JP6797588B2 - Verification system - Google Patents

Description

Embodiments of the present invention relates to a verification system.

Conventionally, control devices (control systems) that monitor and control plants, field equipment, etc. have been required to operate continuously from the viewpoint of productivity and availability. However, if a bug or vulnerability is found in the controller program, the program needs to be updated, and in general, the controller needs to be stopped while the program is being updated. It is also necessary to verify that the program works properly after updating the program.

Japanese Unexamined Patent Publication No. 2016-31623

However, in the prior art, there is nothing that can update and verify a program without stopping the control device.

Therefore, the present invention has been made in view of such a situation, and an object of the present invention is to update and verify a program without stopping the control device.

The verification system of the embodiment implements a control device having a plurality of calculation units, and when updating a program of the control device, updates the program of one of the plurality of calculation units and verifies the operation. After that, if the verification result is appropriate, the remaining arithmetic units are also provided with a verification device that sequentially updates the program and verifies the operation. The control device has a mode storage unit that stores whether the current operation mode is a normal mode or a verification mode, and the plurality of arithmetic units that input data from the outside according to the operation mode. An input operation switching unit that switches to at least one of them, and an output operation switching unit that switches the output destination of the calculation result of each of the plurality of arithmetic units to either a control signal output unit or a verification result output unit according to the operation mode. The control signal output unit that outputs the control signal that is the calculation result received from the output operation switching unit to the controlled device and the verification result that is the calculation result received from the output operation switching unit are output to the verification device. A storage including the verification result output unit, the verification device stores the program and the update program used by the control device, and stores the verification data and the verification result received from the control device. When the mode storage unit transitions to the verification mode when updating the program of the control device and the unit, the update program is transmitted to one of the plurality of arithmetic units and the update program is transmitted. After verifying the operation with the verification data, if the verification result is appropriate, the verification unit that sequentially sends the update program to the remaining arithmetic units and verifies the operation with the verification data. And.

FIG. 1 is a block diagram showing a configuration example of the verification system of the first embodiment. FIG. 2 is an explanatory diagram of the operation of the verification system of the first embodiment in the normal mode. FIG. 3 is an explanatory diagram of the operation of the verification system of the first embodiment in the verification mode. FIG. 4 is a flowchart showing an operation example of the verification system of the first embodiment. FIG. 5 is a diagram showing an example of the verification result in the first embodiment. FIG. 6 is a flowchart showing an operation example of normal system comparison verification in the first embodiment. FIG. 7 is a diagram showing an example of abnormal system appropriate value data in the first embodiment. FIG. 8 is a flowchart showing an operation example of the abnormal system comparison verification in the first embodiment. FIG. 9 is a block diagram showing a configuration example of the verification system of the second embodiment. FIG. 10 is an explanatory diagram of the operation of the verification system of the second embodiment in the normal mode. FIG. 11 is an explanatory diagram of the operation of the verification system of the second embodiment in the verification mode. FIG. 12 is a flowchart showing an operation example of the verification system of the second embodiment. FIG. 13 is a diagram showing an example of normal system storage data in the second embodiment. FIG. 14 is a flowchart showing an operation example of normal system comparison verification in the second embodiment. FIG. 15A is a diagram showing a partial example of the verification program according to the second embodiment. FIG. 15B is a diagram showing an example of abnormal system storage data in the second embodiment. FIG. 16 is a flowchart showing an operation example of the abnormal system comparison verification in the second embodiment.

Hereinafter, the verification system and the verification method of the embodiment will be described with reference to the drawings. First, the first embodiment will be described with reference to FIGS. 1 to 8, and then the second embodiment will be described with reference to FIGS. 9 to 16.

(First Embodiment)
FIG. 1 is a block diagram showing a configuration example of the verification system S of the first embodiment. The verification system S includes a control device 1, a verification device 2, a controlled device 3, and a detection device 4.

The control device 1 is a computer device that monitors and controls a plant, field equipment, etc., and is a communication unit 101, an input operation switching unit 102, a first calculation unit 103, a second calculation unit 104, a first storage unit 105, and a first. 2. A storage unit 106, an output operation switching unit 107, a control signal output unit 108, a verification result output unit 109, a mode storage unit 110, and a detection signal input unit 111 are provided.

The communication unit 101 is an interface for transmitting and receiving data to and from the verification device 2. The input operation switching unit 102 is connected to the communication unit 101, the first calculation unit 103, and the second calculation unit 104, and refers to the mode storage unit 110 to perform data according to the operation mode (either normal mode or verification mode). The path of is switched between the first calculation unit 103 and the second calculation unit 104. The verification mode is a mode in which the verification device 2 verifies the update program of the control device 1 while the control device 1 controls the controlled device 3. Further, the normal mode is a mode in which the control device 1 controls the controlled device 3 other than the verification mode.

The first calculation unit 103 outputs the calculation result for the input information based on the control program or the like stored in the first storage unit 105. The first storage unit 105 is a storage means for storing a control program or the like.

The second calculation unit 104 outputs the calculation result for the input information based on the control program or the like stored in the second storage unit 106. The second storage unit 106 is a storage means for storing a control program or the like. In the following, when the first calculation unit 103 and the second calculation unit 104 are not particularly distinguished, they may be simply described as "calculation unit" without a code.

The output operation switching unit 107 is connected to the first calculation unit 103 and the second calculation unit 104, and refers to the mode storage unit 110 to verify the output destination of those calculation results with the control signal output unit 108 according to the operation mode. Switch to any of the result output units 109.

The control signal output unit 108 outputs a control signal, which is a calculation result received from the output operation switching unit 107, to the controlled device 3. The verification result output unit 109 outputs (transmits) the verification result, which is the calculation result received from the output operation switching unit 107, to the verification device 2.

The mode storage unit 110 stores whether the current operation mode is the normal mode or the verification mode. The control device 1 performs two types of different operations, a normal mode and a verification mode, depending on the state of the mode storage unit 110. For example, when the mode storage unit 110 transitions from the normal mode to the verification mode, the input operation switching unit 102 refers to the mode storage unit 110 and inputs the verification data received from the verification device 2 only to the calculation unit to be updated. Switch the data path so that it does. Further, the output operation switching unit 107 refers to the mode storage unit 110 and switches the data path so as to output the verification result of the calculation unit to be updated to the verification result output unit 109.

The operation mode held in the mode storage unit 110 may be changed by transmission information from the user terminal (not shown) or the verification device 2, or may be changed by physical switching of a DIP switch or the like. Good. The detection signal input unit 111 receives the input information from the detection device 4.

When the verification device 2 updates the program of the control device 1, after updating the program of one of the first calculation unit 103 and the second calculation unit 104 and verifying the operation, if the verification result is appropriate. The other is also a computer device that updates the program and verifies the operation. The verification device 2 includes a communication unit 21, a verification signal input unit 22, a verification unit 23, and a storage unit 24.

The communication unit 21 is an interface for transmitting and receiving data to and from the control device 1. The verification signal input unit 22 inputs the verification signal output from the control device 1.

When the mode storage unit 110 transitions to the verification mode when updating the program of the control device 1, the verification unit 23 transmits the update program to one of the first calculation unit 103 and the second calculation unit 104. After verifying the operation with the verification data, if the verification result is appropriate, the update program is sent to the other and the operation is verified with the verification data. Further, for example, the verification unit 23 determines whether or not the output value and the timing are appropriate for the verification result of the calculation unit.

Further, for example, the verification unit 23 transmits the data of the abnormal system test as verification data to the calculation unit to be updated, and the error code transmitted by the calculation unit corresponding to the output value of the abnormal system test. Based on this, it is determined whether or not the operation of the calculation unit is appropriate. Further, for example, when the verification unit 23 determines that the operation after the update is inappropriate to the calculation unit to be updated, the verification unit 23 re-distributes the pre-update program.

The storage unit 24 stores programs, update programs, verification data, normal system appropriate value data, abnormal system appropriate value data, verification results, and the like.

The program (pre-update program) and the update program are used by the control device 1. The verification data is composed of normal system verification data and abnormal system verification data. The normal system verification data is the data used for verification in the normal system test. The normal system test is a test to check whether a proper output is output for a normal input.

On the other hand, the abnormal system verification data is data used for verification in the abnormal system test. The abnormal system test is a test for checking whether an appropriate output (for example, an output of an appropriate error code) is output for an abnormal input.

The normal system appropriate value data is the correct answer data of the normal system test, that is, the data for determining whether or not the normal system test is appropriate. The abnormal system appropriate value data is the correct answer data of the abnormal system test, that is, the data for determining whether or not the abnormal system test is appropriate. The verification results are the results of the normal system test and the results of the abnormal system test.

The controlled device 3 is a device controlled by the control device 1. The detection device 4 is various sensors that output a detection signal.

Next, the operation of the verification system S in the normal mode will be described. FIG. 2 is an explanatory diagram of the operation of the verification system S of the first embodiment in the normal mode. In the normal mode, when the input operation switching unit 102 receives data input information such as DI (Digital Input) and AI (Analog Input) from the detection device 4 via the detection signal input unit 111 (S1, S2), the first calculation is performed. Transfer to both the unit 103 and the second calculation unit 104 (S3, S4).

The first calculation unit 103 uses this input value (data input information) to perform a calculation based on the control program stored in the first storage unit 105, and sends the calculation result to the output operation switching unit 107 (S5). Further, the second calculation unit 104 uses this input value (data input information) to perform a calculation based on the control program stored in the second storage unit 106 (same as the control program stored in the first storage unit 105). Then, the calculation result is sent to the output operation switching unit 107 (S6).

The output operation switching unit 107 sends the received calculation result to the control signal output unit 108 (S7). At this time, the output operation switching unit 107 may perform data selection processing such as duplication comparison collation of the received calculation result and first-come-first-served priority processing. Next, the control signal output unit 108 transmits the calculation result (control signal) to the controlled device 3 (S8). The controlled device 3 (actuator or the like) is controlled by the received calculation result (control signal). In the normal mode, the verification device 2 is not used and may be excluded.

Next, the operation of the verification system S in the verification mode will be described. FIG. 3 is an explanatory diagram of the operation of the verification system S of the first embodiment in the verification mode. When updating the program of the control device 1, the user switches the operation mode of the mode storage unit 110 from the normal mode to the verification mode. As a result, the input operation switching unit 102 and the output operation switching unit 107 switch the data path.

First, the first calculation unit 103 executes the same operation as in the normal mode (S1 → S2 → S3 → S5 → S7 → S8).

On the other hand, the data flow during program update and verification operations is as shown by the broken line in FIG. Hereinafter, a specific description will be given with reference to FIG. FIG. 4 is a flowchart showing an operation example of the verification system S of the first embodiment.

First, the verification unit 23 of the verification device 2 transmits the update program stored in the storage unit 24 to the second calculation unit 104 of the control device 1 (S101). The second calculation unit 104 receives (downloads) the update program (S102).

Next, the verification unit 23 executes the normal system test in S103 to S108. Specifically, the verification unit 23 transmits the normal system verification data (data imitating the detection signal from the detection device 4) stored in the storage unit 24 to the second calculation unit 104 (S103). The second calculation unit 104 receives the normal system verification data (S104). Next, the second calculation unit 104 executes a control calculation using the update program and the normal system verification data (S105), and outputs the calculation result to the verification device 2 (S106). The verification device 2 receives the calculation result (S107).

Next, the verification unit 23 compares and verifies the normal system using the received calculation result (S108), and stores the verification result (verification result of the normal system test) shown in FIG. 5 in the storage unit 24. Here, FIG. 5 is a diagram showing an example of the verification result in the first embodiment. Regarding the verification results of FIG. 5, in order from the left, the verification input values are normal system verification data. The verification input value may be all from the minimum to the maximum that the control device 1 can take, or may be thinned out. The assumed value is correct answer data (normal system appropriate value data). The read value is the calculation result by the second calculation unit 104. The time difference from the previous output is an actually measured value, and "8 to 12 ms" is set as an allowable range. This permissible range may be set for each user, or may be defined in advance by the vendor as a specification. The judgment is OK (appropriate) or NG (inappropriate).

Next, an operation example of the normal system comparison verification (S108) will be described. FIG. 6 is a flowchart showing an operation example of normal system comparison verification in the first embodiment. The verification unit 23 executes S1082 to S1084 for all the verification input values (S1081 to S1085). However, if No in either S1082 or S1083, the process ends at that point.

In S1082, the verification unit 23 determines whether or not the read value is the same as the assumed value, and if Yes, the process proceeds to S1083, and if No, the process proceeds to S1086. In S1083, the verification unit 23 determines whether or not the time difference from the previous output is within the allowable range, and if Yes, the process proceeds to S1084, and if No, the process proceeds to S1086. In S1084, the verification unit 23 saves OK as a determination result in the verification result (FIG. 5).

In S1086, the verification unit 23 saves NG as a determination result in the verification result (FIG. 5). After that, the verification unit 23 distributes the pre-update program stored in the storage unit 24 to the second calculation unit 104 (S1087). This is because the update did not work properly. After that, the verification unit 23 ends the verification (S1088) and ends the process. After passing through this S1088, the process of FIG. 4 is also stopped. Also, the operation mode is returned from the verification mode to the normal mode. When S108 is terminated via S1085, the process returns to the process of FIG.

Returning to FIG. 4, after S108, the verification unit 23 executes the abnormal system test in S109 to S114. Specifically, the verification unit 23 transmits the abnormal system verification data stored in the storage unit 24 to the second calculation unit 104 (S109). The second calculation unit 104 receives the abnormal system verification data (S110). Next, the second calculation unit 104 executes error detection using the update program and the abnormal system verification data (S111), and transmits the error code to the verification device 2 (S112). The verification device 2 receives the error code (S113).

As described above, the abnormal system test is a test for checking whether an appropriate output is obtained for an abnormal input. Further, the abnormal system appropriate value data is the correct answer data of the abnormal system test, that is, the data for determining whether or not the abnormal system test is appropriate. FIG. 7 is a diagram showing an example of abnormal system appropriate value data in the first embodiment. As shown in FIG. 7, in the abnormal system appropriate value data, an error type and an error code are associated with each other.

An error code "0000" is associated with an error whose numerical value is out of the permissible range. An error in which the numerical value is out of the allowable range is, for example, a case where a numerical value of "21" is received when the allowable range is "0" to "20".

Further, an error code "0001" is associated with an error whose data content is abnormal. An error in which the data content is abnormal is, for example, a case where the data size is inappropriate.

Further, an error code "0010" is associated with the error of the dark decoding abnormality. The error of the dark decoding abnormality is, for example, a case where the first data should always be "0123" when the encrypted data is decrypted, but it is different data.

Returning to FIG. 4, after S113, the verification unit 23 compares and verifies the abnormal system using the received error code (S114), and stores the verification result (not shown) in the storage unit 24. Next, an operation example of the abnormal system comparison verification (S114) will be described. FIG. 8 is a flowchart showing an operation example of the abnormal system comparison verification in the first embodiment. The verification unit 23 executes S1142 and S1143 for all the verification input data (abnormal system verification data) (S1141 to S1144). However, if No in S1142, the process ends at that point.

In S1142, the verification unit 23 determines whether or not the received error code is appropriate, and if Yes, the process proceeds to S1143, and if No, the process proceeds to S1145. In S1142, for example, when the permissible range of numerical values is "0" to "20" and the numerical value "21" is the verification input data, it is appropriate if the error code "0000" is received (Yes). , If other data (error code other than "0000", etc.) is received, it is inappropriate (No). In S1143, the verification unit 23 saves OK as a determination result in the verification result.

In S1145, the verification unit 23 stores NG as a determination result in the verification result. After that, the verification unit 23 distributes the pre-update program stored in the storage unit 24 to the second calculation unit 104 (S1146). This is because the update did not work properly. After that, the verification unit 23 ends the verification (S1147) and ends the process. After passing through this S1147, the process of FIG. 4 is also stopped. Also, the operation mode is returned from the verification mode to the normal mode. When S114 is terminated via S1144, the process returns to the process of FIG.

Returning to FIG. 4, after S114, the verification unit 23 transmits the pre-update program stored in the storage unit 24 to the second calculation unit 104 (S115). The second calculation unit 104 receives (downloads) the pre-update program (S116). Here, returning the second arithmetic unit 104 to the pre-update program is to cause the second arithmetic unit 104 to execute the same processing as in the normal mode during the update and verification of the program of the first arithmetic unit 103. Because.

Next, in S117 to S130, the verification unit 23 updates and verifies the program of the first calculation unit 103, but since it is the same as in S101 to S114, the description thereof will be omitted.

After S130, that is, when there is no problem in updating and verifying the programs in both the second calculation unit 104 and the first calculation unit 103, the verification unit 23 transfers the update program stored in the storage unit 24 to the first control device 1. 2 Transmission to the calculation unit 104 (S131). The second calculation unit 104 receives (downloads) the update program (S132). As a result, both the second calculation unit 104 and the first calculation unit 103 have been updated to the update program. After that, the mode storage unit 110 transitions from the verification mode to the normal mode.

As described above, according to the verification system S of the first embodiment, the program can be updated and verified without stopping the control device 1. Specifically, when the mode storage unit 110 transitions to the verification mode when updating the program of the control device 1, the verification unit 23 of the verification device 2 can be used as one of the first calculation unit 103 and the second calculation unit 104. On the other hand, after sending the update program and verifying the operation with the verification data for both the normal system test and the abnormal system test, if the verification result is appropriate, the same operation is executed for the other. As a result, not only the program of the control device 1 can be updated, but also the operation after the update can be guaranteed.

(Second Embodiment)
Next, the verification system S of the second embodiment will be described. The same components as those in the first embodiment are designated by the same reference numerals, and duplicate description will be omitted as appropriate. FIG. 9 is a block diagram showing a configuration example of the verification system S of the second embodiment.

The control device 1 of FIG. 9 is different from the control device 1 of FIG. 1 in that the verification result output unit 109 is not provided.

Further, the verification device 2 of FIG. 9 is different from the verification device 2 of FIG. 1 in the following points. First, there is no verification signal input unit 22. Further, the storage unit 24 further stores a verification program including a normal system verification program and an abnormal system verification program. That is, in the second embodiment, the verification is performed using not the update program but a verification program having the same calculation content as the update program and having a verification result transmission function. In the case of the verification program, unlike the update program, as shown in FIG. 11, the control device 1 does not transmit the calculation result to the output operation switching unit 107. Further, the verification program has a function of holding the calculation result and transmitting the verification input value, the calculation result (output value) based on the verification input value, and the calculation cycle to the verification device 2 (FIG. 13). ..

Further, the verification device 2 may be a local device installed at the same location as the control device 1, or may be installed at a remote location such as a cloud server.

Further, for example, when the mode storage unit 110 transitions to the verification mode when updating the program of the control device 1, the verification unit 23 applies a verification program to one of the first calculation unit 103 and the second calculation unit 104. If the verification result received from one of the executions of the verification program is appropriate, the verification program is also transmitted to the other.

Further, for example, if the verification unit 23 transmits the verification program to one of the first calculation unit 103 and the second calculation unit 104, and the verification result received from the execution of the verification program is appropriate. , Deliver updates to one of them.

Further, for example, the verification unit 23 transmits a verification program to one of the first calculation unit 103 and the second calculation unit 104, and the verification result received from the execution of the verification program is inappropriate. If so, the pre-update program will be distributed to one of them again.

Further, for example, the verification unit 23 transmits a normal system verification program to the calculation unit to be updated, and the calculation result received from the calculation unit that executes the normal system verification program and the normal system appropriate value data of the storage unit 24. Based on, it is determined whether or not the operation of the calculation unit is appropriate.

Further, for example, the verification unit 23 transmits an abnormal system verification program to the calculation unit to be updated, and the calculation result received from the calculation unit that executes the abnormal system verification program and the abnormal system appropriate value data of the storage unit 24. Based on, it is determined whether or not the operation of the calculation unit is appropriate.

Next, the operation of the verification system S in the normal mode will be described. FIG. 10 is an explanatory diagram of the operation of the verification system S of the second embodiment in the normal mode. Since S21 to S28 in FIG. 10 are the same as S1 to S8 in FIG. 2, description thereof will be omitted.

Next, the operation of the verification system S in the verification mode will be described. FIG. 11 is an explanatory diagram of the operation of the verification system S of the second embodiment in the verification mode. When updating the program of the control device 1, the user switches the operation mode of the mode storage unit 110 from the normal mode to the verification mode. As a result, the input operation switching unit 102 and the output operation switching unit 107 switch the data path.

First, the first calculation unit 103 executes the same operation as in the normal mode (S21 → S22 → S23 → S25 → S27 → S28).

On the other hand, the flow of data during the operation of program update and verification is as shown by the broken line in FIG. Hereinafter, a specific description will be given with reference to FIG. FIG. 12 is a flowchart showing an operation example of the verification system S of the second embodiment.

First, the verification unit 23 of the verification device 2 transmits the verification program (both the normal system verification program and the abnormal system verification program) stored in the storage unit 24 to the second calculation unit 104 of the control device 1 (S201). The second calculation unit 104 receives (downloads) the verification program (S202).

Next, the verification unit 23 executes the normal system test in S203 to S208. Specifically, the verification unit 23 transmits the normal system verification data stored in the storage unit 24 to the second calculation unit 104 (S203). The second calculation unit 104 receives the normal system verification data (S204). Next, the second calculation unit 104 executes a control calculation using the normal system verification program and the normal system verification data (S205), saves (accumulates) the calculation result (output value), and then collects a set. The calculation result is transmitted to the verification device 2 (S206). The verification device 2 receives the calculation result (S207).

Here, FIG. 13 is a diagram showing an example of normal system storage data (a set of calculation results) in the second embodiment. Regarding the normal system storage data of FIG. 13, the verification input values are the normal system verification data in order from the left. The calculation result is the result of calculation based on the verification input value. The calculation cycle is the time length of the calculation.

Returning to FIG. 12, after S207, the verification unit 23 compares and verifies the normal system using the received calculation result (S208), and stores the verification result (similar to FIG. 5) in the storage unit 24. An operation example of this normal system comparison verification (S208) will be described. FIG. 14 is a flowchart showing an operation example of normal system comparison verification in the second embodiment.

The verification unit 23 executes S2082 to S2084 for all the verification input values (S2081 to S2085). However, if No is obtained in either S2082 or S2083, the process ends at that point.

In S2082, the verification unit 23 determines whether or not the calculation result (FIG. 13) is the same as the assumed value (FIG. 5). If Yes, the process proceeds to S2083, and if No, the process proceeds to S2086. In S2083, the verification unit 23 determines whether or not the calculation cycle (FIG. 13) is within the permissible range (FIG. 5), and if Yes, the process proceeds to S2084, and if No, the process proceeds to S2086. In S2084, the verification unit 23 saves OK as a determination result in the verification result.

In S2086, the verification unit 23 saves NG as a determination result in the verification result. After that, the verification unit 23 distributes the pre-update program stored in the storage unit 24 to the second calculation unit 104 (S2087). This is because the verification program did not work properly. After that, the verification unit 23 ends the verification (S2088) and ends the process. After passing through this S2088, the process of FIG. 12 is also stopped. Also, the operation mode is returned from the verification mode to the normal mode. When S208 is terminated via S2085, the process returns to the process of FIG.

Returning to FIG. 12, after S208, the verification unit 23 executes the abnormal system test in S209 to S214. Specifically, the verification unit 23 transmits the abnormal system verification data (abnormal system test number) stored in the storage unit 24 to the second calculation unit 104 (S209). The second calculation unit 104 receives the abnormal system verification data (S210). Next, the second calculation unit 104 executes error detection using the abnormality system verification program and the abnormality system verification data (S211), saves (accumulates) the error code, and then verifies it as a set of calculation results. It is transmitted to the device 2 (S212). The verification device 2 receives the calculation result (S213).

The data transmission timing from the second calculation unit 104 to the verification device 2 in S206 or S212 may be for each predetermined unit of processing, may be when a certain number of data sizes are stored, or all. It may be the case when the processing of is completed.

Here, FIG. 15A is a diagram showing a part of an example of the verification program in the second embodiment. FIG. 15B is a diagram showing an example of abnormal system storage data (a set of calculation results) in the second embodiment. In this verification program, in normal processing, a is calculated by adding b and c (L1 in FIG. 15 (a)), and a and d match (L5 and L6 in FIG. 15 (a)). Then, in the test (TEST1) of the abnormal system test number "1", by adding 1 to a (L3 in FIG. 15A), it becomes possible to create an environment in which a ≠ d (FIG. 15A). L7 to L9). The "ERROR" in L8 in FIG. 15A means an error code (for example, "0000"). By preparing a plurality of such abnormal system tests, it is possible to create abnormal system stored data (a set of calculation results) as shown in FIG. 15B. Further, the information shown in FIG. 15B is stored as a correct answer table in the abnormal system appropriate value data of the storage unit 24 of the verification device 2. If such a verification program is used, the processing of S209 and S210 in FIG. 12 can be omitted.

Returning to FIG. 12, after S213, the verification unit 23 compares and verifies the abnormal system using the received calculation result (error code) (S214), and stores the verification result (not shown) in the storage unit 24. Next, an operation example of the abnormal system comparison verification (S214) will be described. FIG. 16 is a flowchart showing an operation example of the abnormal system comparison verification in the second embodiment. The verification unit 23 executes S2142 and S2143 for the tests of all the abnormal system test numbers (S2141 to S2144). However, if No in S2142, the process ends at that point.

In S2142, the verification unit 23 determines whether or not the error code is appropriate, and if Yes, proceeds to S2143, and if No, proceeds to S2145. In S2143, the verification unit 23 saves OK as a determination result in the verification result.

In S2145, the verification unit 23 stores NG as a determination result in the verification result. After that, the verification unit 23 distributes the pre-update program stored in the storage unit 24 to the second calculation unit 104 (S2146). This is because the verification program did not work properly. After that, the verification unit 23 ends the verification (S2147) and ends the process. After passing through this S2147, the process of FIG. 12 is also stopped. Also, the operation mode is returned from the verification mode to the normal mode. When S214 is terminated via S2144, the process returns to the process of FIG.

Returning to FIG. 12, after S214, the verification unit 23 transmits the pre-update program stored in the storage unit 24 to the second calculation unit 104 (S215). The second calculation unit 104 receives (downloads) the pre-update program (S216). Here, returning the second arithmetic unit 104 to the pre-update program is to cause the second arithmetic unit 104 to execute the same processing as in the normal mode during the update and verification of the program of the first arithmetic unit 103. Because.

Next, the verification unit 23 updates and verifies the program of the first calculation unit 103 in S217 to S230, but the description is omitted because it is the same as in S201 to S214.

After S230, that is, when there is no problem in updating and verifying the programs in both the second calculation unit 104 and the first calculation unit 103, the verification unit 23 transfers the update program stored in the storage unit 24 to the first control device 1. 2 Transmission to the calculation unit 104 and the first calculation unit 103 (S231). The second calculation unit 104 and the first calculation unit 103 receive (download) the update program (S232, S233). As a result, both the second calculation unit 104 and the first calculation unit 103 have been updated to the update program. After that, the mode storage unit 110 transitions from the verification mode to the normal mode.

As described above, according to the verification system S of the second embodiment, the program can be updated and verified without stopping the control device 1. Specifically, when the mode storage unit 110 transitions to the verification mode when the program of the control device 1 is updated, the verification unit 23 of the verification device 2 may be placed on one of the first calculation unit 103 and the second calculation unit 104. On the other hand, after sending the verification program and performing both the normal system test and the abnormal system test, if the verification result is appropriate, the same operation is executed for the other. As a result, not only the program of the control device 1 can be updated, but also the operation after the update can be guaranteed. Further, since the actual output value from the control device 1 is not used when the control device 1 is verified, the verification device 2 can be installed at a distant place, and the convenience is improved.

Although some embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other embodiments, and various omissions, replacements, and changes can be made without departing from the gist of the invention. These embodiments and modifications thereof are included in the scope and gist of the invention, and are also included in the scope of the invention described in the claims and the equivalent scope thereof.

For example, even when there are three or more arithmetic units in the control device 1, the program is updated and the operation is verified in order for each arithmetic unit, so that the control device 1 is not stopped. You can update and verify the program.

1 Control device 101 Communication unit 102 Input operation switching unit 103 1st calculation unit 104 2nd calculation unit 105 1st storage unit 106 2nd storage unit 107 Output operation switching unit 108 Control signal output unit 109 Verification result output unit 110 Mode storage unit 111 Detection signal input unit 2 Verification device 21 Communication unit 22 Verification signal input unit 23 Verification unit 24 Storage unit 3 Controlled device 4 Detection device S Verification system

Claims (10)

A control device with multiple arithmetic units and
When updating the program of the control device, after updating the program of one of the plurality of arithmetic units and verifying the operation, if the verification result is appropriate, the remaining arithmetic units Also equipped with a verification device that sequentially updates the program and verifies its operation .
The control device
A mode storage unit that stores whether the current operation mode is normal mode or verification mode,
An input operation switching unit that switches the input destination of input data from the outside to at least one of the plurality of arithmetic units according to the operation mode.
An output operation switching unit that switches the output destination of the calculation result of each of the plurality of calculation units to either the control signal output unit or the verification result output unit according to the operation mode.
The control signal output unit that outputs the control signal that is the calculation result received from the output operation switching unit to the controlled device, and the control signal output unit.
A verification result output unit that outputs a verification result, which is a calculation result received from the output operation switching unit, to the verification device is provided.
The verification device is
A storage unit that stores the program and the update program used by the control device, and also stores the verification data and the verification result received from the control device.
When the mode storage unit transitions to the verification mode when updating the program of the control device, the update program is transmitted to one of the plurality of arithmetic units, and the verification data is transmitted. If the verification result is appropriate, the update program is sequentially transmitted to the remaining arithmetic units, and the verification unit that verifies the operation using the verification data is performed. A verification system to prepare . When the mode storage unit transitions from the normal mode to the verification mode,
With reference to the mode storage unit, the input operation switching unit switches the data path so that the verification data received from the verification device is input only to the calculation unit to be updated.
The verification system according to claim 1 , wherein the output operation switching unit switches a data path so as to output the verification result of the calculation unit to be updated to the verification result output unit with reference to the mode storage unit. The verification unit according to claim 1 or 2 , wherein the verification unit of the verification device determines whether or not the output value by the calculation unit and the timing of the output are appropriate for the verification result of the calculation unit. Verification system. The verification unit of the verification device transmits the data of the abnormal system test as the verification data to the arithmetic unit to be updated, and the error transmitted by the arithmetic unit corresponding to the output value of the abnormal system test. based on the code, the verification system of any one of claims 3 or operation proper or not of the computation unit determines, from the claims 1. Verification of the verification apparatus, with respect to the calculation of the updated, if the operation after update is determined to be a improper delivers again before the update of the program, claims 1 to 4 The verification system described in any one of the above. A control device with multiple arithmetic units and
When updating the program of the control device, after updating the program of one of the plurality of arithmetic units and verifying the operation, if the verification result is appropriate, the remaining arithmetic units Also equipped with a verification device that sequentially updates the program and verifies its operation .
The control device is
A mode storage unit that stores whether the current operation mode is normal mode or verification mode,
An input operation switching unit for switching an input destination of input data from the outside to at least one of the plurality of arithmetic units according to the operation mode is provided.
The verification device is
A storage unit that stores the program, the update program, the verification program that has the same calculation content as the update program and has the verification result transmission function, and stores the verification result received from the control device.
When the mode storage unit transitions to the verification mode when updating the program of the control device, the verification program is transmitted to one of the plurality of arithmetic units, and the verification program is transmitted. If the verification result received from the executed calculation unit is appropriate, the remaining calculation units are also provided with a verification unit that sequentially transmits the verification program and performs verification based on the verification result by the verification program. , Verification system. If the verification unit of the verification device transmits the verification program to one of the plurality of calculation units and the verification result received from the calculation unit that executes the verification program is appropriate. The verification system according to claim 6 , wherein the update program is delivered to the calculation unit. The verification unit of the verification device transmits the verification program to one of the plurality of calculation units, and the verification result received from the calculation unit that executes the verification program is inappropriate. For example, the verification system according to claim 6 , wherein the program before the update is re-distributed to the calculation unit. The storage unit of the verification device stores normal system appropriate value data which is correct answer data of the verification result by the verification program for normal system test.
The verification unit of the verification device transmits the verification program for normal system test to the calculation unit to be updated, and the calculation result received from the calculation unit that executes the verification program and the storage unit The verification system according to any one of claims 6 to 8 , which determines whether or not the operation of the calculation unit is appropriate based on the normal system appropriate value data. The verification unit of the verification device transmits the verification program for the abnormality system test to the calculation unit to be updated, and the calculation unit executes the verification program to correspond to the output value of the abnormality system test. The verification system according to any one of claims 6 to 9 , wherein it is determined whether or not the operation of the calculation unit is appropriate based on the error code transmitted.

Images