DD159681A1 - HIERACHICALLY BUILT REDUNDANT INFORMATION PROCESSING SYSTEM - Google Patents

Abstract

The invention relates to a circuit arrangement for process automation by means of a hierarchically structured redundant information processing system. The circuit arrangement according to the invention is applicable in the fields where high safety and reliability requirements exist. The aim of the invention is to increase the security and reliability of a hierarchically structured redundant information processing system. With the solution according to the invention is at an economically justifiable expense for complex control systems, as z. B. occur in nuclear power plants, chemical plants and railway safety technology, achieved a high level of safety and reliability. This is particularly due to the fact that the data comparison is organized in software or hardware according to the "2 of 2" principle and that a set of subsystems is assigned a fixed number of backup systems according to the reliability requirements.

Description

231189 3

Hierarchically structured redundant information processing

beitungssystem

Field of application of. Invention .

The invention relates to a circuit arrangement for process automation by means of a hierarchically structured redundant information processing system. The erfindungsge <mäße circuitry is applicable in the fields where high security and reliability requirements exist.

Characteristic of the Known Technical Solutions A circuit arrangement (DE-OS 2612 100) is known for digital data processing with assemblies provided in two channels, which are controlled in steps by a common clock current supply. At each processing step, a monitoring pulse is output except for a plurality of control signals. This monitoring pulse is for interrogating series-connected comparators. In the presence of orderly signal pairs, the monitoring pulse is output as error-free message for triggering the control signals required for the next processing step and another monitoring pulse to the clock power supply. The disadvantage of this solution is that the comparison is performed in hardware (bitwise). Furthermore, additional facilities for clock generation and clock transmission are required. Furthermore, a digital computer device consisting of two mutually. , switchable computer combinations known (DE-OS 2915 401). .The redundant computer in the combination only serves

31189 3

for comparison and a computer operates on the output, wherein between the output of the first computer and the output of the second computer, a bit-by-bit ^ -Vergleich is performed. The number of equality or inequality is counted, and at a certain level, the message and a switching or blocking of working on the technological unit two-computer group · In complex systems with more than one. Doppelrechnersystem this solution is economically very complicated, there for each Doppelrechnersystera a similar redundant system is provided.

Furthermore, a multi-computer system for controlling train-bound transport is known (DB-AS 2725 922), in which all computers process the same information asynchronously, the result information for testing errors are compared with each other only at the end of a computing cycle »To ensure the asynchronous operation the information is forwarded to the individual computers at a later time. The output data of the individual computers are checked by means of a comparison and Durchsehalteinrichtung. The comparison is only performed when the majority of the computers arrive at a result. This is done by a logic circuit that is not redundant, so that errors that may occur within the logic circuit are not detected.

Object of the invention

The aim of the invention is to increase the security and reliability of a hierarchically structured information processing system with reasonable economic effort by means of redundancy.

Explanation of the essence of the invention

The invention has for its object to develop a hierarchically structured redundant information processing system, the individual systems operate on the "2 of 2" principle and for the entire system, the principle of

2 3118 9 3

sliding redundancy is applied.

According to the invention the object is achieved in that an operating and display device to a first and a second Bediensaramelleitung, which are connected to Leitrechnerpaaren connected, the Leitrechnerpaare are linked by a control line. The Leitrechnerpaare are connected to a first and a second LeitSammelineit to which the area computer pair and a reserve computer pair are connected. The area calculator pairs are linked via a control line to a resume logic connected to a reserve computer pair, and the first area computer pair is provided with a first and a second output bus, the second area computer pair having a third and a fourth output bus, and the nth area computer pair having a (2n-1) -th and a 2n-th output bus and the spare computer pair connected to the first to 2n-th output bus. Process elements are connected to the first to the second output bus.

In a refinement of the solution according to the invention, the first host pair and the area computer pair consist of two parallel individual computers, each of which has an input / output unit upstream or downstream. The individual computers are bidirectionally linked or connected via a control line to an OR module to which an external control line is applied. Deir output of the Oder module is connected to a reserve system and with a first and a second manifold control, which are zwisehenschaltet between each of the subordinate buses and the individual computers upstream or upstream input / output units.

In a further embodiment of the invention, the other Leitrechnerpaare each consisting of two parallel Sinzelrechnern, each of which is an input / output unit upstream or downstream. The individual computers are directly bidirectional

231 189 3

linked or connected via control lines to an OR module.

The output of the NOR block is combined with a reserve system and the inverting input of a Nor block, at the first input of which the Umsehaltsignal the first host, the · The output of the Nor block is with a first and a second bus control, each between the LeitSammelleitungen and the individual computers nach- or upstream input / output units are interposed connected.

If the master computer level is made up of only a single pair of master computers, then the master computer pair consists of two parallel individual computers, each of which has an input / output unit upstream or downstream. Between the Leitsammelineit and the individual computers upstream and downstream second and fourth input / output unit, a first and a second bus control is interposed, wherein the second input of a first AND-block and the output of a second AND-block with the second Input / output unit and the first Samraelleitungssteuerung are connected · At the inverting first input of the first AND device is a first Umsehaltsignal US 14.2. The output of the first AND device and the second input of the second AND device are connected to the fourth input / output device and to the second bus controller, wherein at the inverting first input of the second AND device a second switching signal US 14 * 1 is present.

embodiment

The invention will be explained in more detail in the following embodiment.

The accompanying drawings show:

Pig. 1: Hierarchically structured redundant information processing system

Fig. 2: "2 of 2" structures for the first host pair - and the area computer pair

Fig. 3: "2 of 2" structures for the Leitrechnerpaare 1 * 2, ..., 1.JTi

2 3118 9 3

Pig. 4: Structure of the master computer level with only one master computer pair

The control computer pairs 1.1 and 1.2 (FIG. 1) receive signals for initiating control sequences via the control bus lines and, via the same bus lines, give messages for operational management (operating information, fault information, etc.) to the higher-level display devices 3. The two control computer pairs 1.1 and 1.2 become the same Algorithms (but may be different versions of the program) processed so that the same output signals result in trouble-free operation, with only one host pair (eg 1.1) signals are output to the control or Leitsammelleitungen. Each computer pair 1.1, 2.1 and 2.2 again contains two separate individual computers 7.1 and 7.2 (see FIG. 2), which likewise process the same algorithms in parallel. The connection of the computers to the bus lines is made via I / O units 8.1, ..., 8.4, which cause the signal-like adjustment. The bus lines are also executed in duplicate, so that each of the two individual computers 7.1 and 7.2 is connected only to a control or Leitsammpipe and line faults affect only one computer. The data traffic on the control bus lines is likewise organized by the individual computers 7.1 and 7.2 (each separated for a bus), whereby either the computers themselves realize this function or separate bus control systems 10.1 and 10.2 (SLS in FIG. 2) are present. The calculation results of the two computers 7.1 and 7.2 working in parallel are compared in terms of software or hardware (symbolized by the bidirectional connection between computer 7.1 and computer 7.2 in FIG. 2). In the case of a detected inequality, a switchover takes place to the reserve computer pair 1.2 or 6 (FIG. 1).

231189 3

This switchover command is formed either by individual computer 7.1 or by individual computer 7.2 (dashed connections Pig. 2). Via the bus control systems SLS 1 and SLS 2 > , the computer pair 1.1 is disconnected from the bus lines (the output is blocked for the operator bus lines) and the reserve host pair 1.2 is connected to the bus lines. This changeover can also be initiated via an external switchover command (also the switchback, for example, after a successful repair). The structure of the reserve host pair 1.2 is shown in FIG. 3, deviations from the host pair 1.1 occurring only in the switching logic. In case of a detected inequality between the reserve control computers, a further reserve system can be switched to the manifolds (indicated by dashed information output) or there is a message about the inoperability of the two Leitrechnerpaare, the output channels are zu.belegen zu¬ with a fail-safe state or a separation zwei.Leitrechnerpaare of the manifolds is to be caused. In systems without a reserve host pair (eg, not acceptable from reliability and economic estimates), a switchable host pair can be selected according to FIG. Proper operation is as described above. If there is an inequality detected, the failed computer is to be determined by special diagnostic tests (automatically or with the help of the staff); the bidirectional switcher switches the error-free computer to both channels and thus both bus lines. In case of failure of the computer 14.2, a switchover takes place by means of the Umsehaltsignals US 14.2 or bei.AUSfall the computer 14.1 by means of the Umsehaltsignals US 14.1. On the side of the control bus lines, an analog switch-over takes place for the output signals.

As a result of this measure, the overall system continues to work, but the number of control computers is reduced

231189 3

Safety, which is however justifiable at this level (no direct control signals are formed for the technological process as in the area computer level). Subordinate to the master computers are the area calculators 2.1 and 2.2 (Pig. I). In these computers, the control instructions are processed by the master computers to detailed control signals and switched to the process elements 5 via the output headers. Likewise, the process elements receive 5 signals, evaluated and passed in possibly condensed form the Leltrechnern.1.1 and 1.2. Each. Area computer pair (2.1 or 2.2) is after Pig. 2 built. The block construction has been described above. Each range computer pair 2.1 and 2.2 is assigned an output bus pair, while all range computer pairs are connected in common to the trunk pair. Pur a group of area computer pairs (number is set project-specific) is a reserve computer pair 6 is provided. This reserve computer pair 6 can be switched over to all output bus pairs and, on the other hand, receive or output information via the control bus lines. The switching commands from the area computer pairs 2.1 and go to the switching logic 4 and are logically linked there and signals for switching the reserve computer pair 6 on one of the Ausgabesammelleitμngspaare-formed. The structure makes it possible to connect several reserve computer pairs. Corresponding outputs are indicated in FIG. 1 at the switching logic and the reserve area computer pair 6.

Claims (4)

2 3118 9 3 invention claim 1. Hierarchically structured redundant information processing system consisting of main and spare computers, characterized in that an operating and display device (3) on a first and a second control bus, which are connected to Leitrechnerpaaren (1.1; ...; 1.m) is connected, wherein the Leitreohnerpaare (1,1; ···; 1.m) are linked by a control line, the Leitrechnerpaare (1.1; ···; 1.m) with a first and a second Leitsammelineung, where range computer pairs (2.1; ... j2.n) and a Heserverechnerpaar (6) are connected, wherein the area computer pairs (2.1; ... j2.n) via a control line with a Umshaltlogik (4) »with a Heserverechnerpaar ( 6), and the first area computer pair (2.1) having a first and a second output bus, the second area computer pair (2.2) having a third and a fourth output bus and the nth area computer pair (2, n) m a (2n-1) -th and a 2n-th output bus and the spare computer pair (6) are connected to the first to 2n-th output bus and connected to the first to 2n-th output bus of process elements (5). 2. Hierarchically structured redundant information processing system according to item 1, characterized in that the first host pair (1.1) and the area computer pair (2.1; ...; 2.n) consist of two parallel computers (7.1, 7.2), each having an on - / output unit (8.1; ...; 8.4) upstream or downstream, wherein the individual computer (7.1, 7.2) linked directly bidirectionally or via control lines to an OR block (9) to which an external control line is present, connected and the output of the OR module (9) with a reserve system (.6) and with a first and a second bus control (10.1, 10.2), each between the - 9 - 231189 3 Subordinate bus lines and the individual computers (7.1,7.2) downstream or upstream input / output units are interposed, is connected. 3. hierarchically structured redundant information processing system according to item 1, characterized in that the Leitrechnerpaare (1 «2,., *, 1.jm) from two parallel individual computers (11.1,11.2). Exist, each of which an input / output Unit (12.1, ..., 12.4) upstream or downstream, the individual computers are linked directly bidirectionally or connected via control lines to an OR block (14) and the output of the OR block (14) with a Reserveöystem and the inverting input of a Nor block (15), at the first input of the switching signal of the first host computer (1.1) is applied, the output of the Nor block (15) with a. First and a second manifold control (13.1 , 13.2), each between the Leitsammelleitungen and the individual computers (11.1,1,2,2) downstream or upstream input / output units (12.2, 12.4) are connected. 4. Hierarchically structured redundant information processing system according to item (1), characterized in that when the host computer level is composed of only a single pair of host computers, that consists of two parallel individual computers (14.1, 14.2), each of which has an input. / Output unit (15.1, ..., 15.4) upstream or downstream, between the Leitsammelineit and the individual computers (14.1,14.2) upstream or downstream second and fourth input / output unit (15.2, 15.4) .a first and a second bus control (16.1, 16.2) is interposed, wherein the second input of a first AND-block (7) and the output of a second AND-block (18) with the second input / output unit ( 15.2) and the first - 10 - 2 3118 9 3 Bus line control (16 _# 1) are connected to the inverting first input of the first and block (17), a first Umsehaltsignal US 14.2 is applied, the output of the first AND block (17) and. the second input of the second AND device (18) is connected to the fourth input / output unit (15.4) and the second bus control (16.2), wherein at the inverting first input of the second AND device (18) a second switching signal US 14.1 is present.