WO2021181712A1

WO2021181712A1 - Data processing device, data processing method, and program

Info

Publication number: WO2021181712A1
Application number: PCT/JP2020/015665
Authority: WO
Inventors: 融村田; 大介八木; 敦史上村; 田中　裕; 拓也谷口; 雄作小林
Original assignee: オムロン株式会社
Priority date: 2020-03-09
Filing date: 2020-04-07
Publication date: 2021-09-16
Also published as: JP6721140B1; JP2021140642A

Abstract

In the present invention, a processor moves data residing on a register to a first region of a memory in response to an save command, and restores the data residing on the first region to the register in response to a restore command. After execution of the move command, the processor writes the data residing on the first region to each of regions, starting with a second region and up to Nth region, in the memory. Before execution of the restore command, the processor compares the data residing on each of the regions, from the first region to the Nth region, with each other, and in response to a situation where the data residing on a majority of the regions match but the data residing on the first region does not match the data residing on the majority of the regions, overwrites the data residing on the first region with the data residing on the majority of the regions. This configuration makes it possible to prevent temporary stopping of the system caused by damage to data temporarily moved from the register to the memory.

Description

Data processing equipment, data processing methods and programs

This disclosure relates to data processing devices, data processing methods and programs.

With the increasing integration and miniaturization of semiconductor devices, transient bit errors (soft errors) in memory are rapidly increasing. Data is corrupted due to a soft error (data is garbled). Soft errors are caused, for example, by collisions of alpha particles and cosmic ray neutrons. Applying soft-error-prone memory to a system can result in a temporary system outage due to data corruption.

Technology has been developed to avoid temporary system outages due to data corruption. For example, Japanese Patent Application Laid-Open No. 2007-18414 (Patent Document 1) includes a control device that writes the same data to each of three or more different addresses in the RAM when rewriting the variable data of the RAM (Random Access Memory). It is disclosed. When the controller reads a variable by executing a program, it reads data from each of three or more different addresses in the RAM. Then, when any one data among the data read from three or more different addresses is different from the other plurality of data, the control device transfers the different data to the other plurality of data. Rewrite to data.

Japanese Unexamined Patent Publication No. 2007-18414

If a function process (subroutine) occurs during the execution of the main routine, a stack operation is performed to interrupt the main routine. The stack operations are (1) a save operation (so-called Push operation) that temporarily saves the data held in the register built in the processor to the stack area of the RAM at the start of the subroutine processing, and (2) a stack at the end of the subroutine processing. It includes a return operation (so-called Pop operation) for returning the data saved in the area to the register. A soft error can also occur in the stack area where data is temporarily saved by the stack operation. However, the code for stack operations associated with subroutine processing is automatically generated by the compiler. Therefore, when a general-purpose compiler is used, the technique described in Patent Document 1 cannot be applied to the stack operation.

The present disclosure has been made in view of the above problems, and an object thereof is a data processing device and data capable of suppressing a temporary stop of a system due to a corruption of data temporarily saved from a register to a memory. It is to provide a processing method and a program.

According to an example of the present disclosure, the data processing device includes a memory and a processor that executes arithmetic processing using the memory. The processor has a built-in register. The processor saves the data held in the register to the first area of the memory in response to the save instruction, and returns the data in the first area to the register in response to the return instruction. The processor executes the first process after executing the save instruction and executes the second process before executing the return instruction. The first process includes a process of writing the data of the first area to each of the second area to the Nth area in the memory. N is an integer of 3 or more. The second process is a process of collating the data of the first region to the Nth region with each other, and the data of the majority of the regions from the first region to the Nth region are matched, and the first region is the first region. This includes a process of overwriting the data of the majority area with the first area according to the fact that the data of the majority area does not match the data of the majority area.

According to this disclosure, even if a soft error occurs in the first area where the data is temporarily saved in response to the save instruction, the data in the first area is restored before the return command is executed. Therefore, the correct data is returned to the register in response to the return instruction. As a result, it is possible to suppress a temporary stop of the system due to the corruption of the data temporarily saved from the register to the memory.

In the above disclosure, the first area is included in the stack area set in the memory. The processor identifies the first area by referring to the stack pointer set in the stack area before and after the execution of the save instruction.

According to this disclosure, the processor can correctly identify the first area in the memory where the data is temporarily saved from the register.

In the above disclosure, the save instruction is issued for calling the function process. The return instruction is issued after the function processing is completed. The processor starts a second process upon completion of the function process. According to this disclosure, the data in the first region can be restored immediately before the execution of the return instruction.

According to an example of the present disclosure, the data processing device includes a memory and a processor that executes arithmetic processing using the memory. The processor has a built-in register. The data processing method of the data processing apparatus includes the first to fourth steps. The first step is a step in which the processor saves the data held in the register to the first area of the memory in response to the save instruction. The second step is a step in which the processor executes the first process after executing the save instruction. The third step is a step in which the processor executes the second process before executing the return instruction. The fourth step is a step in which the processor returns the data in the first region to the register in response to the return instruction. The first process includes a process of writing the data of the first area to each of the second area to the Nth area in the memory. N is an integer of 3 or more. The second process is a process of collating the data of the first region to the Nth region with each other, and the data of the majority of the regions from the first region to the Nth region are matched, and the first region is the first region. This includes a process of overwriting the data of the majority area with the first area according to the fact that the data of the majority area does not match the data of the majority area.

According to an example of the present disclosure, the program causes a computer to execute the above data processing method. These disclosures also make it possible to suppress a temporary stoppage of the system due to corruption of data temporarily saved from the register to the memory.

According to the present disclosure, it is possible to suppress a temporary stop of the system due to the corruption of the data temporarily saved from the register to the memory.

It is the schematic which shows the overall structure of the control system which concerns on embodiment. It is a figure which shows the outline of the data restoration process in the safety IO unit which concerns on embodiment. It is a schematic diagram which shows the hardware configuration example of a safety IO unit. It is a figure which shows the area of a main memory. It is a figure which shows an example of the process of writing data to a main memory. It is a figure which shows an example of the reading process of data from a main memory. It is a figure which shows the process which is executed after a Push operation. It is a figure which shows the process which is executed before Pop operation. It is a schematic diagram which shows the hardware configuration example of a standard PLC. It is a schematic diagram which shows the hardware configuration example of a safety PLC. It is a schematic diagram which shows the hardware configuration example of a coupler.

An embodiment of the present invention will be described in detail with reference to the drawings. The same or corresponding parts in the drawings are designated by the same reference numerals and the description thereof will not be repeated.

§1 Application example In various fields such as aerospace systems, automobiles, medical equipment, communication equipment, and industrial equipment, it is desirable to suppress temporary system outages caused by memory soft errors. The present disclosure may be applied to systems in such various fields. Hereinafter, a control system incorporated in the FA (factory automation) field will be described as an application example of the present disclosure, but the application example of the present disclosure is not limited to the control system.

FIG. 1 is a schematic view showing the overall configuration of the control system according to the embodiment. The control system 1 exemplified in FIG. 1 includes a standard PLC (programmable logic controller) 100, a safety PLC 200, one or more couplers 300, and one or more safety IO units 400 as main components. These devices included in the control system 1 are data processing devices that execute various tasks.

The standard PLC100 executes standard control for an arbitrary control target according to a standard control program created in advance. "Standard control" is a general term for processing for controlling a control target according to a predetermined requirement specification. The control target is, for example, a servo motor, a robot, or the like.

The safety PLC200 executes safety control for an arbitrary control target independently of the standard PLC100. The safety PLC 200 illustrated in FIG. 1 is connected to the standard PLC 100 via a local bus. "Safety control" is a general term for processing to prevent human safety from being threatened by equipment or machines. The "safety control" is designed to meet the requirements for realizing the safety function specified in, for example, IEC 61508.

The coupler 300 mediates the exchange of data between the standard PLC 100 and the safety IO unit 400. The coupler 300 is electrically connected to the standard PLC 100 via the field network 2. The field network 2 is a communication medium for realizing data transmission for FA. In the field network 2, frame transmission is possible at a predetermined cycle, and the data arrival time for each node in the network is guaranteed. As an example of such a protocol in which the data arrival time is guaranteed, EtherCAT (registered trademark) is adopted as the field network 2 in the control system 1 according to the present embodiment.

The coupler 300 transmits the data received from the standard PLC 100 to the safety IO unit 400, and when the data is received from the safety IO unit 400, prepares to store the received data in the next arriving frame.

The safety IO unit 400 is connected to the safety PLC 200 or the coupler 300 via the local bus. Further, any safety device (not shown) is connected to the safety IO unit 400. Safety devices include light curtains, emergency stop buttons, safety door switches and the like.

The safety IO unit 400 receives the input signal from the safety device and provides the input signal to the safety PLC 200. Alternatively, the safety IO unit 400 receives an input signal from the safety device and provides the input signal to the standard PLC 100 via the coupler 300. The input signal provided to the standard PLC100 is provided to the safe PLC200.

Further, the safety IO unit 400 outputs an output signal to the safety device in response to a command from the safety PLC 200. Alternatively, the safety IO unit 400 outputs an output signal to the safety device in response to a command from the safety PLC 200 via the coupler 300 and the standard PLC 100.

The safety IO unit 400 executes arithmetic processing related to receiving an input signal from the safety device, providing the input signal, outputting the output signal to the safety device, and the like at predetermined intervals.

The safety PLC 200 executes safety control in response to the input signal provided by the safety IO unit 400. For example, when the safety device, which is a light curtain, provides an input signal indicating the intrusion of a person, the safety PLC 200 cuts off the power supply to the controlled object of the standard PLC 100 and temporarily stops the control system 1. Alternatively, when the safety device, which is an emergency stop button, provides an input signal indicating that the button is pressed, the safety PLC 200 cuts off the power supply to the controlled object of the standard PLC 100 and temporarily stops the control system 1.

In this way, the safety IO unit 400 is directly involved in safety control to prevent human safety from being threatened. Therefore, the safety PLC 200 is designed to temporarily stop the control system 1 even when a failure or abnormality occurs in the safety IO unit 400.

In the safety IO unit 400, when a function process (subroutine) occurs during execution of the main routine, the data held in the register built in the processor is temporarily saved in the main memory, and the saved data is saved after the function process is completed. Is returned to the register. Evacuation of the data held in the register to the main memory is executed in response to the Push instruction which is an evacuation instruction. The return of the saved data to the register is executed in response to the Pop instruction which is a return instruction.

In the main memory, if a soft error occurs in the area where the data was temporarily saved, the temporarily saved data will be damaged. If the safety IO unit 400 continues to operate without repairing the corrupted data, the safety PLC 200 cannot normally execute the safety control. Therefore, the safety IO unit 400 has a function of recovering the data temporarily saved in the main memory even if the data is damaged.

FIG. 2 is a diagram showing an outline of data recovery processing in the safety IO unit according to the embodiment. The processor 402 and the main memory 404 shown in FIG. 2 are provided in the safety IO unit 400. The processor 402 includes a register 403.

The processor 402 saves the data held in the register 403 to the area 404a of the main memory 404 in response to the Push instruction (step S1).

After executing the Push instruction, the processor 402 writes the data in the area 404a to each of the two

areas

404b and 404c different from the area 404a in the main memory 404 (step S2). As a result, in the main memory 404, the data temporarily saved from the register 403 is tripled.

The processor 402 collates the data in the

areas

404a, 404b, and 404c with each other before executing the Pop instruction (step S3).

Further, the processor 402 determines that the data in the majority (that is, two) regions of the regions 404a to 404c match, and the data in the region 404a does not match the data in the majority region. Overwrite the data in the area 404a (step S4). If a soft error occurs in the area 404a between the completion of step S2 and the start of step S3, the data in the area 404a does not match the data in the

areas

404b and 404c. Therefore, the data in the

areas

404b and 404c is overwritten in the area 404a. This repairs the data corruption in region 404a.

After that, the processor 402 returns the data in the area 404a to the register 403 in response to the Pop instruction (step S5).

As described above, even if a soft error occurs in the area 404a between the completion of step S2 and the start of step S3, the data in the area 404a is restored in step S4. Therefore, correct data is returned to the register 403 as long as a soft error does not occur in the area 404a between the completion of step S4 and the start of step S5. As a result, it is possible to suppress a temporary stop of the system due to the corruption of the data temporarily saved from the register 403 to the main memory 404.

§2 Specific example <Hardware configuration of safety IO unit>
FIG. 3 is a schematic diagram showing a hardware configuration example of the safety IO unit. The safety IO unit 400 illustrated in FIG. 3 includes a processor 402, a main memory 404, a storage 410, a local bus controller 420, and a safety IO module 430. These components are connected via the processor bus 440.

The processor 402 corresponds to a calculation processing unit that executes control calculations related to signal input / output and management functions necessary for realizing safety control, and is composed of a CPU, an MPU (Micro Processing Unit), and the like. The processor 402 has a built-in register 403. The register 403 temporarily holds the calculation result of the processor 402, and holds the address when reading and writing the main memory 404.

The main memory 404 is composed of a volatile memory such as a DRAM or SRAM. The SRAM uses a flip-flop as the structure of the storage unit, does not require a refresh operation, and has an advantage that it can operate at a higher speed than the DRAM. Therefore, it is preferable to use SRAM as the main memory 404.

DRAM with a stack type structure has high soft error resistance. On the other hand, in SRAM having a flip-flop structure, soft error resistance is lowered due to miniaturization. Therefore, when the main memory 404 composed of highly integrated SRAM for increasing the capacity is used, a soft error is likely to occur in the main memory 404. Hereinafter, the main memory 404 will be described as being a SRAM.

The storage 410 is composed of, for example, a non-volatile storage device such as an SSD or an HDD. The storage 410 stores an executable program 41 for realizing the IO function, a write / read program 42, and a collation / repair program 43.

The local bus controller 420 exchanges data with a device (for example, safety PLC200, coupler 300) to which the safety IO unit 400 is connected via the local bus.

The safety IO module 430 is electrically connected to the safety device, accepts inputs such as detection results by the safety device, and outputs a signal to the safety device.

<Main memory>
FIG. 4 is a diagram showing an area of the main memory. As shown in FIG. 4, the main memory 404 includes a stack area 405, a data area 406, and a text area 407. The stack area 405 is an area for temporarily saving the data held in the register 403. The data area 406 is an area in which variables and the like are arranged. The text area 407 is an area where the program is expanded.

The processor 402 executes the instruction of the program expanded in the text area 407 line by line. The processor 402 reads the value of the variable from the data area 406 and writes the value of the variable to the data area 406 according to the instruction content.

The program expanded in the text area 407 (executable program 41 shown in FIG. 3 and the like) is generated by the compiler. The compiler generates a Push instruction when calling a function process (subroutine) during execution of the main routine, and generates a Pop instruction after the function process is completed. The processor 402 temporarily saves the data held in the register 403 to the stack area 405 according to the Push instruction. The processor 402 returns the data saved in the stack area 405 to the register 403 according to the Pop instruction.

A stack pointer SP is set in the stack area 405. The stack pointer SP indicates the start address of the data placed in the stack area 405. In other words, the stack pointer SP indicates the address of the last data placed in the stack area 405. When new data is placed in the stack area 405, the stack pointer SP is updated.

<Processing for data area of main memory>
The writing and reading of data to the data area 406 of the main memory 404 is executed by the processor 402 according to the write / read program 42.

FIG. 5 is a diagram showing an example of data writing processing to the main memory. As shown in FIG. 5, when writing the target data indicating the value of the specified variable to the data area 406 of the main memory 404, the processor 402 copies the target data twice and generates two copy data. ..

The processor 402 writes the target data in the partial area 406a of the data area 406, and writes the two copy data in the

partial areas

406b and 406c, respectively. The addresses of the

subregions

406a, 406b, and 406c are managed in association with variables. The processor 402 uses the address to write data to the

subregions

406a, 406b, 406c. As a result, the data is tripled in the main memory 404.

Immediately after writing, the data in the

partial areas

406a, 406b, 406c are the same. However, for example, due to the influence of cosmic rays and neutron rays, soft errors may occur in any of the

partial regions

406a, 406b, and 406c.

FIG. 6 is a diagram showing an example of data reading processing from the main memory. As shown in FIG. 6, the processor 402 reads data from the

partial areas

406a, 406b, 406c in the data area 406 of the main memory 404, and collates the data read from the

partial areas

406a, 406b, 406c with each other. Specifically, the processor 402 copies the data in the

partial regions

406a, 406b, and 406c to the register 403, and collates the data copied to the register 403 with each other.

If no soft error has occurred in any of the

partial areas

406a, 406b, 406c, all the data read from the

partial areas

406a, 406b, 406c match. Therefore, the processor 402 continues the arithmetic processing using the value indicated by the data read from the partial area 406a according to the fact that all the data read from the

partial areas

406a, 406b, and 406c match.

Even if a soft error occurs in one of the

subregions

406a, 406b, and 406c, the data read from the remaining two subregions will match. Therefore, the processor 402 matches the data read from the two subregions according to the fact that the data read from the two regions excluding one of the

subregions

406a, 406b, and 406c matches. The data read from the one subregion is rewritten. As a result, the data read from the one subregion on the register 403 is restored. After that, the processor 402 continues the arithmetic processing using the value indicated by the data read from the partial area 406a on the register 403.

Further, the processor 402 overwrites the data read from the two subregions with the one subregion in the data area 406 of the main memory 404. As a result, the data of the one partial area is restored even on the main memory 404.

In this way, even if a soft error occurs in one of the

subregions

406a, 406b, and 406c, the data in the one subregion is restored in the read processing.

<Processes executed in association with stack operations>
As described above, the processor 402 temporarily saves the data held in the register 403 to the stack area 405 according to the Push instruction (Push operation). The processor 402 restores the data saved in the stack area 405 to the register 403 according to the Pop instruction (Pop operation). Here, instead of the Push instruction, it is conceivable to issue an instruction to temporarily save the data held in the register 403 to three partial areas in the stack area 405. Then, instead of the Pop instruction, the data of the three sub-regions in the stack area 405 are collated with each other, and the data of the majority sub-region is matched according to the fact that the data of the majority sub-region of the three sub-regions matches. It is conceivable to issue an instruction to return the data to the register 403. However, the Push and Pop instructions are generated by the compiler. Therefore, as long as a general-purpose compiler is used, it is not possible to issue the above instructions in place of the Push instruction and the Pop instruction.

Therefore, in the safety IO unit 400, the following processing is executed in association with the stack operation. The following processing associated with the stack operation is performed by processor 402 according to collation repair program 43.

FIG. 7 is a diagram showing a process executed after the Push operation. FIG. 7 shows a process in which a Push instruction for calling the function process 20 is issued and executed after the Push operation in response to the Push instruction.

Processor 402 monitors the stack pointer SP in the stack area 405. The processor 402 identifies the partial area 405a of the stack area 405 from which the data has been saved by the Push operation by referring to the stack pointer SP before and after the stack operation (step S11).

The processor 402 writes the two copy data obtained by copying the data in the specified partial area 405a into the two

partial areas

406d and 406e in the data area 406, respectively (step S12).

As a result, in the main memory 404, the data temporarily saved in the stack area 405 by the Push operation is tripled.

FIG. 8 is a diagram showing a process executed before the Pop operation. FIG. 8 shows a process executed before the Pop operation corresponding to the Push operation shown in FIG. 7.

The processor 402 recognizes the completion of the function process 20 by executing the line "functionExit ();" indicating the completion of the function process 20 called after the Push instruction (step S21). After the function processing 20 is completed, a Pop instruction is issued to return to the main routine. Therefore, the processor 402 executes the following steps S22 and S23 after completing the function processing.

Upon recognizing the completion of the function processing 20, the processor 402 collates the data of the partial areas 405a of the stack area 405 and the data of the two

partial areas

406a and 406b of the data area 406 with each other (step S22).

The processor 402 repairs the

partial regions

405a, 406d, 406e according to the collation result of the data in the

partial regions

405a, 406d, 406e (step S23).

If no soft error has occurred in any of the

partial regions

405a, 406d, and 406e between the completion of step S12 shown in FIG. 7 and the start of step S22 in FIG. 8, the data is read from the

partial regions

405a, 406d, and 406e. All of the data are matched. In this case, since it is not necessary to repair the

partial regions

405a, 406d, and 406e, the process of step S23 is omitted.

Even if a soft error occurs in one of the

subregions

405a, 406d, and 406e, the data read from the remaining two subregions will match. Therefore, the processor 402 uses the data read from the two subregions to match the data read from the two subregions excluding one of the

subregions

405a, 406d, and 406e. Overwrite one subarea. As a result, the data in the one subregion is restored.

Specifically, when the data of the

partial regions

406d and 406e match and the data of the partial regions 405a do not match the data of the

partial regions

406d and 406e, the data of the

partial regions

406d and 406e are overwritten on the partial regions 405a. In FIG. 8, the data “00103333” in the partial area 405a does not match the data “00003333” in the

partial areas

406d and 406e. Therefore, the data "00003333" of the

partial areas

406d and 406e is overwritten on the partial area 405a. As a result, the data in the partial region 405a is restored.

The data in the

partial regions

406d and 406e are used for determining whether or not a soft error has occurred in the partial region 405a and for repairing the partial region 405a. Therefore, if the data in the

partial regions

405a and 406d match and the data in the partial region 406e does not match the data in the

partial regions

405a and 406d, the restoration of the data in the partial region 406e may be omitted. Similarly, if the data in the

partial regions

405a and 406e match and the data in the partial regions 406d do not match the data in the

partial regions

405a and 406e, the restoration of the data in the partial regions 406d may be omitted.

After that, the processor 402 returns the data in the partial area 405a to the register 403 in response to the Pop instruction. As described above, even if a soft error occurs in the partial region 405a between the completion of step S12 and the start of step S22, the data in the partial region 405a is restored by step S22 and step S23. Therefore, it is possible to suppress a temporary stop of the control system 1 due to a soft error in the stack area 405 in which data is temporarily saved in response to the stack operation.

If the data in the

partial regions

405a, 406d, and 406e are different from each other, it cannot be determined which data is correct. Therefore, the processor 402 may give an error notification when the data in the

partial regions

405a, 406d, and 406e are different from each other.

<Hardware configuration of other devices>
(Standard PLC hardware configuration)
FIG. 9 is a schematic diagram showing a hardware configuration example of a standard PLC. The standard PLC 100 illustrated in FIG. 9 includes a processor 102, a main memory 104, a storage 110, a field network controller 108, and a local bus controller 116. These components are connected via the processor bus 118.

The processor 102 mainly corresponds to an arithmetic processing unit that executes a control operation related to standard control, is composed of a CPU, a GPU, and the like, and has a built-in register 103. The processor 102 reads out the programs (as an example, the system program 1102 and the standard control program 1104) stored in the storage 110, expands them into the main memory 104, and executes them to perform control operations according to the control target. Realize various processes as described later.

The main memory 104 is composed of volatile memories such as DRAM (Dynamic Random Access Memory) and SRAM (Static Random Access Memory). The storage 110 is composed of, for example, a non-volatile storage device such as an SSD (Solid State Drive) or an HDD (Hard Disk Drive).

The storage 110 stores a system program 1102 for realizing basic functions, a standard control program 1104 created according to a control target, and setting information 1106 for defining processing in the standard PLC 100.

The field network controller 108 exchanges data with an arbitrary device (for example, a coupler 300) via the field network 2.

The local bus controller 116 exchanges data with an arbitrary unit (for example, a safety PLC200) connected to the standard PLC100 via the local bus.

(Hardware configuration of safety PLC)
FIG. 10 is a schematic diagram showing a hardware configuration example of the safety PLC. The safety PLC 200 illustrated in FIG. 10 includes a processor 202, a main memory 204, a storage 210, and a local bus controller 216. These components are connected via the processor bus 218.

The processor 202 mainly corresponds to a calculation processing unit that executes control calculations related to safety control, and is composed of a CPU, a GPU, and the like. The processor 202 includes a register 203.

The main memory 204 is composed of a volatile memory such as a DRAM or SRAM. The storage 210 is composed of, for example, a non-volatile storage device such as an SSD or an HDD.

The storage 210 stores a system program 2102 for realizing basic functions, a safety program 2104 created according to the required safety function, and setting information 2106 for defining processing in the safety PLC 200. NS.

The local bus controller 216 exchanges data with the safety IO unit 400 connected to the safety PLC 200 via the local bus.

(Hardware configuration of coupler)
FIG. 11 is a schematic view showing a hardware configuration example of the coupler. The coupler 300 illustrated in FIG. 11 includes a processor 302, a main memory 304, a storage 310, a field network controller 308, and a local bus controller 316. These components are connected via the processor bus 318.

The processor 302 mainly corresponds to an arithmetic processing unit that executes a control operation for operating the coupler 300, and is composed of a CPU, a GPU, and the like. The processor 302 includes a register 303.

The main memory 304 is composed of a volatile memory such as a DRAM or SRAM. The storage 310 is composed of, for example, a non-volatile storage device such as an SSD or an HDD.

The storage 310 stores the system program 3102 for realizing the basic functions and the setting information 3106 for defining the processing by the coupler 300.

The field network controller 308 exchanges data with an arbitrary device (for example, standard PLC100) via the field network 2.

The local bus controller 316 exchanges data with the safety IO unit 400 connected to the coupler 300 via the local bus.

<Action / effect>
As described above, the safety IO unit 400, which is a data processing device, includes a main memory 404 and a processor 402 that executes arithmetic processing using the main memory 404. The processor 402 includes a register 403. In response to the Push instruction, the processor 402 saves the data held in the register 403 to the partial area 405a of the stack area 405 in the main memory 404. The processor 402 returns the data in the partial area 405a to the register 403 in response to the Pop instruction. The processor 402 executes the first process after executing the Push instruction, and executes the second process before executing the Pop instruction. The first process includes a process of writing the data of the partial area 405a to each of the

partial areas

406d and 406e of the data area 406 in the main memory 404. The second process includes a process of collating the data of the

partial regions

405a, 406d, and 406e with each other. In the second process, the data of the

partial regions

406d and 406e are further matched, and the data of the partial regions 405a do not match the data of the

partial regions

406d and 406e. The process of overwriting the data in the partial area 405a is included.

According to the above configuration, even if a soft error occurs in the partial area 405a in which the data is temporarily saved in response to the Push instruction, the data in the partial area 405a is restored before the Pop instruction is executed. Therefore, the correct data is returned to the register 403 in response to the Pop instruction. As a result, it is possible to suppress a temporary stop of the system due to the corruption of the data temporarily saved from the register 403 to the main memory 404.

The partial area 405a is included in the stack area 405 set in the main memory 404. The processor 402 identifies the partial area 405a with reference to the stack pointer SP set in the stack area 405 before and after the execution of the Push instruction. As a result, the processor 402 can correctly identify the partial area 405a in which the data is temporarily saved from the register 403 in the main memory 404.

The Push instruction is issued for calling the function process 20. The Pop instruction is issued after the function processing 20 is completed. The processor 402 starts the second process described above in response to the completion of the function process 20. As a result, the data in the partial region 405a can be restored immediately before the execution of the Pop instruction.

<Modification example 1>
In the above description, the processor 402 writes the copy data obtained by copying the data temporarily saved in the partial area 405a in response to the Push instruction to the two

partial areas

406a and 406b in the data area 406, respectively. bottom. However, the processor 402 may write the copy data of the data in the partial area 405a to three or more partial areas in the data area 406. As a result, the data temporarily saved in the stack area 405 is multiplexed according to the Push instruction.

For example, the processor 402 writes the copy data of the data in the partial area 405a to the second partial area to the Nth partial area in the data area 406. N is an integer of 4 or more. Then, the processor 402 collates the data of the partial region 405a and the data of the second partial region to the Nth partial region with each other before executing the Pop instruction. In the processor 402, the data of the majority of the subregions 405a and the second subregion to the Nth subregion match, and the data of the subregion 405a does not match the data of the majority of the subregions. The data of the majority of the partial areas is overwritten on the partial area 405a accordingly. As a result, even if a soft error occurs in the partial region 405a, the data in the partial region 405a is restored.

<Modification 2>
The standard PLC 100, the safety PLC 200, and the coupler 300 may also perform the processes shown in FIGS. 7 and 8 in association with the stack operation in the same manner as the safety IO unit 400. As a result, the standard PLC100, the safety PLC200, and the coupler 300 can also repair the damage of the data temporarily saved in the stack area in response to the stack operation. As a result, the frequency of stopping the control system 1 is suppressed.

§3 Addendum As described above, this embodiment includes the following disclosures.

(Structure 1)
It is a data processing device (400)
Memory (404) and
A processor (402) that executes arithmetic processing using the memory (404) is provided.
The processor (402) has a built-in register (403).
The processor (402)
In response to the save instruction, the data held in the register (403) is saved in the first area (404a, 405a) of the memory (404).
In response to the return instruction, the data in the first region (404a, 405a) is returned to the register (403).
The processor (402) executes the first process after executing the save instruction, and executes the second process before executing the return instruction.
In the first process, the data in the first region (404a, 405a) is transferred from the second region (404b, 404c, 406d, 406e) in the memory (404) to the Nth region (404b, 404c, Includes processing to write to each of 406d, 406e)
N is an integer greater than or equal to 3
The second process is
A process of collating the data of the first region (404a, 405a) to the data of the Nth region (404b, 404c, 406d, 406e) with each other.
The data of the majority of the regions (404b, 404c, 406d, 406e) from the first region (404a, 405a) to the Nth region (404b, 404c, 406d, 406e) match, and the data of the first region (404a, 405a) A data processing apparatus including a process of overwriting the data of the majority area with the first area (404a, 405a) in response to the fact that the data does not match the data of the majority area.

(Structure 2)
The first area (405a) is included in the stack area (405) set in the memory (404).
The processor (402) is described in the configuration 1 in which the first area (404a, 405a) is specified by referring to the stack pointer set in the stack area (405) before and after the execution of the save instruction. Data processor.

(Structure 3)
The save instruction is issued to call the function processing, and is issued.
The return instruction is issued after the completion of the function processing (20).
The data processing apparatus according to

configuration

1 or 2, wherein the processor (402) starts the second process upon completion of the function process (20).

(Structure 4)
It is a data processing method of the data processing apparatus (400).
The data processing device (400)
Memory (404) and
A processor (402) that executes arithmetic processing using the memory (404) is provided.
The processor (402) has a built-in register (403).
The data processing method is
A step in which the processor (402) saves the data held in the register (403) to the first area (404a, 405a) of the memory (404) in response to the save instruction.
A step in which the processor (402) executes the first process after executing the save instruction, and
A step in which the processor (402) executes a second process before executing the return instruction.
The processor (402) includes a step of returning the data of the first region (404a, 405a) to the register in response to the return instruction.
In the first process, the data in the first region (404a, 405a) is transferred from the second region (404b, 404c, 406d, 406e) in the memory (404) to the Nth region (404b, 404c, Includes processing to write to each of 406d, 406e)
N is an integer greater than or equal to 3
The second process is
A process of collating the data of the first region (404a, 405a) to the data of the Nth region with each other, and
The data of the majority of the regions (404b, 404c, 406d, 406e) from the first region (404a, 405a) to the Nth region (404b, 404c, 406d, 406e) match, and the data of the first region (404a, 405a) A data processing method including a process of overwriting the data of the majority area with the first area (404a, 405a) in response to the fact that the data does not match the data of the majority area.

(Structure 5)
A program that causes a computer to execute the data processing method described in Configuration 4.

Although the embodiments of the present invention have been described, the embodiments disclosed this time should be considered to be exemplary in all respects and not restrictive. The scope of the present invention is indicated by the claims and is intended to include all modifications within the meaning and scope equivalent to the claims.

1 control system, 2 field network, 20 function processing, 41 executable program, 42 write / read program, 43 collation repair program, 100 standard PLC, 102, 202, 302, 402 processor, 103, 203, 303, 403 register, 104,204,304,404 main memory, 108,308 field network controller, 110,210,310,410 storage, 116,216,316,420 local bus controller, 118,218,318,440 processor bus, 200 safety PLC , 300 coupler, 400 safety IO unit, 404a to 404c area, 405 stack area, 405a, 406a to 406e partial area, 406 data area, 407 text area, 430 safety IO module, 1102, 2102, 3102 system program, 1104 standard control Program, 1106, 2106, 3106 setting information, 2104 safety program.

Claims

It is a data processing device
Memory and
A processor that executes arithmetic processing using the memory is provided.
The processor has a built-in register
The processor
In response to the save instruction, the data held in the register is saved in the first area of the memory.
In response to the return instruction, the data in the first area is returned to the register.
The processor executes the first process after executing the save instruction, and executes the second process before executing the return instruction.
The first process includes a process of writing data in the first area to each of the second area to the Nth area in the memory.
N is an integer greater than or equal to 3
The second process is
The process of collating the data from the first region to the Nth region with each other,
According to the fact that the data in the majority of the Nth regions from the first region match and the data in the first region does not match the data in the majority region, the majority region A data processing apparatus including a process of overwriting the first area with the data of the above.
The first area is included in the stack area set in the memory.
The data processing device according to claim 1, wherein the processor identifies the first area by referring to the stack pointer set in the stack area before and after the execution of the save instruction.
The save instruction is issued to call the function processing, and is issued.
The return instruction is issued after the function processing is completed.
The data processing device according to claim 1 or 2, wherein the processor starts the second process in response to the completion of the function process.
It is a data processing method of a data processing device.
The data processing device is
Memory and
A processor that executes arithmetic processing using the memory is provided.
The processor has a built-in register
The data processing method is
A step in which the processor saves the data held in the register to the first area of the memory in response to the save instruction.
A step in which the processor executes the first process after executing the save instruction, and
A step in which the processor executes a second process before executing the return instruction.
The processor includes a step of returning the data in the first region to the register in response to the return instruction.
The first process includes a process of writing data in the first area to each of the second area to the Nth area in the memory.
N is an integer greater than or equal to 3
The second process is
The process of collating the data from the first region to the Nth region with each other,
According to the fact that the data in the majority of the Nth regions from the first region match and the data in the first region does not match the data in the majority region, the majority region A data processing method including a process of overwriting the first area with the data of the above.
A program that causes a computer to execute the data processing method according to claim 4.