JP7613245B2 - Information processing device and error recovery method - Google Patents

Description

The present invention relates to an information processing device and an error recovery method.

In recent years, DCS (Distributed Control Systems) and SIS (Safety Instrumented Systems) have become increasingly important in plants. DCS, SIS, and other FA (Factory Automation) equipment used in plants often contain FPGAs (Field Programmable Gate Arrays), which are integrated circuits.

FPGAs have a risk of data inversion in the internal configuration memory CRAM (Configuration Random Access Memory) and logic circuits FF (Flip-Flop) due to the effects of neutron rays caused by cosmic rays, known as soft errors. Therefore, when configuring logic that requires reliability, measures to prevent this are necessary.

JP 2014-052781 A

However, even if a soft error occurs in an FPGA, it is difficult to effectively maintain the normal state of the output signal. This is because, with the above technology, it is difficult to repair the circuit damage caused by the data inversion in the CRAM and to immediately repair the data inversion in the FF.

In order to solve the above-mentioned problems and achieve the object, the information processing device according to the present invention is characterized in that it comprises processing circuits set for each frame, each of which acquires the output results of each processing circuit and selects and outputs them by majority vote, and an integrated circuit including a configuration memory that stores information about each processing circuit and a repair unit that detects and repairs soft errors in the configuration memory.

The error repair method according to the present invention is characterized in that, in an information processing device having each processing circuit set for each frame and an integrated circuit, the processing circuits acquire the output results of the processing circuits that have executed processing for each frame, select and output the selected result by majority vote, and the integrated circuit executes a process to detect and repair soft errors in a configuration memory that stores information about each processing circuit.

The present invention effectively maintains the normal state of the output signal even if a soft error occurs in the FPGA.

FIG. 2 is a diagram illustrating an example of the configuration of an FPGA according to an embodiment. FIG. 1 is a diagram showing an example of soft error occurrence in a CRAM and a FF on an FPGA. FIG. 1 is a diagram showing an overview of a conventional soft error countermeasure 1. 1 is a time chart showing an output state of a circuit of a conventional soft error countermeasure 1. FIG. 1 is a diagram showing an overview of a conventional soft error countermeasure 2. 1 is a time chart showing an output state of a circuit for a conventional soft error countermeasure 2. 4 is a time chart showing an example of an output state of an FPGA according to an embodiment. 11 is a flowchart showing an example of the overall flow of a repair process according to the embodiment. 11 is a flowchart showing an example of the flow of a CRAM repair process according to the embodiment. 11 is a flowchart showing an example of the flow of an FF repair process according to the embodiment. FIG. 13 is a diagram illustrating an example of a frame configuration according to a modified example of the embodiment. 13 is a flowchart showing an example of the flow of an FF repair process according to a modified example of the embodiment. FIG. 2 is a diagram illustrating an example of a hardware configuration of an information processing device according to an embodiment.

Below, a detailed description is given of an embodiment (or, as appropriate, a specific embodiment) of an information processing device and an error recovery method according to the present invention, with reference to the accompanying drawings. Note that the present invention is not limited to the embodiment described below.

[Embodiment]
The FPGA configuration of the information processing device according to this embodiment, conventional soft error countermeasures, the configuration of the CRAM, etc., the output state of the FPGA, and the flow of each process will be described below in order, and finally the effects of this embodiment will be described.

[FPGA configuration]
The configuration of an FPGA 10 mounted on an information processing device 100 according to the present embodiment will be described in detail with reference to Fig. 1. Fig. 1 is a diagram showing an example of the configuration of an FPGA according to the embodiment. Below, an example of the overall configuration of the FPGA 10 will be shown, and then the CRAM repair process and FF repair process in the FPGA 10 will be described in that order.

(Example of the overall configuration of FPGA 10)
The FPGA 10 is an integrated circuit mounted on a DCS, SIS, or other FA equipment, which are examples of information processing devices used in a plant. For example, the FPGA 10 has a CRAM 11, which is a configuration memory, and a repair unit 12, which monitors and repairs soft errors. The CRAM 11 is an example of a configuration memory that stores circuit information. For example, the CRAM 11 is assigned a memory area for each unit called a frame, and each memory area stores circuit information of a processing circuit that performs various processes, such as error processing and correction processing, on input data.

As an example, in this embodiment, an example will be described in which the CRAM 11 stores circuit information to be configured for each of three frames, "Frame A" 110A, "Frame B" 110B, and "Frame C" 110C. In other words, the FPGA 10 according to this embodiment has a triplexed processing circuit. Note that the number of multiplexes and the configuration of the processing circuit are merely examples and are not limited to those shown in the figure.

As shown in FIG. 1, the FPGA 10 has processing circuits corresponding to three frames, "Frame A" 110A, "Frame B" 110B, and "Frame C" 110C. Furthermore, the processing circuits corresponding to each frame may be implemented with a series of multiple processing circuits, such as {Frames A-1, A-2, ..., A-n}, {Frames B-1, B-2, ..., B-n}, and {Frames C-1, C-2, ..., C-n}. Furthermore, the FPGA 10 shown in FIG. 1 may include multiple CRAMs 11 and multiple repair units 12.

(CRAM Repair Process)
First, due to the influence of neutron radiation, etc., data inversion occurs on the CRAM 11 due to a soft error (see FIG. 1 (1-1)). At this time, the processing circuit corresponding to the circuit information stored in the memory area on the CRAM 11 and configured on the FPGA 10 is destroyed, and the output becomes unstable (see FIG. 1 (1-2)). Next, the soft error is detected by the fixed-period monitoring of the repair unit 12 (see FIG. 1 (1-3)), and the data inversion of the CRAM 11 is repaired (see FIG. 1 (1-4)). Then, by repairing the data inversion of the CRAM 11, the processing circuit is repaired, and the output returns to a normal state (see FIG. 1 (1-5)). Details of the CRAM repair process will be described later in [Flow of CRAM Repair Process].

(FF repair process)
First, data inversion occurs in FFs due to the influence of neutron rays, etc. (See Fig. 1 (2-1)). In this case, even if the data of any FF is inverted, the output is maintained in a normal state due to the triplicate circuit. In addition, since there is a path that constantly writes back the majority vote result of the outputs of the three FFs to the input of the FFs, the inverted data is immediately repaired. Details of the FF repair process will be described later in [Flow of FF repair process].

As described above, the FPGA 10 according to this embodiment has a CRAM repair function and is equipped with a triplexed processing circuit. Furthermore, in the event of a one-bit soft error in the CRAM 11, the FPGA 10 sets each system in a separate frame to prevent failure of two or more of the triplexed systems due to failures in multiple locations in the circuit. Therefore, even if a soft error occurs in the FPGA 10, the FPGA 10 can effectively maintain the normal state of the output signal, contributing to improved soft error resistance.

[Conventional soft error countermeasures]
Here, conventional soft error countermeasures that are generally taken are explained as reference technology using Figures 2 to 6. Figure 2 is a diagram showing an image of soft error occurrence in CRAM and FF on FPGA. Figures 3 and 5 are diagrams showing an overview of conventional soft error countermeasures. Figures 4 and 6 are time charts showing the output state of a circuit for conventional soft error countermeasures. Below, an image of soft error occurrence is shown, and then conventional soft error countermeasures 1 and 2 are explained in that order.

(Illustration of soft error occurrence)
An image of soft error occurrence in CRAM and FF on FPGA will be explained using Figure 2. First, neutron rays caused by cosmic rays, which are the cause of soft errors, are generated (see Figure 2 (1)). Next, data inversion occurs in the CRAM and FF inside the FPGA due to the irradiation of the generated neutron rays (see Figure 2 (2)). When data inversion occurs in the CRAM or FF as described above, the following effects occur.

First, if the data in the CRAM is inverted, the circuitry configured in the FPGA will be destroyed. This is because the circuitry configured in the FPGA is generated from the data on the CRAM in the FPGA.

Secondly, if the data in a FF is inverted, the circuit downstream of that FF will temporarily stop working normally. In particular, for FFs that are not constantly written to, the abnormal output will continue until data is written to.

(Conventional soft error countermeasures 1)
3 and 4, a conventional soft error countermeasure 1 that is generally performed will be described as a reference technology. Soft error countermeasure 1 is a soft error countermeasure using a repair unit 12-1. The following describes data inversion of CRAM and data inversion of FF in that order. Note that "CLK" in FIG. 4 indicates a clock signal.

First, consider the case where data inversion occurs in the CRAM. First, when data inversion due to a soft error occurs in the CRAM 11-1 due to the influence of neutron radiation in the FPGA 10-1, the circuit configured on the frame 110-1 is destroyed (see FIG. 3 (1-1)). At this time, the output becomes undefined (see FIG. 4 (1-1)). After that, the repair unit 12-1 detects the soft error and repairs the data inversion in the CRAM 11-1 (see FIG. 3 (1-2)). Here, the CRAM repair function by the repair unit 12-1 is a fixed-cycle monitoring function, and real-time correction cannot be performed. Therefore, it takes some time for the data in the CRAM 11-1 to actually be repaired after data inversion due to a soft error occurs. Therefore, although the output returns to a normal state, it remains undefined for a certain period of time (see FIG. 4 (1-2)).

Secondly, consider the case where data inversion occurs in a FF. First, data inversion occurs in a FF in FPGA 10-1 due to the effects of neutron radiation (see FIG. 3 (2-1)), and the circuit downstream of that FF temporarily does not operate normally (see FIG. 4 (2-1)). Here, the repair unit 12-1 is a countermeasure function for soft errors in CRAM, and has no countermeasure effect against data inversion in the FF. Therefore, at this time, the output is in an undefined state until normal data is written to the FF (see FIG. 3 (2-2), FIG. 4 (2-2)).

(Conventional soft error countermeasures 2)
A conventional soft error countermeasure 2 that is generally taken will be described as a reference technology with reference to Figures 5 and 6. Soft error countermeasure 2 is a countermeasure that maintains normal output even if one fault occurs in the circuit by tripling the circuit and using the output of three systems to determine the output of each FF by majority vote. The following describes data inversion of CRAM and data inversion of FF in that order. Note that "CLK" in Figure 6 indicates a clock signal.

First, consider the case where data inversion occurs in the CRAM. First, when a soft error data inversion occurs in CRAM 11-2 due to the influence of neutron radiation in FPGA 10-2, the circuit configured on frame 110-2 is destroyed. In this case, if only one circuit is faulty (see Figures 5 (1a-1) and 6 (1a-1)), the output can be maintained normal even if repair unit 12-2 does not repair CRAM 11-2 (see Figures 5 (1a-2) and 6 (1a-2)). However, for circuits configured with data within the same frame, a single bit of data inversion in CRAM 11-2 due to a soft error can cause circuit failures in multiple places. Therefore, if two of the triplex circuits fail due to data inversion caused by a soft error (see Figures 5 (1b-1) and 6 (1b-1)), the output will be in an undefined state unless the repair unit 12-2 repairs the CRAM (see Figures 5 (1b-2) and 6 (1b-2)).

Secondly, consider the case where data inversion occurs in a FF. First, data inversion occurs in a FF in FPGA 10-2 due to the effects of neutron radiation (see Figures 5 (2-1) and 6 (2-1)). Here, even if the data in any FF is inverted, it is not affected by a soft error, and the output can be maintained in a normal state due to the triplicate circuit (see Figures 5 (2-2) and 6 (2-2)).

The above two soft error countermeasures have difficulty in effectively maintaining the normal state of the output signal when a soft error occurs in an FPGA for the following reasons. First, in the above soft error countermeasure 1, when data is inverted in the CRAM, there is a period during which the output becomes an undefined value, and the countermeasure is insufficient for circuits that require reliability. Second, in the above soft error countermeasure 2, when a soft error occurs in the CRAM, the output becomes an undefined value when one bit inversion causes two faults in the circuit. Furthermore, if the soft error in the CRAM cannot be repaired, the faulty state continues, and even when one bit inversion causes one fault in the circuit, a further soft error may cause a bit inversion, leading to two faults.

In contrast, as described above, the FPGA 10 shown in FIG. 1 according to this embodiment includes a CRAM 11 that processes input data and outputs the data, and a repair unit 12 that detects and repairs soft errors in the CRAM 11. The CRAM 11 includes processing circuits that are set for each frame 110 and that acquire the output results of each processing circuit and select and output the result by majority vote.

In other words, the FPGA 10 can maintain the normal state of the output signal even if a circuit failure (including multiple failures) occurs in a soft error (1-bit inversion) in the CRAM 11, and repairs the circuit failure so that the failure does not remain. Also, the FPGA 10 can maintain the normal state of the output signal in the case of a soft error in the FF. Furthermore, the repair process according to this embodiment can be implemented in inexpensive and easily available FPGAs such as commercial, industrial, and automotive products.

[Configuration of FPGA 10]
The configuration of the FPGA 10 of the information processing device 100 according to this embodiment will be described in detail. The FPGA 10 has a frame 110, a CRAM 11, and a repair unit 12. The frame 110, the CRAM 11, and the repair unit 12 will be described below in that order (see FIG. 1).

(Frame 110)
The frame 110 is implemented with each processing circuit set for each frame 110, which acquires the output result of each processing circuit, selects and outputs it by majority vote. For example, the frame 110 has each processing circuit set for each frame 110 (110A, 110B, 110C) on the FPGA 10 outside the CRAM 11. Each processing circuit includes flip-flop circuits 111 (111a, 111b, 111c), majority vote circuits 112 (112a, 112b, 112c), write-back circuits 113 (113a, 113b, 113c), and multiplexers (MUX) 114 (114a, 114b, 114c). The frame 110 also has a group of circuits, each of which is made up of a flip-flop circuit 111, a majority circuit 112, a write-back circuit 113, and a multiplexer 114, corresponding to each process.

Each processing circuit processes input data and outputs the data. Each processing circuit is on the FPGA 10 and is set for each frame 110 outside the CRAM 11, and each processing circuit acquires the output results of each processing circuit, selects them by majority vote, and outputs them.

In the FPGA 10 according to this embodiment, each processing circuit is configured for each frame 110 using a partial reconfiguration function that dynamically reconfigures only a specific logic area on the FPGA 10 and switches to a different logic, but the method for configuring the processing circuits is not particularly limited.

The flip-flop circuit 111 holds a value based on the result of processing performed on the frame 110. The flip-flop circuit 111 also acquires a clock signal (CLK).

The majority circuit 112 obtains the output of the flip-flop circuit 111 of each processing circuit, and outputs a value selected by majority vote. For example, the majority circuit 112 obtains the output of the flip-flop circuits 111a to 111c of a triplexed processing circuit, and outputs a value selected by majority vote.

The write-back circuit 113 inputs the output of the majority circuit to the flip-flop circuit 111 and writes back the value held in the flip-flop circuit 111. For example, the write-back circuit 113 inputs a value selected by majority vote from the outputs of the flip-flop circuits 111a to 111c to the flip-flop circuit 111a and writes back the value held in the flip-flop circuit 111a.

The multiplexer 114 selects one of the multiple inputs and outputs it. The multiplexer 114 also acquires the write data and the write enable. Furthermore, the multiplexer 114 acquires the value written back by the write-back circuit 113.

(CRAM11)
The CRAM 11 stores information (circuit information) about each processing circuit. For example, the CRAM 11 is a configuration memory that stores the circuit information about each processing circuit, and memory areas are allocated for each frame, and each memory area stores the circuit information about a processing circuit that executes various processes such as error processing and correction processing on input data.

(Repair Unit 12)
The repair unit 12 detects and repairs soft errors in the CRAM 11. For example, the repair unit 12 periodically monitors each processing circuit set for each frame, and when the repair unit 12 detects data inversion due to a soft error in any of the processing circuits, the repair unit 12 repairs the data inversion for the processing circuit in which the data inversion occurred.

[FPGA 10 Output State]
The output state of the FPGA 10 according to this embodiment will be described in detail with reference to Fig. 7. Fig. 7 is a time chart showing an example of the output state of the FPGA according to this embodiment. Below, the data inversion of the CRAM and the data inversion of the FF will be described in that order. Note that "CLK" in Fig. 7 indicates a clock signal.

First, consider the case where data inversion occurs in the CRAM. First, if data inversion occurs in the CRAM 11 due to a soft error caused by neutron radiation, the configured circuit will be destroyed (see FIG. 7 (1-1)). In this case, since the triplex circuit is implemented with each system in a separate frame, the impact of circuit destruction due to a one-bit inversion caused by a soft error is contained within one system even if two or more failures occur. In addition, since the output of each FF is decided by majority decision through the triplicate configuration, the output can be maintained in a normal state. Furthermore, the repair unit 12 detects soft errors in the CRAM 11 based on periodic monitoring, and repairs the data inversion, thereby repairing the failed circuit (see FIG. 7 (1-2)).

Secondly, consider the case where data inversion occurs in a FF. First, data inversion occurs in a FF in FPGA 10 due to the effects of neutron radiation (see Figure 7 (2-1)). Here, even if the data in any FF is inverted, it is not affected by a soft error, and the output can be maintained in a normal state due to the triplicate circuit (see Figure 7 (2-2)). In addition, since there is a path (write-back circuit) 113 that constantly writes back the majority vote result of the outputs of the three FFs to the input of the FF, the inverted data is immediately restored.

[Overall repair process flow]
The overall flow of the repair process according to this embodiment will be described with reference to Fig. 8. Fig. 8 is a flowchart showing an example of the overall flow of the repair process according to this embodiment. In the repair process according to this embodiment, a CRAM repair process (step S101) and an FF repair process (step S102) are executed. Note that the order and execution timing of the process of step S101 and the process of step S102 can be changed dynamically or statically. Also, some of the processes of step S101 and step S102 may be omitted.

(CRAM Repair Process)
When data inversion occurs in the CRAM, the FPGA 10 executes a CRAM repair process (step S101). At this time, the majority circuit 112 selects and outputs the output of each flip-flop circuit 111 by majority decision. The repair unit 12 detects a soft error in the CRAM 11 based on periodic monitoring and repairs the data inversion. A detailed description of the CRAM repair process will be given later in [Flow of CRAM Repair Process].

(FF repair process)
When data inversion of the FF occurs, the FPGA 10 executes an FF repair process (step S102). At this time, the majority circuit 112 selects and outputs the output of each flip-flop circuit 111 by majority decision. The write-back circuit 113 inputs the output of the majority circuit to the flip-flop circuit 111 and writes back the value held in the flip-flop circuit 111. The FF repair process will be described in detail later in [Flow of FF Repair Process].

[Flow of CRAM repair process]
The flow of the CRAM repair process according to this embodiment will be described in detail with reference to Fig. 9. Fig. 9 is a flowchart showing an example of the flow of the CRAM repair process according to this embodiment.

First, the repair unit 12 of the FPGA 10 detects a soft error by periodically monitoring the CRAM 11 (step S201). At this time, the repair unit 12 periodically monitors the state of the CRAM 11 and detects the occurrence of a soft error using a CRC (Cyclic Redundancy Code) or the like, but the method of detecting a soft error by the repair unit 12 is not particularly limited.

Next, the repair unit 12 repairs the data inversion in the CRAM 11 (step S202) and ends the process. At this time, the repair unit 12 performs repair using an ECC (Error-Correcting Code) or by rewriting normal data to the CRAM 11, but the repair method used by the repair unit 12 is not particularly limited.

[FF repair process flow]
The flow of the FF repair process according to this embodiment will be described in detail with reference to Fig. 10. Fig. 10 is a flowchart showing an example of the flow of the FF repair process according to this embodiment.

First, the write-back circuit 113 of the FPGA 10 obtains the majority result of the outputs of the three flip-flop circuits 111 from the majority circuit 112 (step S301). At this time, the write-back circuit 113 obtains the majority result regardless of the occurrence of data inversion in the flip-flop circuits 111.

Next, the write-back circuit 113 writes back the majority result obtained from the majority circuit 112 to the input of the flip-flop circuit 111, and repairs the data inversion (step S302). At this time, the write-back circuit 113 writes back the majority result regardless of the occurrence of data inversion in the flip-flop circuit 111.

[Effects of the embodiment]
First, the information processing device 100 according to the present embodiment described above includes each processing circuit that acquires the output result of each processing circuit set for each frame and selects and outputs it by majority vote, and an FPGA 10 that includes a CRAM 11 that stores circuit information and a repair unit 12 that detects and repairs soft errors in the CRAM 11. Therefore, in the information processing device 100, even if a soft error occurs in the FPGA 10, the normal state of the output signal can be effectively maintained.

Secondly, in the information processing device 100 according to the present embodiment described above, the repair unit 12 periodically monitors each processing circuit, and when it detects data inversion due to a soft error in any of the processing circuits, it repairs the data inversion in the processing circuit in which the data inversion occurred. Therefore, in the information processing device 100, even if a soft error occurs in the FPGA 10, the data inversion can be repaired, thereby effectively maintaining the normal state of the output signal.

Thirdly, in the information processing device 100 according to the present embodiment described above, each processing circuit includes a flip-flop circuit 111 that holds a value based on the processing result performed on the input data, a majority circuit 112 that acquires the output of the flip-flop circuit 111 of each processing circuit and outputs a value selected by majority vote, and a write-back circuit 113 that inputs the output of the majority circuit 112 to the flip-flop circuit 111 and writes back the value held in the flip-flop circuit 111. Therefore, in the information processing device 100, even if a soft error occurs in the FPGA 10, the normal state of the output signal can be effectively maintained by outputting and writing back the majority vote result.

[Modifications of the embodiment]
A modified example of the embodiment will be described with reference to Fig. 11 and Fig. 12. Fig. 11 is a diagram showing an example of a frame configuration according to the modified example of the embodiment. Fig. 12 is a flowchart showing an example of the flow of an FF repair process according to the modified example of the embodiment. Below, the configuration of the FPGA according to this modified example and the flow of each process will be described in order, and finally, the effect of this modified example will be described.

[Configuration of FPGA10-S]
The configuration of the FPGA 10-S according to this modification will be described in detail with reference to Fig. 11. Note that descriptions of configurations and functions common to the FPGA 10 according to the above-described embodiment will be omitted as appropriate. Below, the configuration of the FPGA 10-S will be described in comparison with the FPGA 10.

In the FPGA 10 according to the embodiment described above, when the circuit is tripled, the output of the FF is maintained in a normal state by a majority vote among the three systems, and the normal output is re-input to the FF via loopback to write back the FF data. However, a simple triplexing of FFs can make the timing design of the FPGA 10 strict. In particular, the FF for state machine control has a complex circuit, and is therefore the FF with the strictest timing design.

In this modified example, the FPGA 10-S has a configuration including a state machine 115 and a comparator (comparison circuit) 116 as shown in FIG. 11, allowing for some leeway in the timing design despite the tripled logic. In this case, the FPGA 10-S does not use a majority vote on the output of the state control FF 111-S from the three systems, but instead checks whether the output matches the other two systems using the comparator 116.

The FPGA 10-S has processing circuits configured for each frame 110-S. Each of the above processing circuits includes a state machine circuit (sometimes called a "state machine") 115 and a comparison circuit (sometimes called a "comparator") 116. Each of the above processing circuits also includes a state machine management flip-flop circuit (sometimes called a "state control FF") 111-S.

The state machine circuit 115 switches the state of the processing circuit.

The comparison circuit 116 compares the own state output from the state machine circuit 115 with each other state acquired from the state machine circuits of the other processing circuits. Furthermore, when the own state differs from each other state, the comparison circuit 116 transitions the state machine circuit 115 to an idle state to suppress the operation of the state machine circuit 115. Furthermore, when the own state in the idle state matches each other state acquired from the state machine circuits of the other processing circuits, the comparison circuit 116 resumes the operation of the state machine circuit 115.

[Flow of FF repair process according to the modified embodiment]
The flow of the FF repair process according to this modification will be described with reference to Fig. 12. Fig. 12 is a flowchart showing an example of the flow of the FF repair process according to the modification of the embodiment. Note that the flow of the entire repair process and the flow of the CRAM repair process according to this modification are common to the above-mentioned [flow of the entire repair process] and [flow of the CRAM repair process], and therefore description thereof will be omitted.

First, the comparison circuit 116 of the FPGA 10-S compares the state of the state machine circuit 115 from the outputs of the three systems of state machine management flip-flop circuits 111-S (step S401). For example, in frame A110A-S shown in FIG. 11, the comparison circuit 116a compares the state of the state management FF 111a-S with the states of the other two systems of state management FFs (not shown).

At this time, if there is a mismatched output (step S402: Yes), the comparison circuit 116 proceeds to the process of step S403, and if there is no mismatched output (step S402: No), the comparison circuit 116 ends the process.

Next, the comparison circuit 116 resets FF111-S of the state machine circuit 115 where there is a mismatched output (step S403). For example, in frame A110A-S shown in FIG. 11, the comparison circuit 116a resets the state management FF111a-S when only the output of the state management FF111a-S is mismatched. Note that the various outputs output from the state machine 115 can be maintained in a normal output state by a separate majority vote, so there is no effect on downstream circuits.

Then, when the state management FF is reset, the comparison circuit 116 sets the initial value to the idle state of the state machine (appropriately, "IDLE state") (step S404) and ends the process.

The comparison circuit 116 also resumes the operation of the state machines when the other two systems of state machines return to the IDLE state. For example, in frame A110A-S shown in FIG. 11, the comparison circuit 116a resets the state management FF 111a-S and sets the state machine 115a to the IDLE state. When the other two systems of state machines return to the IDLE state, the comparison circuit 116a resumes the operation of the state machine 115a. Therefore, the state machine 115a on frame A110A-S can automatically synchronize with the operation of the other two systems of state machines.

[Effects of the Modification of the Embodiment]
First, in the information processing device 100 according to the above-described present modified example, each processing circuit includes a state machine circuit 115 that switches the state of the processing circuit, and a comparison circuit 116 that compares its own state output from the state machine 115 with each other state acquired from the state machine circuits of the other processing circuits, and when its own state differs from each other state, the comparison circuit 116 transitions the state machine circuit 115 to an idle state to suppress the operation of the state machine circuit 115. Therefore, in the information processing device 100, by comparing the states of the state machine circuits and suppressing the operation of the state machine circuits, it is possible to effectively maintain the normal state of the output signal even if a soft error occurs in the FPGA 10-S.

Secondly, in the information processing device 100 according to the above-described modified example, the comparison circuit 116 resumes the operation of the state machine circuit 115 when its own state, which is an idle state, matches each of the other states acquired from the state machine circuits of the other processing circuits. Therefore, in the information processing device 100, by resuming the operation of the state machine circuit 115 whose operation has been suppressed, the normal state of the output signal can be effectively maintained even if a soft error occurs in the FPGA 10-S.

〔system〕
The information including the processing procedures, control procedures, specific names, various data and parameters shown in the above documents and drawings can be changed arbitrarily unless otherwise specified.

In addition, each component of each device shown in the figure is a functional concept, and does not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of each device is not limited to that shown in the figure. In other words, all or part of them can be functionally or physically distributed and integrated in any unit depending on various loads, usage conditions, etc.

Furthermore, each processing function performed by each device can be realized, in whole or in part, by a CPU (Central Processing Unit) and a program analyzed and executed by the CPU, or can be realized as hardware using wired logic.

[Hardware]
Next, a hardware configuration example of the information processing device 100 will be described. FIG. 13 is a diagram for explaining a hardware configuration example of the information processing device. As shown in FIG. 13, the information processing device 100 has an FPGA 10 having the above-mentioned functions, an MPU (Micro Processing Unit) 20, a main memory 30, and a network interface controller 40. In addition, each part shown in FIG. 13 is connected to each other. Note that the information processing device 100 shown in FIG. 13 is mounted in a dedicated device for plant control, or in various computers such as a server or a terminal. For example, it can be mounted in various control devices such as DCS and SIS, APC (Advanced Process Control) servers, APC clients, OPC (Open Platform Communications) servers, OPC clients, etc., used for operation control of various plants using petroleum, petrochemical, chemical, gas, etc.

10, 10-S Integrated Circuit (FPGA)
11, 11-S Configuration Memory (CRAM)
110, 110-S Frame 111, 111-S Flip-flop circuit (FF)
112 majority circuit 113 write back circuit 114 multiplexer (MUX)
115 State machine circuit 116 Comparison circuit (comparator)
20 MPU
30 Main memory 40 Network interface controller 100 Information processing device

Claims (5)

Each processing circuit is set for each frame, and each processing circuit acquires an output result of each processing circuit, selects and outputs the selected result by majority vote;
an integrated circuit including a configuration memory that stores information about each of the processing circuits, and a repair unit that detects and repairs soft errors in the configuration memory;
Equipped with
Each of the processing circuits includes:
a state machine circuit that switches the state of the processing circuit;
a comparison circuit that compares the state output from the state machine circuit with other states obtained from state machine circuits of other processing circuits;
The comparison circuit includes:
If the own state is different from each of the other states, the state machine circuit is transitioned to an idle state to suppress operation of the state machine circuit.
23. An information processing apparatus comprising: The repair unit is
periodically monitoring each of said processing circuits;
when detecting a data inversion due to a soft error in any one of the processing circuits, repairing the data inversion in the processing circuit in which the data inversion occurred;
2. The information processing apparatus according to claim 1, Each of the processing circuits includes:
a flip-flop circuit that holds a value based on a result of processing performed on input data;
a majority circuit that acquires outputs of the flip-flop circuits of the respective processing circuits and outputs a value selected by majority vote;
a write-back circuit that inputs an output of the majority circuit to the flip-flop circuit and writes back the value held in the flip-flop circuit;
3. The information processing apparatus according to claim 1, further comprising: The comparison circuit includes:
restarting an operation of the state machine circuit when the own state, which is the idle state, matches each other state acquired from the state machine circuit of the other processing circuit;
4. The information processing apparatus according to claim 1, wherein the information processing apparatus is a computer . In an information processing device including processing circuits set for each frame and an integrated circuit,
each of the processing circuits acquires an output result of each of the processing circuits that has executed processing for each of the frames, selects and outputs the selected output result by majority vote;
The integrated circuit detects and repairs soft errors in a configuration memory that stores information about each of the processing circuits.
Execute the process ,
Each of the processing circuits includes:
a state machine circuit that switches the state of the processing circuit;
a comparison circuit that compares the state output from the state machine circuit with other states obtained from state machine circuits of other processing circuits;
The comparison circuit includes:
If the own state is different from each of the other states, the state machine circuit is transitioned to an idle state to suppress operation of the state machine circuit.
13. An error recovery method comprising:

Images