CN1099075C

CN1099075C - Redundant electronic device with certified and non-certified channels

Info

Publication number: CN1099075C
Application number: CN98802340A
Authority: CN
Inventors: 赫伯特·巴塞尔; 哈特马特·冯·克罗西克
Original assignee: Siemens AG
Current assignee: Siemens AG
Priority date: 1997-02-26
Filing date: 1998-02-13
Publication date: 2003-01-15
Anticipated expiration: 2018-02-13
Also published as: DE59800963D1; ES2160407T3; CN1246938A

Abstract

A homogeneously and redundantly built electronic device (EG) with at least two channels, especially a two-channel, homogeneously and redundantly built programmable central unit of a controller with at least one certified channel (A) and at least one non-certified channel (B). Said certified channel (A) is a channel (A) which is sufficiently free of systematic faults whilst in the non-certified channel (B), components can be used which have not been explicitly proven to be sufficiently free of systematic faults.

Description

The redundant electronic device that has authentication and non-authentication passage

The present invention relates to a kind of electronic equipment of at least two channel architectures, the Programmable Logic Device of a channel structure particularly, wherein this Programmable Logic Device for example is the central location of a storer Programmable Logic Controller.

For relating to safe task, need the reliable electronic equipment of performance height, the term here " dependable performance " is chosen according to international document draft IEC 1508 " functional safety ".

The outstanding part of the electronic equipment of dependable performance is to provide special measures so that avoid, discern and control mistake and fault for it.

A kind of common method of avoiding, discern and controlling mistake and fault is the multi-channel redundant structure of electronic equipment, the wherein same operation of executed in parallel in each passage.Be identified in the passage mistake whether occurs by comparative result or output valve.

Certain group mistake relevant especially with the operation of support equipment dependable performance ground may be the so-called system mistake of assembly, element or the parts of a passage.This mistake for example can cause by logical organization or its physical characteristics.So-called physical arrangement is meant the misconnection each other of single parts and assembly, and physical characteristics depends on the manufacture process of each use.For the application of being planned, prove enough few system mistake by multiple authentication measures.

In the semiconductor technology that develops rapidly now, manufacture method promptly changed after very short time.Consequently, must prove again that to related parts or assembly it does not have system mistake, because in a system as the classification of dependable performance ground, the such parts and the operation of assembly have only by multiple authentication measures and just allow.

The technical innovation cycle requires for example to be necessary for each re-executes this authentication for new type microprocessor or novel memory assembly fast in the semiconductor applications, wherein, because for verification process need provide test and/or proof operational reliability, estimate to spend in time above this cause novel component only after quite postponing, just can be applied in some security-related purposes on.

Therefore, the object of the present invention is to provide a kind of electronic equipment, can in relating to system safe, that have even redundant channel, use by this equipment not to be proved to be the enough few assembly of system mistake, element or parts as yet.

The objective of the invention is to realize by the electronic equipment of the even redundancy structure of a kind of like this binary channels at least, the electronic equipment of the even redundancy structure of these at least two passages especially can be the Programmable Logic Device of an even redundancy structure of binary channels, it has at least one authentication passage and at least one non-authentication passage, and wherein authenticating passage is a passage that system mistake is enough few.

As the enough few passage of system mistake correspondingly can be regarded as probability of malfunction during a stipulated time be no more than a regulation be subjected to use the threshold value that influences at that time, it for example is a threshold value according to international document draft IEC 1508.

When an askable identifier is provided for each passage, for example when special memory cell or mechanical switch or electronic switch, can obtain one first sign this moment when this identifier of inquiry authentication passage, when this identifier of the non-authentication passage of inquiry, can obtain one second sign, this electronic equipment only just begins its operation under at least one inferior situation of the first sign appearance when the sign at each passage of inquiry, like this this electronic equipment is realized self check, it guarantees that this electronic equipment only confirming that at least one passage of the electronic equipment of channel structure is a passage that system mistake is enough few at least, that is just begins its operation when being an authentication passage.

When the sign of each passage of poll, can know definitely which passage is a passage that system mistake is enough few, also authentication authorization and accounting passage, which passage is the enough not few passage of system mistake, that is non-authentication passage.

When this electronic equipment operation, non-authentication passage be identified at one can be given in advance the time period that does not have identification error after can be from second sign that characterizes non-authentication passage to the first sign conversion that characterizes the authentication passage, this moment is at enough run durations with after the serviceability of still unverified so far passage is done enough analyses, can be with this passage itself as using with reference to passage, make and utilize this electronic equipment can use for example still unverified follow-on element, parts or assembly, and needn't prove in advance that there is not mistake in it.

From below with reference to accompanying drawing to understanding other advantage of the present invention and invention details the explanation of an embodiment.

Fig. 1 is the block scheme of central location of the even redundancy structure of binary channels of a storer Programmable Logic Controller.

According to Fig. 1, electronic equipment EG is the central location of the even redundancy structure of binary channels of a storer Programmable Logic Controller.Even redundant each passage of expression here is with element, parts or assembly symmetric construction with said function at least.

In the embodiment shown in fig. 1, passage A has a microprocessor P, a program storage I and a data storer R.The operation of microprocessor P is by monitor unit W, and promptly so-called house dog monitors.Channel B is even redundancy structure for passage A, and this is from having same parts P, I, the R of same reference numerals respectively, and is clear and definite especially.

Passage A must be by proving system mistake enough few parts P, I, R, W structure, so each parts, element and assembly are through authenticating.Thereby passage A integral body appears as the enough few passage of system mistake.

Use parts P, I, R, the W of one or more various modification in channel B, they were once for example changed owing to manufacture method new or that revised in some way, and were not doing enough proofs aspect the no system failure.

If the system mistake that may exist in related element, parts or the assembly in channel B manifests its effect, then this point relatively is identified by the result with passage A and is therefore controlled.Described result relatively can realize by the connection K that is present between passage A and the B.

Can under the situation of the security feature in not worsening passage A, the B of redundant electronic device EG, use thus and fully not prove inerrancy that is still unverified element, parts or assembly as yet.

By the result relatively, for example can discern because the physical characteristics of each electronic component, parts or assembly or because the system mistake that altered manufacturing or installation process cause.

Electronic equipment EG of the present invention allows the supplier of this kind equipment directly the technical innovation cycle of for example semi-conductor industry to be reacted, in the system of dependable performance, always supply with element, parts or assembly, even these elements are enough being lacked the occasion that this point does not clearly prove by authentication so far as yet with regard to its system mistake corresponding to current development level.

In this regard, can utilize method of the present invention or electronic equipment EG of the present invention to realize that impliedly this authentication probably is particularly advantageous.

For this purpose, be sign of each passage A, B management of electronic equipment EG, whether this identifier declaration each passage A, B can be counted as the enough few passage of system mistake.After certain time period of particularly freely selecting by the user, if unidentified to any system mistake in unverified so far passage A, B electronic equipment in service at this section time durations, then this sign can be changed to " authenticating " from " unverified ".Like this, clearly do not authenticate so far but its passage that does not have the system mistake this point fully to be proved in concrete operations also can use as a passage that clearly authenticates.

This point can use member, assembly or the parts of being made by semiconductor element of future generation especially in another redundant channel A, B in the electronic equipment EG that is combined with present " online-the authentication passage ", also these parts are proved the possibility that its system mistake is enough few according to said process then.

Thus, the electronic equipment of the application of the invention or adopt method of the present invention can at any time freely adopt up-to-date element, and assembly or parts relate in the safe system and needn't just they be applied to behind verification process quite consuming time.

Claims

1. electronic equipment (EG) with even redundancy structure of at least two passages, the Programmable Logic Device of an even redundancy structure of binary channels particularly, wherein this electronic equipment (EG) has at least one authentication passage (A) and at least one non-authentication passage (B), this authentication passage (A) is a passage that system mistake is enough few, wherein be each passage (A, B) provide an askable identifier, wherein when the identifier of inquiry authentication passage (A), obtain one first sign, when the identifier of the non-authentication passage of inquiry (B), obtain one second sign, wherein only (A exists the occasion of one first sign just to begin its operation to this electronic equipment (EG) at least during B) sign at each passage of inquiry.

2. electronic equipment according to claim 1 is characterized in that, described (A, B) Biao Shi inquiry is carried out in proper order to each passage.

3. electronic equipment according to claim 1 and 2 is characterized in that, described non-authentication passage (B) be identified at one can be given in advance the unidentified time period that makes mistake after can be from second sign to the first sign conversion.

4. one kind is moved an electronic equipment (EG) that has the even redundancy structure of two passages at least, the method of the Programmable Logic Device of an even redundancy structure of binary channels particularly, wherein this electronic equipment (EG) has at least one authentication passage (A) and at least one non-authentication passage (B), this authentication passage (A) is a passage that system mistake is enough few, wherein be each passage (A, B) provide an askable identifier, wherein when the identifier of inquiry authentication passage (A), obtain one first sign, when the identifier of the non-authentication passage of inquiry (B), obtain one second sign, wherein only (A, the occasion that occurs one time first sign during B) sign at least just begins its operation to this electronic equipment (EG) at each passage of inquiry.

5. method according to claim 4 is characterized in that, described (A, B) Biao Shi inquiry is carried out in proper order to each passage.

6. according to claim 4 or 5 described methods, it is characterized in that, described non-authentication passage (B) be identified at one can be given in advance the unidentified time period that makes mistake after can be from second sign to the first sign conversion.