RU2763092C1 - Fail-safe control system - Google Patents

Abstract

FIELD: computing.

SUBSTANCE: invention relates to the field of computing, in particular to methods for constructing highly reliable computing control systems by duplicating information, and devices designed to receive and process information and issue the resulting signals to the control object. The fail-safe control system contains the main and backup control modules based on processors, majority elements, signal output modules and a synchronization unit. The main and backup control modules are united by a common input and output data bus. The output data bus is configured to transmit signals from each of the control modules to all majority elements simultaneously. Error control units for each of the control modules and signal output modules are connected to the outputs of the majority elements, error indication units are connected to the outputs of the error control units to output information about the failed control channel.

EFFECT: reliability and efficiency of the control system is increased.

3 cl, 1 dwg

Description

The invention relates to the field of computing, in particular to methods of building highly reliable computing control systems by duplicating information, and devices designed to receive and process information and issue the resulting signals to the control object [G06F11 / 16].

From the prior art, a FAIL-SAFE COMPLEX CONTROL SYSTEM is known [RU 2629454 C2, publ .: 08/29/2017], containing at each pilot control station a control stick with four-fold redundant stick position sensors (DPR) according to the number of control channels (roll, pitch, yaw), control panel, redundant computers (VU) of the automatic control system, quadruple redundant VU of the remote control system, quadruple redundant integral sensor unit, quadruple redundant backup navigation unit, three quadruple redundant drive control units, drives, the number of which is determined by the number of aircraft steering surfaces and the required degree reservation.

The disadvantage of the analogue is the high material consumption and labor costs of the production of the system, due to the fact that the fault tolerance of the mentioned system is due to the redundancy of its elements, made at least three times.

Also known is a DEVICE FOR DETECTING AND CORRECTING ERRORS IN A PARALLEL PIPELINE [RU 2524854 C1, publ .: 08/10/2014], containing the first, second and third n-bit parallel registers with the input "write", a group of elements "NOT" (n-elements " NOT "), the block of majority logic, the information inputs of the registers are bitwise combined and are the information input of the device, the outputs of the second register are connected to the inputs of the group of" NOT "elements, characterized in that n-elements" exclusive OR "are introduced into it, the first and second groups elements "And", element of delay; the block of majority logic is made on n-majority elements, the first inputs of which are combined with the second inputs of the “exclusive OR” elements and connected to the corresponding information outputs of the first register, the second inputs are connected to the corresponding outputs of the “NOT” elements, and the third inputs are connected to the corresponding information outputs the third register with an offset of n / 2 bits relative to the first register; the first inputs of the “exclusive OR” elements are combined with the first inputs of the corresponding “AND” elements of the second group of “AND” elements and connected to the outputs of the corresponding majority elements, and the outputs are connected to the first inputs of the corresponding “AND” elements of the first group of “AND” elements, the second inputs which are combined and are the input for enabling the issuance of information about a device malfunction ("error"); the outputs of the “AND” elements of the first group of “AND” elements are the “error” outputs of the device; the outputs of the AND elements of the second group of AND elements are information outputs of the device, the second inputs of which are combined and connected to the output of the delay element, the input of which is combined with the write input of the third register.

The disadvantage of the analogue is the low reliability of the device due to double conversion of the input digital signal in the registers and the reverse conversion of the output digital signal in majority elements, which further complicates the device.

The closest in technical essence is the THREE-CHANNEL RESERVED CONTROL SYSTEM S-01 [RU 2618365 C2, publ .: 05/03/2017], that in the three-channel redundant control system, each module A, B, C additionally includes a Q-bus interface node, a node synchronization timers, a unit for receiving and processing pulse signals, a unit for receiving and processing potential signals, a unit of registers with appropriate connections.

The main technical problem of the prototype is the difficulty of diagnosing a malfunction and / or failure in the operation of any of the channels associated with the appearance of single hardware or software errors, due to the absence of control elements in the system and visualization of its operation.

The objective of the invention is to eliminate the disadvantages of the prototype.

The technical result of the invention is to improve the reliability and efficiency of the control system.

The specified technical result is achieved due to the fact that a fault-tolerant control system containing the main and backup control modules based on processors, majority elements, signal output modules and a synchronization unit, characterized in that the main and backup control modules are united by common input and output data buses, in this case, the output data bus is configured to transmit signals from each of the control modules to all majority elements simultaneously, error control units for each of the control modules and signal output modules are connected to the outputs of the majority elements, error indication units are connected to the outputs of the error control units for output information about the failed control channel.

In particular, the majority elements are fulfilled by the number of control modules.

In particular, the synchronization unit is connected to the inputs / outputs of the processors.

The figure shows a diagram of a fault-tolerant control system, which indicates: 1 - control modules, 2 - processors, 3 - synchronization unit, 4 - input data bus, 5 - output data bus, 6 - majority elements, 7 - buffer output modules, 8 - error control blocks, 9 - error indication blocks.

Implementation of the invention.

The fault-tolerant control system contains N-control modules 1, which include one processor 2 for each of the control channels 1 and a program synchronization unit 3. Processors 2 are united by a common input data bus 4. The outputs of processors 2 are combined into a common output data bus 5 connected to each of the N-majority elements 6. The output of each of the majority elements 6 is connected to a separate buffer output module 7. What is new is that the outputs of the majority elements 6 by a common bus are connected to error control units 8, made according to the number of control modules 1. To the output of each a separate error display unit 9 is connected from the error control units 8.

Fault-tolerant control system works as follows.

When the system is turned on, a stream of input signals from the subject of control (not shown in the figures) is fed to the input of processors 2 of control modules 1 simultaneously via a common bus of input signals 4. In the program synchronization unit 3, an enable signal is generated for the operation of the processors 2 and is fed to the input of the processors 2 of each of the N-control modules 1. The mentioned processors 2, after receiving the enable signal from the program synchronization unit 3, carry out simultaneous processing according to the algorithm of the incoming stream written in advance. on the input data bus 4 signals. At the end of the processing, the processed signals from the processors 2 through the common output bus 5 are fed simultaneously to the inputs of all voting elements 6.

In case of coincidence, the signals from each of the majority elements 6 are fed to separate buffer output modules 7. If any of the signals at the output of the processors 2 of the control modules 1 does not match, resulting from a hardware or software error, the signals are fed to the said buffer output module 7 according to the majority principle, that is, according to the majority principle, in which the value of the output signal from the majority elements 6 coincides with the value of the majority of signals received by the majority elements 6 from the processors 2 of the control modules 1, while in the error control units 8, the control module 1 from which the erroneous signal was received is determined, mark it as a failed one and output information about the error to the error display unit 9 in real time, which makes it possible to timely identify the failed control module 1 and repair or replace it and increase the reliability of the system as a whole, reduce the likelihood of its failure and thereby increase the efficiency of the system management niya, which ensure the achievement of a technical result. From the buffer output modules 7 signals are transmitted to the control object.

After passing the signal processing cycle on all processors 2, the next processing cycle begins only after the generation of the enable signal from the program synchronization block 3.

Claims (3)

1. Fault-tolerant control system containing the main and backup control modules based on processors, majority elements, signal output modules and a synchronization unit, characterized in that the main and backup control modules are united by common input and output data buses, while the output data bus is made with the possibility of transmitting signals from each of the control modules to all the majority elements simultaneously, error control units for each of the control modules and signal output modules are connected to the outputs of the majority elements, error indication units are connected to the outputs of the error control units to output information about the failed control channel. 2. The system according to claim 1, characterized in that the majority elements are made according to the number of control modules. 3. The system according to claim 1, characterized in that the synchronization unit is connected to the inputs / outputs of the processors.

Images