CN1099075C - Redundant electronic device with certified and non-certified channels - Google Patents

Abstract

An electronic device (EG) with a homogeneously redundant structure of at least two channels, in particular a dual-channel homogeneously redundant central unit of a memory programmable controller, which has at least one authentication channel (A) and at least one A non-certified channel (B), where a certified channel (A) is a channel with sufficiently few systematic errors and in which those components that have not been explicitly proven to have sufficiently few systematic errors can be used.

Description

Redundant electronics with certified and non-certified channels

The invention relates to an electronic device with at least two channels, especially a programmable logic circuit with a dual channel structure, wherein the programmable logic circuit is, for example, a central unit of a memory programmable controller.

For safety-related tasks, highly reliable electronic equipment is required. The term "reliable performance" here is chosen according to the draft international document IEC 1508 "Functional safety".

The great thing about reliable electronic equipment is that it provides special measures to avoid, identify and control errors and malfunctions.

A common approach to avoiding, identifying and controlling errors and failures is the multi-channel redundant structure of electronic equipment, where the same operation is performed in parallel within each channel. Identify whether an error has occurred in a channel by comparing the results or output values.

A certain group of errors that is particularly relevant to ensure the reliable operation of equipment performance may be the so-called systematic errors of components, elements or parts of a channel. Such errors can be caused, for example, by the logical structure or its physical properties. By physical construction is meant the interconnection of individual parts and assemblies, while the physical characteristics depend on the manufacturing process for each use. For the intended application, a sufficiently low number of system errors has been demonstrated by various certification measures.

In today's rapidly advancing semiconductor technology, manufacturing methods change after a short period of time. As a result, the components or assemblies involved must be re-certified as being free from system errors, since the operation of such components and assemblies in a system classified as reliable in performance is only permitted by means of various certification measures.

The rapid technological innovation cycle in the semiconductor field requires that this certification must be re-executed for, for example, each new generation of microprocessors or new memory components, where costs are expected due to the need to provide tests and/or prove operational reliability for the certification process The timing of new types of components has resulted in certain safety-related uses only after considerable delay.

It is therefore the object of the present invention to provide an electronic device by means of which components, elements or parts which have not yet been proven to have a sufficiently low system error rate can be used in a safety-relevant system with uniformly redundant channels.

The object of the present invention is achieved by such an electronic device with at least two channels of uniform redundant structure, the electronic device of at least two channels with uniform redundant structure can be a programmable logic with dual-channel uniform redundant structure A circuit having at least one authenticated channel and at least one non-authenticated channel, wherein the authenticated channel is a channel with sufficiently few system errors.

Correspondingly, a channel with a sufficiently low number of systematic errors is understood to mean that the failure probability during a defined period of time does not exceed a defined threshold value depending on the application at the time, which is, for example, a threshold value according to the draft international document IEC 1508.

When each channel is provided with an interrogable identifier, such as a dedicated memory unit or a mechanical or electronic switch, a first identification can be obtained when interrogating the identifier of an authenticated channel, and when interrogating a non-authenticated When this identifier of the channel, a second identification can be obtained, the electronic device only starts its operation when the first identification appears at least once when the identification of each channel is inquired, so that the electronic device realizes self-test, it It is guaranteed that the electronic device starts its operation only when it is confirmed that at least one channel of the electronic device with at least a dual-channel structure is a channel with sufficiently few system errors, that is, an authentication channel.

When the identifications of each channel are inquired in sequence, it can be determined which channel is a channel with sufficiently few system errors, that is, an authentication channel, and which channel is a channel with insufficient system errors, that is, a non-authentication channel.

When the electronic device is running, the identification of the non-authentication channel can be converted from the second identification representing the non-authentication channel to the first identification representing the authentication channel after a pre-determinable period of time without identification errors. during operation and after a sufficient analysis of the performance of a hitherto uncertified channel, the channel itself may be used as a reference channel, so that with this electronic equipment it is possible to use, for example, next-generation components, components or assemblies which have not yet been certified, It is not necessary to prove in advance that there is no error.

Further advantages and inventive details of the invention emerge from the following description of an exemplary embodiment with reference to the drawing.

Fig. 1 is a block diagram of the central unit of a dual-channel uniform redundant structure of a memory programmable controller.

According to FIG. 1, the electronic device EG is the central unit of a two-channel homogeneously redundant structure of a memory-programmable controller. Uniform redundancy here means that the individual channels are constructed symmetrically with elements, parts or assemblies which have at least the same function.

In the exemplary embodiment shown in FIG. 1, channel A has a microprocessor P, a program memory I and a data memory R. The operation of the microprocessor P is monitored by a monitoring unit W, a so-called watchdog. Channel B is uniformly redundant with respect to channel A, which is particularly clear from the fact that identical components P, I, R each bear the same reference numerals.

Channel A must be constructed from parts P, I, R, W that have proven to be systematically error-free enough so that the individual parts, elements and assemblies are certified. Therefore, channel A as a whole appears to be a channel with sufficiently few system errors.

In channel B use one or more components P, I, R, W of various variants which have been altered in some way, e.g. due to new or modified manufacturing methods, without systematic failure Proof enough.

If a possible systematic error in the element, component or assembly involved in channel B manifests its effect, this is identified by comparison with the results of channel A and thus controlled. The comparison of the results can be effected via the connection K existing between the channels A and B.

It is thus possible to use elements, components or assemblies which have not yet been sufficiently proven to be error-free, ie not yet certified, without compromising the safety properties in the channels A, B of the redundant electronics EG.

By comparing the results, systematic errors can be identified, for example due to the physical properties of the individual electronic components, components or assemblies or due to altered manufacturing or assembly processes.

The electronic equipment EG of the present invention allows a supplier of such equipment to respond directly to technological innovation cycles of, for example, the semiconductor industry, always supplying elements, components or assemblies corresponding to the current state of the art in reliable systems, even in Where such components have not been clearly demonstrated by certification that they have sufficiently low systematic errors so far.

In this regard, it must be particularly advantageous to be able to implement this authentication implicitly with the method of the invention or with the electronic device EG of the invention.

For this purpose, an identifier is administered for each channel A, B of the electronic device EG, which indicates whether the respective channel A, B can be regarded as a channel with sufficiently few systematic errors. After a certain period of time, in particular freely chosen by the user, if no system errors have been detected during the operation of the electronic equipment in the hitherto uncertified channels A, B during this period, the identification can be changed from "not Authenticated" to "Authenticated". In this way, a hitherto unambiguously authenticated channel, which has been sufficiently proven in practice to be free from system errors, can also be used like an explicitly authenticated channel.

This enables, in particular, components, components or components produced from next-generation semiconductor components to be used in an electronic device EG combined with the present "online-authentication channel" in another redundant channel A, B, which are then also The likelihood that these components demonstrate a sufficiently low level of systematic error.

Thus, by using the electronic device according to the invention or using the method according to the invention, the latest elements, components or parts can be used freely at any time without having to implement them into safety-relevant systems after a rather time-consuming certification process .

Claims (6)

1. An electronic device (EG) with a uniform redundant structure of at least two channels, particularly a programmable logic circuit with a dual-channel uniform redundant structure, wherein the electronic device (EG) has at least one authentication channel (A ) and at least one non-authenticated channel (B), the authenticated channel (A) is a channel with a sufficiently small number of system errors, where each channel (A, B) is provided with an interrogable identifier, where the inquired authentication channel ( The identifier of A) obtains a first identification, and obtains a second identification when inquiring about the identifier of the non-authenticated channel (B), wherein the electronic device (EG) only inquires about the identification of each channel (A, B) It starts its operation only when there is at least one first identification. 2. The electronic device according to claim 1, characterized in that the inquiry of the identification of each channel (A, B) is performed sequentially. 3. The electronic device according to claim 1 or 2, characterized in that, the identification of the non-authentication channel (B) can be changed from the second identification to the second identification after a pre-specified time period in which no errors are identified. An identity conversion. 4. A method of operating an electronic device (EG) with at least two uniformly redundant structures, in particular a programmable logic circuit with a dual-channel uniformly redundant structure, wherein the electronic device (EG) has at least one An authenticated channel (A) and at least one non-authenticated channel (B), the authenticated channel (A) being a channel with sufficiently few system errors, wherein each channel (A, B) is provided with an interrogable identifier, where in A first identification is obtained when inquiring about the identifier of the authenticated channel (A), and a second identification is obtained when inquiring about the identifier of the non-authenticated channel (B), wherein the electronic device (EG) only inquires about each channel (A, B ) at least once when the mark of the first mark appears to start its operation. 5. The method according to claim 4, characterized in that said querying of the identity of each channel (A, B) is performed sequentially. 6. The method according to claim 4 or 5, characterized in that the identification of the non-authenticated channel (B) can be changed from the second identification to the first Identity conversion.

Images