shown in FIG. 9, the node specified in 380 1 in FIG. 8 is set as the “target node” and executed. The new test node identification unit 12 first sets the passage flag of the target node to "true". Next, the new test node identification unit 12 determines whether or not the target node is the end node (3902). As described above, the terminal node is a node that does not have a gate below. When the new test node identification unit 12 determines that the target node is a terminal node, it creates and outputs a list with only the target node as an element (3903), and ends the processing shown in Fig. 9. To do. When the new test node identifying unit 1 2 determines that the target node is not the end node, the process proceeds to 390 6.

[0045] In 3960, the new test node identification unit 1 2 determines that the lower gate of the target node is \¥02020/175060 13 卩(: 171-12020/004324

If it is judged whether the gate is 80 gates or not, if it is judged that the lower gate is 80 gates, proceed to 39 1 1, and if it is judged that the lower gate is 0 gates, proceed to 3921. The new test node identification part 1 2 is 39 1

In, all the nodes lower than the target node are sequentially treated as “loop target” and the processing of 39 1 2 is executed. For example, if node 1\11 02 is the processing target in the example shown in Fig. 3, for example, node 1\11 04 is the loop target and 39 1 2 is executed, then node 1\! Execute 1 2 and finally execute 39 1 2 with node 1\11 08 as the loop target.

In 39 1 2, the new test node identifying unit 12 executes the new core processing shown in FIG. 9 with the loop target as the target node. That is, 39 1 2 is a recursive call. For example, if 39 1 2 is executed with node 1\11 04 as the loop target in the above example, the new core processing shown in Fig. 9 is executed with node 1\11 04 as the target node. The new test node identifying unit 12 advances to 39 1 4 when 39 1 2 is executed with all lower nodes of the target node as loop targets.

In 39 1 4, the new test node identification unit 12 creates a list that combines the lists output by the process of 39 1 2. For example, as mentioned above, if the target node is 1\11 02, the loop target is nodes 1\11 04, N 1 05, and 1\11 08. The list that is output when each of these three performs new core processing as the target node is 102, N 104, and 1\11 08. Therefore, in 39 1 4 as a list combining these, 1\11 02, 1\11 04, N 1 08, (N 1 02, N 1 04} ,(N 1 02, N 1 08} ,{

1 04, N 1 08}, {1\11 02, N 1 04, N 1 08} are created. However, when a list contains multiple elements, curly braces are used here to indicate the scope of the list. In the following 39 15, the new test node identifying unit 12 outputs the list created in 39 14 and finishes the processing shown in FIG.

[0048] The new test node identification unit 1 2 is 392 1

In 924, all nodes below the target node are sequentially marked as “loop target” in 3922 and 39. \¥02020/175060 14 卩 (: 171?2020/004324

Execute the processing of 23. For example, in the example shown in Fig. 3, when node 1\11 02 is the processing target, nodes N 1 04, N 1 05, and N 1 08 are loop targets, and 3922 and 3923 are executed. In 3922, the new test node identification unit 12 executes the new core processing shown in Fig. 9 with the loop target as the target node. That is, 3922 is a recursive call. In 3923, the new test node specifying unit 12 outputs the list output by the process of 3922. When the new test node identification unit 12 executes 3922 and 3923 with all lower nodes of the target node as loop targets, the process shown in FIG. 9 ends.

[0049] 39 1

The process executed in #3 and the process executed in #3921 to 3924 are similar but the details are different. That is, in 39 1 1 to 39 1 5, the lists output by executing the new core processing in 39 1 2 by recursive processing are not output as they are, but output in combination. On the other hand 392 1

At 924, the new core processing is executed at 3922 by recursive processing, and the output list is output as it is.

[0050] Since there are actually 3906 judgments, the same target node is 39 1 1 ~

It is impossible to execute both 39 1 5 and 392 1 to 3924, but if you write it for explanation, even if the target node is the same, 39 1 1 to 39 1 5 and 392 1 to 3924 call The list output in 3803 in Fig. 8 is different as follows. That is, 39 1 1 to 39 1 5: 1\11 02, N 1 04, N 1 08, (N 1 02, N 1 04} ,(N 1 02, N 1 0

8}, (N 1 04, N 1 08} ,{1\11 02, 1\11 04, 1\11 08} are output, and 392 1 to 3924 have 1 02, N 1 04, and 1\11 08 Is output.

[0051] (Flow chart retest node identification unit)

FIG. 10 is a flow chart showing the processing of the retest node identification unit 13 and a flow chart showing the details of 3706 in FIG. The configuration shown in Fig. 10 is used, except for 31 003.

Correspond to each reason. Here 31 0 \¥02020/175060 15 卩(: 171?2020/004324

Only the processing of 03 will be explained. In 31 003, the retest node identification unit 13 executes the retest core processing for identifying the node to be retested. Details of 31 003 will be described later with reference to FIG.

[0052] FIG. 11 is a flow chart showing the reprocessing core treatment.

It is a flow chart showing the details of 003. In the process shown in Fig. 11, the node specified in 31 001 of Fig. 10 is set as the "target node" and executed. In FIG. 11, the retest node identification unit 13 first determines whether or not the target node is the highest node in the fault tree (31 01 1). When the retest node identification unit 13 determines that the target node is the top node, the process shown in Fig. 9 ends, and when it determines that the target node is not the top node, it returns to 31 0 1 2. move on.

[0053] In 31 01 2, the retest node identification unit 13 determines whether or not the upper gate of the target node is 80 gates, and if it is determined that the upper gate is 80 gates, 31 02 Proceed to 1 and proceed to 31 01 3 if the upper gate is judged to be 〇 gate. In 31 01 3, the retest node identifying unit 13 sets the passage flag of the node one step higher than the target node to true, and proceeds to 31 01 4. For example, if the target node is node 1\11 07 shown in Fig. 3, the transit flag of node 1\11 03 is set to true in 31 01 3.

[0054] In 31 01 4, the retest node identification unit 13 determines that the node one level higher than the target node

-The safety function check box is the target safety function, that is, one of the safety functions specified in 3701 of Fig. 7, and it is determined whether or not the safety functions are selected one by one in order. When the retest node identification unit 13 determines that the safety function port of the node one step higher than the target node matches the target safety function, the process shown in Fig. 11 ends. If the retest node identification unit 13 determines that the safety function port of the node one level above the target node does not match the target safety function, it sets the target node to the node one level higher than the current target node. Change and return to 31 01 2.

[0055] For example, if the target node is the node !\11 07 shown in Fig. 3, 31 01 3 \¥02020/175060 16 卩(：171?2020/004324

Determines whether the safety function entrance of node 1\1 103 matches the target safety function. According to the example of Fig. 3, the safety function entrance of the node N 103 is 3 2, so if the target safety function is 3 2, an affirmative judgment is made. If the node one step higher than the target node does not have a safety function entry, a negative judgment is made in 3 1 0 1 3 regardless of the value of the target safety function.

[0056] The retest node identification unit 13

In step 3, all nodes under 80 gates, which are the upper gates of the target node, are sequentially set as “loop nodes” and the processes of 3 1 0 2 2 to 3 1 0 2 9 are executed. In 3 1 0 2 2, the re-test node identifying unit 13 determines whether or not the pass flag of the loop node is false, and when it is determined that the pass flag of the loop node is false, 3 1 0 2 When it is judged that the passage flag of the loop node is not false, that is, it is true, the procedure proceeds to 3 1 0 3 0. In 3 1 0 2 3, the retest node identifying unit 1 3 sets the passage flag of the loop node to true and proceeds to 3 1 0 2 4.

[0057] In 3 1 0 2 4, the retest node identification unit 1 3 determines whether or not the loop node has been tested, that is, it is set as the fault insertion location in any test case of the existing test information 9 2. Determine whether or not If the retest node identification unit 13 determines that the loop node is set at the fault injection location in any of the test cases of the existing test information 92, the retest node identification unit 13 proceeds to 3 10 25. If the re-test node identification unit 13 determines that the loop node is not set as the fault-insertion location in any of the test cases of the existing test information 92, the re-test node identification unit 13 proceeds to 3 10 26.

In 3 1 0 2 5, the retest node identifying unit 13 selects the loop node as the test target, and proceeds to 3 1 0 2 9. At 310 2 6 the retest node identification unit 13 determines whether the lower gate of the loop node is 80 gates. When the re-test node identification unit 13 determines that the lower gate of the loop node is 8 gates, the re-test node identification unit 13 proceeds to 3 1 0 30 and the lower gate of the loop node is not 80 gates, that is, 0 gates. If yes, go to 3 1 0 2 7. \¥02020/175060 17 卩(: 171?2020/004324

In 311027, the retest node identifying unit 13 executes the determination process shown in FIG. 13 using all nodes below the ∘ gates, which are lower gates of the loop node, as evaluation nodes in order. For example, in the example shown in Figure 3, if the loop node is node 1 07, the lower gate of node 1\1 1 0 7 is gate ◦ 15 so node N 1 0 9 and node N 1 1 0 The decision process shown in Fig. 13 is executed as an evaluation node. As will be described later in detail, in this determination process, the count number and the target node list are output. In the following 3 1 0 2 8, the retest node identification unit 1 3 selects the target node list with the minimum count number in the decision processing executed in 3 1 0 2 7 as the test target, and sets it to 3 1 0 2 9. move on.

FIG. 12 is a diagram showing an example of the count number and the target node list. If 3

In 1 0 2 7, there are 4 nodes with 0 gates or less in total, and when the output of each is as shown in Fig. 12 3 1 0 2 9 has the smallest count number. The list, node 201, is selected for testing.

[0061] In 3109, the retest node identifying unit 13 outputs the test targets as one list. When the retest node identification unit 13 executes the processes of 3 1 0 2 2 to 3 1 0 2 9 with all nodes under 80 gates, which are the upper gates of the target node, as loop nodes, the process shown in Fig. 11 is executed. To finish.

[0062] (Flow chart determination process)

FIG. 13 is a flow chart showing the determination process, and is a flow chart showing the details of 310 2 7 in FIG. The retest node identification unit 13 first initializes the target node list to 1\1 II !_ !_, that is, the blank state by setting the number of counts to zero (3 1 1 0 1). Next, the retest node identification unit 13 determines whether the evaluation node has been tested, that is, whether the test node in any of the existing test information 92 has been set as the failure insertion location. .. When the retest node identification unit 13 determines that the evaluation node is set at the fault injection location in any of the test cases of the existing test information 92, the retest node identification unit 13 proceeds to 3 1 1 0 3. The retest node identification unit 1 3 determines that the evaluation node is one of the existing test information 9 2. \¥02020/175060 18 卩(：171? 2020/004324

In any of the test cases, if it is determined that the fault is not set, the procedure goes to 31 104.

[0063] In 31 10 3, the retest node identification unit 13 sets the count number to "1", sets the evaluation node in the target node list, and proceeds to 31 1 3 1. In 31 1 3 1, the retest node identification unit 13 outputs the set count number and target node list, and ends the processing shown in Fig. 13.

[0064] In 31 104, the retest node identifying unit 13 determines whether or not the lower gate of the evaluation node is 80 gates, and when it is determined that the lower gate is 80 gate, 31 1 Proceed to 1 1 and proceed to 31 1 2 1 if it is judged that the lower gate is a gate.

[0065] The retest node identification unit 13 returns 31 1 1

In 1 1 4, all nodes below the evaluation node are sequentially treated as “loop targets” and the processing in 3 1 1 1 2 is executed. In 31 1 1 2, the retest node identification unit 13 executes the decision process shown in Fig. 13 with the loop target as the evaluation node. That is, 31 1 1 2 is a recall call. In the subsequent 31 1 1 3, the retest node identifying unit 13 temporarily records the count number and the target node list output by executing 31 1 1 2. The retest node identification unit 13 executes 31 1 1 2 and 31 1 1 3 with all the lower nodes of the evaluation node as loop targets, and proceeds to 31 1 1 5.

[0066] In 31 1 1 5, the retest node identification unit 13 sets the count number to the total of the count numbers recorded in 31 1 1 3 and sets the target node list to all the record numbers in 31 1 1 3. Set it in the node list and proceed to 31 1 3 1. If the count number recorded in 31 1 1 3 and the target node list are as shown in Fig. 12, the count number is set to "8", which is the total of 1, 2, 2 and 3 in 31 1 15 and the target node list is set. The node list is node 201

Set to 208.

In 31 1 2 1 to 31 1 24, the retest node identifying unit 13 sequentially executes the process of 31 1 22 by setting all nodes lower than the evaluation node as “loop targets” in order. 31 1 2 2 The retest node identification unit 1 3 evaluates the loop target. \¥02020/175060 19 卩(：171?2020/004324

The decision process shown in Fig. 13 is executed as a valence node. That is, 3 1 1 2 2 is a recall call. In the subsequent 3 1 1 2 3, the retest node identification unit 13 temporarily records the count number and target node list output by executing 3 1 1 2 2. The retest node identification unit 13 executes 3 1 1 2 2 and 3 1 1 2 3 with all the lower nodes of the evaluation node as loop targets, and proceeds to 3 1 1 2 5.

[0068] In 3 1 1 2 5, the retest node identifying unit 13 sets the count number to the minimum value of the count numbers recorded in 3 1 1 1 3 and sets the target node list to the first force number. Set to the corresponding node list and proceed to 3 1 1 3 1. If there are multiple minimum counts, the node list set in the target node list may be any of the node lists corresponding to the minimum count. This is because the minimum number of counts is selected to reduce the amount of test calculation, so any selection of the target node does not affect the test calculation amount.

A specific example of 3 1 1 2 5 will be described. If the count number and target node list recorded in 3 1 1 2 3 are as shown in Fig. 12, set the minimum force number "1" in 3 1 1 2 5 and set the target node list to the count number. Set to node N 2 0 1 where is “1”. The above is the explanation of the processing shown in FIG.

[0070] According to the above-described first embodiment, the following operational effects can be obtained.

(1) The arithmetic unit 1 has a plurality of nodes, and at least one of the plurality of nodes is associated with a safety function.For the fault tree, the configuration of the fault tree before the change and the fault tree after the change And the storage unit 9 that stores the node information 91 that indicates the nodes that have been tested in the past for each safety function, and the safety function that identifies the safety function affected by the change based on the information about the change in the failure tree. The function identification unit 1 1, the retest node identification unit 1 3 that identifies the retest node based on the changed fault tree configuration and the nodes tested in the past, and the configuration of the changed fault tree and the past And a new test node specifying unit (12) for specifying a new test node based on the tested node. Therefore, it is possible to reduce the number of test cases required for changing the fault tree. \¥02020/175060 20 units (：171?2020/004324

[0071] (2) The safety function specifying unit 11 changes the safety function associated with each of all the nodes that pass when the node added by the change to the highest node of the failure tree passes. It is specified as a safety function affected by.

[0072] (3) The retest node identification unit 13 sets the highest node among the nodes added by the change as the target node, and the target node is the highest node in the failure tree after the change by the change. If it is not added to the retest node (3 1 0 1 1 :丫mi 3 in Figure 11)

(4) When the upper gate connected to the target node is 80 gates, the retest node identification unit 13 causes the event of each node connected to the 80 gate to occur. Add a node under 80 gates that has been tested in the past to the retest node (3 1 0 1 2 in Figure 11: 3 3, 3 1 0 2 1 1 0 3 0)

(5) The new test node identification unit 12 sets the highest node among the nodes added by the change as the target node, and if the target node has no lower node, sets the target node to the new test node. (3 9 0 2 :丫mi 3, 3 9 0 3 in Fig. 9), and if the target node has lower nodes, the target node is not added to the new test node (3 9 0 2 :N 0, 3960 or later).

(6) When the target node has a lower node and the lower gate connected to the target node is 80 gates, the new test node identification unit 12 connects to the 80 gate. Add the following nodes to the new test node so that the events of all the generated nodes will occur (3 9 0 6 :丫巳 3,

3 9 1 1

9 15). If the target node has a lower node and the lower gate connected to the target node is 〇 [¾ge_卜, the event of any one node connected to the 〇[¾ge_卜] So that the following nodes are added to the new test node (3 9 0 6 :1\!〇, 3 9 2 1 to 3 9 2 4) ₀

[0076] (Modification 1)

In the first embodiment described above, the nodes and gates that make up the fault tree are The information is stored in the node information 91, and the identifier of the safety function corresponding to each node is also stored in the node information 91. However, the gate information may be stored individually in the storage unit 9 without including the gate information in the node information 91. Also, information on safety functions need not be included in the node information 91.

[0077] (Modification 2)

The program for operating the arithmetic unit 1 does not have to be stored in the ROM in advance, and may be read from the outside as follows. Figure 14 shows how the program is read from outside. The program may be supplied to the arithmetic unit 1 by setting a recording medium 904 such as a CD-ROM storing a program on the arithmetic unit 1 or by a method of passing through a communication line 901 such as a network. It may be read into the arithmetic unit 1. When passing through the communication line 901, the program is stored in the storage device 903 of the server 902 connected to the communication line.

The server 902 reads the program information using the storage device 903 and sends it to the arithmetic unit 1 via the communication line 901. That is, the program is transmitted as a data signal via the carrier wave and the communication line 901. As described above, the program for operating the arithmetic unit 1 can be supplied as a computer readable computer program product in various forms such as a recording medium or a data signal (carrier wave).

[0079] (Modification 3)

Arithmetic unit 1 is realized by an FPGA (Field Programmable Gate Array), which is a rewritable logic circuit instead of the combination of CPU 2, ROM3, and RAM4, and an ASIC (Application Specific Integrated Circuit), which is an integrated circuit for specific applications. May be done. Further, the arithmetic unit 1 may be realized by a combination of different configurations, for example, a combination of C PU, ROM, RAM and F PGA, instead of a combination of C PU 2, ROM 3, and RAM 4.

[0080] First Second Embodiment \¥02020/175060 22 卩 (: 171-12020/004324

A second embodiment of the arithmetic unit will be described with reference to FIGS. In the following description, the same components as those in the first embodiment are designated by the same reference numerals, and the differences are mainly described. The points that are not particularly described are the same as those in the first embodiment. In the present embodiment, when there is a change in the structure of the fault tree, for the tests other than the fault insertion test, the part that requires a new test is specified, and the part that has been tested is the target of the regression test. Identify test cases that The same numbers are given to the same configurations as the first embodiment, and the description is omitted. In the present embodiment, not only the fault injection test, but also the test performed during development, for example, the comprehensive test, the integration test, and the unit test.

[0081] (Structure)

The hardware configuration of the arithmetic unit 18 according to the second embodiment is the same as that of the first embodiment, and therefore its explanation is omitted. The operation of the arithmetic unit 18 in the second embodiment is partially different from that in the first embodiment. Further, in the present embodiment, the memory 9 stores the existing test information 92 and the new test information 93 instead of the existing test information 92 and the new test information 93.

The existing test information 92 in the present embodiment stores information on the test type in addition to the information of the existing test information 92 in the first embodiment. The structure of the new test information 93 is also the same.

FIG. 15 is a diagram showing an example of existing test information 92 8 in the second embodiment. Each record of the existing test information 92 8 has a field of test type in addition to the field of the existing test information 92 in the first embodiment. Also, since the type of test is not limited to the fault insertion test, the field of "fault insertion point" is renamed to "target node".

FIG. 16 is a flow chart showing the overall processing of the arithmetic unit 1 according to the second embodiment. FIG. 16 is obtained by deleting 3770 from FIG. 7 in the first embodiment and adding 3150 and 3150. Here, only the added 3150 and 3150 will be described. In 3150 7, the computing unit 18 uses the new test nodes for the nodes identified in 3750 and 3706. \¥02020/175060 23 卩(: 171?2020/004324

— Select the test case in which the node is the test target by referring to the de-identification part 1 2.8. At this time, all the test cases where the node is the test target may be selected, or the test type may be limited.

[0085] For example, if the node identified in 3705 and 3706 is 3101 and the existing test information 928 is as shown in Figure 15 then the next test case is selected. .. That is, since node 301 is the target node in both test cases 011 and 012, both test cases 011 and 012 are selected. It However, if the operation type has limited the test type to integration test in advance, only the test case note 11 is selected.

Next, in 3150, the arithmetic unit 18 specifies the node for which a new test case should be created from the nodes specified in 3705. Of all the specified nodes, the node for which the test case is not set in the node information is the node that creates the test case. Moreover, the test type of the new test case is not particularly limited, but it can be, for example, a fault insertion test. By the above processing, it is possible to specify the test case of the regression test target and the node of the new test target.

(Modification of Second Embodiment)

In the second embodiment, instead of recording the test case 0 in the existing test information 92, the verification port may be recorded. One unit of the test case was an identification number for identifying the test content, while the verification unit was an identification number for identifying the test results and verification records in past verification activities. In this case, it is possible to specify the node that needs re-verification among the nodes that have been verified in the past and the node that needs new verification. The method of identifying the node when using the verification gateway is the same as the method of identifying the node that should create the test case, and the information to be referenced is different. In other words, create a list to identify the nodes that need revalidation.

The present invention is not limited to the above-mentioned embodiments, and various modifications are possible. \¥02020/175060 24 卩 (: 171?2020/004324

including. For example, the above-described embodiments have been described in detail in order to explain the present invention in an easy-to-understand manner, and are not necessarily limited to those having all the configurations described. Further, a part of the configuration of one embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of one embodiment. Further, it is possible to add/delete/replace other configurations with respect to a part of the configuration of each embodiment.

The above-described embodiments and modified examples may be combined with each other. Although various embodiments and modifications have been described above, the present invention is not limited to these contents. Other aspects that are conceivable within the scope of the technical idea of the present invention are also included within the scope of the present invention.

[0090] The disclosure content of the following priority basic application is incorporated herein by reference.

Japanese patent application 2 0 1 9-3 4 2 2 7 (filed February 27, 209) Description of symbols

[0091] 1 arithmetic unit

9 Memory

1 1 Safety function specification section

1 2 New test node identification section

1 3 Retest node identification section

Claims

\¥0 2020/175 060 25 卩(: 17 2020/004324 Claims

[Claim 1] It has a plurality of nodes, and at least one node of the plurality of nodes is

-For the fault tree associated with the safety function, the configuration stores the configuration of the fault tree before the change, the configuration of the fault tree after the change, and the information indicating the node tested in the past for each safety function. And a safety function identifying unit that identifies the safety function affected by the change based on information about the change in the failure tree,

The node for re-testing the safety function specified by the safety function specifying unit based on the changed fault tree configuration and the node tested in the past, which has been tested in the past. A retest node specifying unit that specifies a retest node that is the node, and a node that is a new test target based on the changed fault tree configuration after the change and the nodes that have been tested in the past. An arithmetic unit comprising a new test node specifying unit for specifying a new test node.

[Claim 2] In the arithmetic unit according to claim 1,

The safety function specifying unit determines the safety function associated with each of all the nodes that pass when the node added from the change to the node at the top of the failure tree is affected by the change. An arithmetic unit that is specified as a safety function that receives

[Claim 3] The arithmetic unit according to claim 1,

The retest node identification unit sets the highest node among the nodes added by the change as a target node, and the target node is the highest node in the failure tree after the change by the change. In the case, an arithmetic unit that does not add to the retest node.

[Claim 4] In the arithmetic unit according to claim 3,

If the upper gate connected to the target node is 80 gates, the retest node identifying unit may generate an event for each of the nodes connected to the 80 gate,

Below 0 gates \¥02020/175060 26 卩(：171?2020/004324

A computing device that adds a node that has been tested in the past to the retest node.

[Claim 5] In the arithmetic unit according to claim 1,

The new test node specifying unit sets the highest node among the nodes added by the change as a target node, and if the target node does not have the lower node, the target node is set to the new test node. A computing device that is added to the new test node when the target node has a lower node.

[Claim 6] In the arithmetic unit according to claim 5,

The new test node identification unit,

If the target node has lower nodes and the lower gate connected to the target node is 80 gates, the events of all the nodes connected to the target log node occur. In the case where the node having 80 gates or less is added to the new test node so that the target node has the lower node, the lower gate connected to the target node is In the case of _, the above 〇[¾_卜 or less of the above nodes are added to the new test node so that the event of any one of the above nodes connected to the above apparatus.

[Claim 7] It has a plurality of nodes, and at least one node of the plurality of nodes is

-For the fault tree associated with the safety function, the DO stores the configuration of the fault tree before the change, the configuration of the fault tree after the change, and the information indicating the node tested in the past for each safety function. A computer equipped with a storage unit

Identifying the safety function affected by the change based on information about the change in the fault tree;

Based on the modified fault tree configuration and the previously tested nodes, before retesting the identified safety function. \¥02020/175060 27 卩(：171?2020/004324

Identifying a retest node that is a node that has been tested in the past,

A computer that records a program for executing a new test node, which is a new test target node, based on the changed fault tree configuration and the previously tested nodes. A readable recording medium.