JPH07122812B2 - Synchronizer for redundant control system - Google Patents

Description

The present invention relates to a synchronizing device for a redundant control system including a plurality of control devices, and particularly to a synchronizing device for a redundant control system, which is suitable for ensuring high reliability. Regarding

[Prior Art] Providing a plurality of control devices for redundancy in order to improve the reliability of a control system has been actively performed in various fields. What is important when the control devices are made redundant is that the control devices are synchronized with each other. In this regard, for example, Japanese Patent Laid-Open No. 57-146303 discloses a method for ensuring synchronization between tripled computers as a method for synchronizing multiple computer systems.

In this conventional example, the system is configured as shown in FIG. 13, and the synchronizing device 4 is means for synchronizing the control devices 1, 2, and 3. The synchronizing device 4 takes the logical product of the synchronization request signals 11 output from the respective control devices 1 to 3 with the AND gate 8, and as a result of this, activates the synchronous interrupt signal generating device 7 via the OR gate 6 and Output 12 Controller 1,2,
The timer device 5 is also connected to 3, and the timer device 5 is
The OR gate 10 takes the logical sum of the synchronization request signals 11 output from the respective control devices 1 to 3, and the timer 9 is driven by this result, and the output of this timer 9 drives the synchronous interrupt signal generation device via the OR gate 6. 7 is activated, and the synchronization signal 12 is output. The OR gate 6 is for outputting a signal when either the output signal of the AND gate 8 or the output signal of the timer 9 comes.

[Problems to be solved by the invention]

In the above conventional example, as shown in FIG. 13, three control devices 1, 2,
3 is provided to make the control device redundant. Further, the timer device 5 is provided to prevent the system from stopping even if one of the control devices 1, 2, 3 fails. However, since the synchronizer 4 is a single system, for example, the OR gate 6
If a partial failure occurs in the synchronizing device 4 due to a failure of the controller, there is a problem that the synchronization between the redundant control devices 1 to 3 cannot be ensured.

The present invention has been made in view of the above points, and an object of the present invention is to provide a synchronization device for a redundant control system capable of ensuring synchronization between control devices even if a partial failure occurs in the synchronization device. Is in the place of providing.

[Means for solving problems]

In the synchronization device of the redundant control system including a plurality of control devices, three or more control devices are provided for each of the plurality of control devices, and a synchronization trigger signal for synchronizing the plurality of control devices. And a plurality of synchronizing trigger signal generating means for outputting the synchronizing trigger signals, and all of the synchronizing trigger signals output from the plurality of controlling devices are input to the synchronizing trigger signal generating means. This is achieved by providing a plurality of majority means for outputting a synchronizing signal to the corresponding control device when the trigger signal exceeds a majority.

[Action]

Since the majority decision means for outputting the synchronization signal is provided for each control device, even if one majority decision means fails, the remaining majority decision means can normally output the synchronization signal to each control device. Therefore, only the control device related to the failed majority decision device does not operate, and the remaining control devices can operate in synchronization. Further, since the synchronization signal is created by taking the majority of the synchronization trigger signals output from each control device, even if one control device fails and the synchronization trigger signal becomes abnormal, the synchronization signal is created and fails. The control devices that are not in operation can operate in synchronization, and if more than half of the control devices fail and the synchronization trigger signal becomes abnormal, no synchronization signal is generated and the operation of all control devices is stopped. , Ensure the safety of the control system.

〔Example〕

Preferred embodiments of the present invention will be described below with reference to the drawings. In the drawings, the same or equivalent members are designated by the same reference numerals.

FIG. 1 shows a redundant control system including a synchronizer according to an embodiment of the present invention. In this embodiment, a triple system including three control devices is shown as an example, but the present invention can also be applied to other redundant systems.

In FIG. 1, reference numerals 1, 2, and 3 are redundant control devices for controlling the control targets 141 to 14M. Each control device 1
3 to 3 take in signals from the sensors S1 to SN, perform arithmetic processing on the signals, and then output control signals to the intermediate value selection circuits 131 to 13M. The intermediate value selection circuits 131 to 13M select an intermediate level signal from the three input control signals and control the target 141
Output to each ~ 14M. This improves driving reliability.

Each control device operating in this way secures synchronization as follows.

A synchronization device including a synchronization circuit 18 is provided in each of the control devices 1 to 3, and the synchronization circuit 18 is constituted by majority circuits 19, 20, 21 installed for each control device. Each of the control devices 1 to 3 is provided with a means for outputting a synchronization trigger signal 15.16.17 for synchronizing these control devices. In the synchronization circuit 18, each majority circuit 19 to 21 inputs the synchronization trigger signals 15, 16 and 17 output from each control device, takes this majority, and outputs this to the control devices 1 to 3 as the synchronization signals 22 to 24. Output. When each control device receives this synchronization signal,
The above control function is operated to control the controlled object.

As described above, the majority circuits 19 to 21 are provided for the respective control devices 1 to 3.
Since the synchronization signals 22 to 24 are provided by, for example, even if the majority circuit 19 fails and the synchronization signal 22 that is the output thereof is not output, the synchronization signals 23 from the other majority circuits 20 and 21 are normally generated. , 24 are output, the control devices 2 and 3 operate in synchronization. As a result, the control signals are input from the control devices 2 and 3 to the intermediate value selection circuits 131 to 13M at substantially the same timing. At this time, the control device 1 does not operate because the synchronization signal 22 is not input, and cannot output the control signal to the intermediate value selection circuit. Therefore, the intermediate value selection circuit 131
˜13M is a control signal of a lower level among the control signals output from the normally operating control devices 2 and 3 (an intermediate level control signal if the control signal from the control device 1 is also included). To control the controlled objects 141 to 14M.

Further, majority circuits 19 to 21 are installed as means for synchronizing the control devices 1 to 3, and the synchronization signals 22 to 24 are created by taking the majority of the synchronization trigger signals 15 to 17 output from the control devices. Therefore, for example, even if the control device 1 fails and an abnormality occurs in the synchronization trigger signal 15, only one of the three synchronization trigger signals 15 to 17 input to the majority decision circuits 19 to 21 is abnormal. , The majority voting circuits 19 to 21 normally generate the synchronization signals 22 to 24 without being affected by this. Therefore, except for the defective controller 1, the remaining controllers are
2 and 3 work in synchronization. As a result, the intermediate value selection circuit 131
Control signals are input to the control units 2 to 3M from the control devices 2 and 3 at substantially the same timing, and the controlled object can be stably controlled.

On the other hand, for example, the control devices 1 and 2 have failed and the synchronization trigger signal 1
When 5 and 16 are no longer output, the number of synchronization trigger signals is less than a majority, so that each majority circuit 19 to 21 does not generate the synchronization signals 22 to 24, and all the control devices 1 to 3 do not generate. Stop the operation. As a result, no control signal is input to the intermediate value selection circuits 131 to 13M, and the control of the controlled objects 141 to 14M is stopped. As a result, the control target 14 can be controlled by only one control device 3.
Preventing the decrease in reliability due to controlling 1 to 14M, and ensuring the safety of the control system.

As described above, according to the present embodiment, the majority circuits 19 to 21 for outputting the synchronizing signals 22 to 24 are provided for the respective control devices 1 to 3, so that one majority circuit fails and the output is generated. Even if the synchronization signal is not output, if the other majority circuits are healthy, the control devices driven by the synchronization signals generated by these majority circuits can operate in synchronization.

Further, according to the present embodiment, since the majority circuit is provided as a means for synchronizing the respective control devices, even if one control device fails and the synchronization trigger signal is not output, the sync signal is created and fails. The control devices that do not operate can operate in synchronization, and if more than half of the control devices fail and the synchronization trigger signal becomes abnormal, the synchronization signal is not created.
It is possible to stop the operation of all control devices and ensure the safety of the control system.

Since the above-described embodiment is a triple redundant system, the majority decision of the majority circuit is based on 2-out-of-3 logic, but in the case of an even redundant system, for example, quadruple. In the case of a computerized system, the presence or absence of the synchronization trigger signal may be the same number of 2 to 2. in this case,
The majority decision may be set in advance so that the output on the side convenient for the control system, for example, the output on the fail-safe side is prioritized.

The above is the outline of the synchronizing apparatus according to the present embodiment. next,
The function of each of the control devices 1 to 3 in the above embodiment will be described in detail below, including the function of the means for outputting the trigger signal for synchronization.

Each of the control devices 1, 2, and 3 has the function of the flowchart shown in FIG.
Synchronous trigger signal creating means 100 for outputting ~ 17 is configured. Further, the function of the control processing means 101 for controlling the control targets 141 to 14M of each of the control devices 1, 2 and 3 is adapted to be activated when the synchronization signals 22 to 24 are input, and the synchronization trigger signal creation The function of the means 100 and the function of the control processing means 101 have the relationship shown in FIG. These functions, which are general, can be easily achieved by implementing the control device by a computer and its software processing.

The function of the synchronization trigger signal creating means 100 is executed as the main processing of the computer as shown in FIG.
Enter the Wait state. As shown in FIG. 2, the synchronizing trigger signal creating means 100 first outputs a signal of logic "1" from the control device as the synchronizing trigger signal (step 102). The trigger signal for synchronization created in this way is output to the majority decision circuits 19, 20, 21 of FIG. The majority decision circuits 19, 20, 21 output the signal of logic "1" as a synchronizing signal after taking a majority decision of the three input signals.
The synchronization trigger signal creating means 100 determines whether or not the synchronization signal input to the control device has a logic "1" (step 103). If the synchronization signal has a logic "1", the synchronization signal is synchronized. The trigger signal for is set to logic "0" (step 104). Then, a wait state is set (step 105). If the synchronization trigger signal is logic "0", the majority circuit in FIG.
Since the three input signals 19, 20, 21 are logic "0", the synchronization signals output from the majority circuits 19, 20, 21 are logic "0".

The function of the control processing means 101 shown in FIG. 3 is executed as an interrupt process, and is activated when the synchronization signal changes from logic "1" to logic "0". Therefore, when the operation of the synchronization trigger signal creating means 100 ends, the function of the control processing means 101 is executed by the interrupt processing, and a series of processing for controlling the control targets 141 to 14M is performed. When the operation of the control processing means 101 is completed, the interrupt processing ends. Here, if the interrupt processing is ended as it is, in FIG. 3, the synchronization trigger signal creating means 100 returns to the wait state, and thereafter, the synchronization trigger signal cannot be output. In order to prevent this, when the operation of the control processing means for interrupt processing is terminated, the return destination (return address) is changed so as to return to the beginning of the main processing shown in FIG.

Next, details of the operations of the control device and the synchronization device configured as described above will be described, including the case where the operation start time of each control device is different or the majority circuit fails.

In FIG. 4, during the period t0 to t1, it is shown that the synchronization between the control devices can be automatically ensured even if the control devices 19, 20, 21 start operating independently. It is assumed that the controller 1 starts the operation and then the controller 2 starts the operation.
Synchronization trigger signal output from these two control devices
When 15, 16 match, the majority voting circuits 19, 20, 21 output the synchronization signals 22, 23, 23. At this time, it is assumed that the control device 3 has not started its operation as shown in FIG. 4 (c).
As a result, the control processing means 101 of the control devices 1 and 2 are activated synchronously and control the control targets 141 to 14M. In the middle of this
When the control device 3 starts to operate, first, the synchronization trigger signal generating means 100 is activated, and a signal of logic "1" is output as the synchronization trigger signal 17. At this point in time, the synchronization trigger signals 15 and 16 from the other control devices 1 and 2 are both logic "0", so the synchronization signals output from the majority decision circuits 19, 20 and 21 are also logic "0". Is. Therefore, the control device 3
Synchronous trigger signal creating means 10 which is the main processing of FIG.
It is in a wait state of 0.

Then, the control devices 1 and 2 have the control processing means 101 shown in FIG.
When the function of (1) is executed and completed, the function of the synchronization trigger signal creating means 100, which is the main processing, is executed again, and signals of logic "1" are output as the synchronization trigger signals 15 and 16. As a result, each majority circuit takes the majority of the three input signals and outputs the synchronization signals 22, 23, 24. As a result, the function of the control processing means of the control devices 1, 2, 3 is executed, and thereafter, the three control devices 1, 2, 3 operate in synchronization.

Next, in the period t1 to t2, the majority circuit 19 has a stuck-at fault so that its output signal becomes logic "0". In this case, the synchronization trigger signals 15, 16, 1 from each control device 1, 2, 3
When 7 is output, the majority decision circuit 19 outputs the sync signal 22
Is not output, the sync signals 23,
Since 24 is output, the control devices 2 and 3 are controlled by the control processing means 101.
Perform the function of. However, since the control device 1 does not receive the synchronization signal, the function of the control processing means that is the interrupt processing is not executed, and the synchronization trigger signal creating means 100 that is the main processing is in the wait state. Then, this state continues until time t3.

Assuming that the majority circuit 19 has been repaired and returned at time t2, after the time t3, the control devices 1, 2, and 3 control the controlled objects in synchronization.

FIG. 5 shows the operation of each part similar to that of FIG. 4, except that the majority circuit 19 suffers the stuck-at fault so that its output signal becomes “1” during the period t1 to t2. Is. In this case, each control device outputs the synchronization trigger signal at time t2 ′, and tries to execute the function of the control processing means 101, which is an interrupt process, by the synchronization signal output from the majority circuits 19, 20, 21. As for the control device 1, since the synchronization signal does not change from the logic “1” to the logic “0”, the function of the control processing means cannot be executed, and the synchronization trigger signal generating means 100 waits for wai.
It remains in the t (standby) state. This state is the fourth
As in the case of the figure, it continues until time t3. After time t3, the majority circuit 19 has already returned at time t2, so that the control target can be controlled in synchronization with each of the control devices 1, 2, and 3.

In the above description, the case where the majority circuit 19 fails is described as an example, but the same applies to the case where the other majority circuits fail.

The synchronous device for a redundant control system in a general control system has been described above, but when it is applied to an inverter or converter control system, its effect is particularly large. Hereinafter, such an embodiment will be described.

FIG. 6 shows an embodiment of the inverter system. In the case of the converter system, only the switching circuit 44 is configured as shown in FIG. 8, and the control system is the same. Further, in order to facilitate the explanation, both FIG. 6 and FIG.
This is the case of a single phase, but the same applies to the case of three phases.

In FIG. 6, reference numerals 30 to 33 are majority voting circuits, and control signals 34 to 37 output from the majority voting circuits 30 to 33 have the relationship shown in FIG. 38-41 is used in the figure.
To control the load 42. The load 42 is often an electric motor. As shown in FIG. 7, it is important that the control signals 34 to 37 have the same timing. For example, if transistor 38 is on,
As shown by the periods t1 and t2, the control signals 34 and 36 must be logic "1" and the control signals 35 and 37 must be logic "0". As described above, in the case of the inverter control system, the timings of the control signals 34 to 37 need to match. For this purpose, each control device 1, 2, 3 must operate in synchronization. As described with reference to FIGS. 4 and 5, according to the present invention, since each control device ensures the synchronization before executing the control process, the digital signal is transmitted as described above. It is very suitable for output and control systems.

The same applies to the converter control system. In this case, the switching circuit 44 is merely replaced by the switching circuit 45 shown in FIG. The switching circuit 45 controls switching elements (thyristors are used in FIG. 8) 46 to 49 by input control signals 34 to 37 and outputs a DC voltage from an AC power supply 50 to terminals 51 and 52. In this case as well, the present invention is very suitable as in the case of FIG.

Next, the majority circuit 19, 20, 21 shown in FIG. 1 can be realized by the non-power-supply type intermediate value selection circuit shown in FIG. 9 as an example. Even if a temporary failure occurs, the synchronizing signal can be output to the control device without being affected by this, and the stuck-at failure itself of the majority circuit shown in FIGS. 4 and 5 can be prevented. The contents will be described below.

FIG. 9 shows an embodiment of a non-power source type intermediate value selection circuit,
When a digital signal is input to the intermediate value selection circuit, this circuit operates as a general majority logic circuit as described below. In this case, this circuit uses NPN transistors 116 to 118 as shown in the figure, and a signal having a positive polarity (for example, 0 to 5 V) is used as an input signal. Note that the diode
Reference numerals 119 to 121 are provided to protect the transistors 116 to 118, and particularly to prevent destruction of the transistors when a reverse voltage is applied between the base and emitter of each transistor.

The inputs of this non-power source type intermediate value selection circuit are a, b and c, and the output is d. For example, assume that the signals shown in FIGS. 10A to 10C are applied to the inputs a, b, and c, respectively. Time t1
Until then, each signal is logic "0", so the output is also "0".
In the period from t1 to t2, only the signal a has the logic "1". As a result, the base of the transistor 116 is “1” and the collector is “0”, and the transistor is turned on, so that the collector voltage is output to the emitter almost as it is. Therefore, the emitter potential of the transistor 116 is "0". At this time, since the bases of the transistors 117 and 118 are both "0", both the transistors 117 and 118 remain in the OFF state, and the potentials of the emitters of the transistors 117 and 118 are "0". That is, until time t2, the output of the intermediate value selection circuit is "0". During the period from t2 to t3, since the base of the transistor 118 is "1" and the collector is "1", the transistor 118 outputs "1" in the ON state. Transistor 1
17 is OFF because the base is "0". In addition, although the base of the transistor 116 is “1”,
The output of is "1", and the reverse voltage is applied to the emitter by this, so it is turned off. As a result, "1" is output at the output d. During the period t3 to t4, all inputs are "1", so the output d also becomes "1". Similarly, considering the state of the input signal, the signal shown in FIG. 10 (d), that is, the signal having the majority logic (2-out-of-3 logic) is finally selected. it can.

Now, consider the failure mode of this non-power source type intermediate value selection circuit. In an extreme example, it is assumed that all the devices have failed in the short circuit mode. Since the outputs of the diodes 119 to 120 are connected to one point, if all the elements fail in the short-circuit mode, they are equivalently a Wird-OR circuit (functionally AND). If it is as shown in Fig. 10, time t3
A logic "1" signal is output from t4 to t4, and a logic "0" is output at other times. That is, if the timings of the input signals are the same, the synchronization signal is output without any problem.

In the above example, all the elements are short-circuited, but even if the elements partially fail, the synchronization signal can be output without any problem.
For example, assume that transistor 118 has a short circuit fault. In this case, in FIG. 10, since the input signal is "0" until time t1, "0" is output. From t1 to t2, since the input signal a is "1", the emitter output becomes "1" and the diode
“1” is directly output via 121. This state continues from t2 to t4, but the input signal a from t4 to t5.
Is "0", the emitter of the transistor 118 is "0", but the operation of the transistors 116 and 117 causes a logic "1".
Is output to the output d, the diode 121 is reverse biased, and the emitter output “0” of the transistor 118 is not output. In this case, assuming that the diode 121 also fails in the short circuit mode, the output d becomes "0" after t4. However, in any case, the output d never remains at the logic "1", that is, the stuck-at fault at the logic "1" does not occur.

Next, in the case where each element fails in the open mode, in this case, the mode in which the signal is lost, that is, the output d becomes "0". Therefore, the stuck-at fault does not occur in logic "1".

As described above, even if any failure occurs in the intermediate value selection circuit, its output is kept at logic “1” and does not fail. The output signal always changes, so the output is logical "0".
Or, it never becomes a "1" and fails. This is because the intermediate value selection circuit does not need a power supply and can determine the output only based on the magnitude relationship of the input signals.

In this way, if a non-power-supply type intermediate value selection circuit is used, its output does not suffer a stuck-at fault to logic "0" or "1", so even if a partial fault occurs in this circuit, The synchronization signal can be output, the control process can be executed by the three control devices, and the reliability of the system can be further enhanced.

The non-power-supply type intermediate value selection circuit may output a voltage lower by the base-emitter voltage of the transistor depending on the magnitude of the input signal. This does not change the logic "1" to "0" but reduces the noise margin. In order to eliminate this voltage drop and increase the noise margin, the intermediate value selection circuit described in Japanese Patent Laid-Open No. 59-14003, in particular, six NPN transistors are used to select and output the intermediate value for a positive signal. The part may be used.

In the embodiments described thus far, the majority circuits 19 to 21 of the synchronizer.
Is configured by hardware, but it is also possible to implement this by software processing of each of the control devices 1 to 3 configured by a computer. FIG. 11 shows such an embodiment, and the majority decision circuit 19 to 19 as shown in FIG.
21, not the trigger signal for synchronization output from the controller 61
15 is input to the control devices 62 and 63, the synchronization trigger signal 16 output from the control device 62 is input to the control devices 61 and 63,
The synchronization trigger signal 17 output from the control device 63 is input to the control devices 61 and 62. Each of the control devices 61 to 63 has the function of the flowchart shown in FIG. 12, and by this function, the synchronization trigger signal generating means 106 for outputting the synchronization trigger signals 15 to 17 and the synchronization trigger signals 15 to 17 Constitutes a majority decision means 107 for taking a majority decision. With this function,
The relationship with the function of the control processing means for controlling the control targets 141 to 14M of each of the control devices 61 to 63 is the same as the relationship shown in FIG. 3 of the above-described embodiment.

In the synchronization trigger signal creation means 106 and the majority decision means 107 shown in FIG. 12, first, a signal of logic "1" is created as a synchronization trigger signal. (Step 102). The synchronization trigger signal thus created is output to the other two control devices shown in FIG. Then, the synchronization trigger signal of itself and the two synchronization trigger signals output from the other two control devices are fetched as input signals a, b, c (step 108).
A majority decision (2-out-of-3 logic) is made on these three signals using the following equation (step 109).

z = a ・ b + b ・ c + c ・ d It is judged whether the logical operation result of the above equation is "1" (step
110), if it is determined to be "1", this is used as a synchronizing signal, and the synchronizing trigger signal is set to logical "0" (step 104). Then, a wait state is set (step 105). Hereinafter, the function of the control processing means 101 of FIG. 3 will be executed. If the steam logic is “0”, input signals a, b,
Execute from import of c.

As described above, if the function of the majority means is executed by software, there is an effect that the amount of hardware does not increase and the reliability increases accordingly.

〔The invention's effect〕

As is apparent from the above, according to the present invention, a majority decision means is provided for each control device, and a synchronization signal is created by majority decision of the synchronization trigger signal output from each control device, thereby controlling the control device. Since the processing is executed, the system does not go down even if one of the majority decision means or the control device that creates the synchronization signal fails, and when more than half of the control devices fail, all The operation of the control device is stopped, whereby a highly reliable and highly safe redundant control system can be provided.

[Brief description of drawings]

FIG. 1 is a schematic diagram showing a redundant control system incorporating a synchronizing device according to an embodiment of the present invention, and FIG. 2 is a flow chart showing the function of a synchronization trigger signal producing means of each control device of the control system. FIG. 3 is a flow chart showing the relationship between the function of the synchronization trigger signal generating means and the function of the control processing means, and FIGS. 4 and 5 show the operating states of the respective parts in the synchronizing device and the control device. FIG. 6 is a timing chart to be described, FIG. 6 is a schematic view similar to FIG. 1, showing another embodiment in which the present invention is applied to an inverter system, and FIG. 7 is a diagram showing an inverter switching circuit of the inverter system. FIG. 9 is a diagram showing a timing relationship of input signals, FIG. 8 is a configuration example of a converter switching circuit to which the present invention is applicable, and FIG. 9 is a majority decision means of the present invention. It is a circuit diagram of a non-power supply type intermediate value selection circuit that can be used to realize, FIG. 10 is a timing chart for explaining the operation of the intermediate value selection circuit, FIG. 11 is a majority voting group. FIG. 6 is a schematic view similar to FIG. 1, showing a redundant control system according to still another embodiment of the present invention configured by software of a control device,
FIG. 12 is a flow chart for explaining the functions of the synchronization trigger signal generating means and the majority decision means of each control device in the system, and FIG. 13 is a schematic diagram showing a conventional redundant control system equipped with a synchronization device. . Description of symbols 1 to 3, 61 to 63 ... control device 18 ... synchronization circuit 15 to 17 ... synchronization trigger signal 19 to 21, 107 ... majority decision means 22 to 24 ... synchronization signal 100, 106 ... synchronization Trigger signal creating means 101 ... Control processing means

Claims (4)

[Claims] 1. A synchronization device of a redundant control system comprising a plurality of control devices of three or more, wherein a synchronization trigger is provided for each of the plurality of control devices, for synchronizing the plurality of control devices. A plurality of synchronization trigger signal generating means for outputting a signal, and a plurality of synchronization trigger signals provided respectively corresponding to the plurality of control devices, each of which receives all of the synchronization trigger signals output from the plurality of control devices. And a plurality of majority decision means for outputting a synchronizing signal to a corresponding control device when the number of trigger signals for use exceeds a majority, and a synchronizing device for a redundant control system. 2. The synchronization device for a redundant control system according to claim 1, wherein the majority decision means comprises a non-power source type intermediate value selection circuit. 3. The control device is constituted by the synchronization trigger signal generating means and a control processing means which is activated by a synchronization signal output from the majority decision means and controls a control target. The synchronization device for a redundant control system according to claim 1. 4. The control device comprises the synchronization trigger signal generating means, the majority decision means, and a control processing means which is activated by a synchronization signal output from the majority decision means and controls a control target. The synchronization device for redundant control system according to claim 1, characterized in that.