DE2023117B2 - Fail safe control for digital information - three channel supervisory control built into processing unit provides full transfer - Google Patents

Abstract

A three channel fail safe supervisory control ensures that digital information transfer between a computer and process is maintained correctly in the event of a malfunction. Error monitoring and majority operation circuitry are located between different sections of the computer. The monitoring circuitry provides a two way check on data to and from the central processing unit and the data processing section containing control circuitry group controls and block control circuitry. The modules provide a majority operation and supervisory fail safe control for data transfer to and from the input/output units. The input/output units are interrupt control, digital input and analogue input. The supervisory control ensures that all necessary criteria for fail safe system operation are met.

Description

continue to work with the restriction and continue to be fully available.

c) The error must be indicated to the operating personnel in order to operate the system as soon as possible Time - at choice of the company - to be able to repair.

With the simultaneous appearance of two of each other independent errors or with the occurrence of a further error before the repair of the reaping is not expected as the probability is sufficiently low for this. In this case, no conditions are placed on security.

The object of the present invention is therefore to provide a fail-safe control system for transmission of digital information that meets the aforementioned security requirements. According to The invention, this object is achieved in that each of the majority and error monitoring circuits The logic link used is an alternating current module and is designed in such a way that it is present in the event of any own defect, regardless of the condition Input signals, no AC voltage at its output.

The whole for the function of the failing The signal processing required by the control system is available in three identical channels. Any channel is functional on its own, so it has a separate power supply as well as its own Periphery. Whether each channel has its own fin output on a single secure computer (polymorphic Computer) or connected to one of three existing computers (triple computer) is irrelevant to the tax system.

The cigen-safe logic modules used for the construction of the majority and student monitoring circuits have already been proposed and described (cf. the not previously published DT-AS 1933 713 and patent applications ⁴⁰ P 19 50 331.2, P 20 14135.9 and P 20 14 100.O) ^ This is an alternating current logic, in which an alternating voltage is generated in each module by an oscillator, depending on the input logic. A central clock is therefore not required for the entire system.

The logic signals L and 0 are defined as follows:

a) The L signal becomes through the envelope of a AC voltage shown.

b) The 0 signal means no alternating voltage.

The following conditions apply to the intrinsically safe modular system:

1. Executes a logic module according to its logical function and the applied input signals a 0 signal at the output, if an internal error occurs (component failure etc.) no L-signal appears at the output.

2. If the module has a 1 signal at the output according to its logical function and the existing ones Input signals, the output must be f> 5 if an internal error occurs Change 0-signal and also, if the input signals change again, continue to output 0-signal.

35

55

3. In the event of a line interruption or a short circuit in the output line of a safe All connected inputs of the logic module should receive a 0 signal (no AC voltage).

Each input of the safe AC modules consists of a potential-free primary winding of an AC transformer. The output line of a unit is looped through all input windings to be linked, the end of the last input winding must be connected to + UB (operating voltage). This type of wiring applies to logical alternating current components (dynamic circuits). It has the advantage that in the event of a wire break in the input circuits connected in series, no input receives an L signal for control.

The invention will be explained in more detail below with reference to the principle circuit diagrams shown in FIGS explained. The

Fig. 1 is a block diagram of the entire control system,

F i g. 2 is a block diagram of the majority logic arrangement and

F i g. 3 is a block diagram of the fault monitoring circuits.

The block diagram of FIG. 1 shows the overall structure of the control system, which in terms of equipment is made up of three data display distribution levels DI, DII and DlII constructed in conventional, integrated circuit technology and of two intervening majority and error monitoring levels U I and i.'II, which are made up of intrinsically safe logic modules are, exists.

The modules 11 to 16 of the monitoring level V 1 regenerate and monitor the data traffic on the program-controlled input and output channels in both directions between the central unit 10 of the process computer, which forms the data processing level DI, and the data processing level D II. The data processing level D II includes in Control units 20, 21 and 22, group control units 23, 24 and 25 and block controls 26, 27 and 28 each for channels K 1 to K 3, which fulfill the tasks mentioned in the introduction to the description. However, their mode of operation is not discussed in more detail here, since this is not necessary for an understanding of the control system according to the invention.

The modules 30 to 35, 40 to 45 and 50 to 55 of the majority and error monitoring level Uli regenerate and monitor the data traffic in both directions between the data processing level DlI and the data processing level DIII, which comprises output blocks 60, 70 and 8C. 7 of these I / O blocks belong to the interrupt input block 60, the digital input block 70 (spontaneous input) and the analog input block 80 The respective output blocks are shown in the Fig.! not shown.

The Lirc-channel structured L'interruption input block 60 (interrupt input block) has the task of signal changes that occur on one or more Inputs, the process computer 10 via eir Collective interrupt signal on lines 61, 62 and 63 regardless of the current program.

■ r

The three-channel digital input block 70, which is designed as a three-channel data processing level, is intended to pass on digital information that is generated at many D III, here by the analog input block 80, as electronic signals or as det. The entire majority circuit contact positions are present, in the process computer of the monitoring level Ü II is how all components are read. Several input points are summarized to 5 th of the control system according to the invention, from three one input word, which is built up within identical circuits in blocks 50, 52 and a digital input operation from the computer address 54 and outputs from each of these circuits must be siert and its information then as output signals λΙ-λ / j, / Jl- / in, γΐ-γη from which the computer double word is brought into the computer. Majority of their associated input signals α 1-o / j, The digital input block thus contains devices io bl-bn, ci-cn correspond (e.g. two of each for address decoding, for conjunctive linking three channel signals of the data processing level function of each input word with the associated D II ). The output signals of each of the three be-address signal and disjunctive Summary taken majority circuits 50, 52 and 54 of coming from different input words per one channel Kl, Kl, K 3 is the Datenvcrarbcitungs information signals. > 5 level D III controlled. The individual circuits

The analogue modules, which are also three-channel, are based on intrinsically safe logic modules gabeblock 80 is used to input analog measured variables, an alternating current logic built up and required which are present as electrical voltages or currents at their inputs signal converters, the static signals, in the process computer 10. It consists of converting signals into dynamic signals, converter Analog-to-digital converter, which is one of the analog 20 PD 561 to 566, and at its outputs converter, A binary number corresponding to the measured value is generated, one which converts the signals in the opposite direction, Preamplifier, the small analog voltages in the converter PS 571 to 576.

value required for the analog-to-digital converter The converters marked with an asterisk

amplified, one or more input blocks, the PD 561 to 566 are included for the Majoritätsschaltungt / i Meßstellenschalter for switching through the desired 25 ML and for error monitoring circuits FÜ th analog input points, and a control common converter (s. also F i g. 3 ). All separate units that determine the timing of the analog input-safe logic modules are determined by a black process, the addressing of the input triangle on the lower right edge of the module blocks and the information transport represented by the symbols.
Analog-to-digital converter controls. 3 ° The conditions for the output signals λ 1, β 1,

Takes place, the construction of the entire control system of the γ I Maioritätsschaltungen 50, 54 are 52und by modules such that three independent Ka and correspond in shape to the Bedinnäle Kl, K 2 and K 3 are formed identical. Majority switching for
gen ML and fault monitoring circuits Fi '

are within the monitoring levels Vl and 35 & 2, ß2, y2b \ s can, βη, γη.

ί / ΙΙ for each channel Kl, K2 and K3 and for each al = ßl = γΐ = alfol + alcl + McI.

Data direction (input / output) available separately.

For example, in the monitoring level Ül for the Ka- This condition is implemented by intrinsically safe

nal Al the blocks 11, 12, for the channel Kl the OR / AND gate. Two of these gates, blocks 13, 14 and, for channel K 3, blocks 40, e.g. 501 and 502 in channel Kl, 521 and 522 in 15, 16. In the monitoring level Ü \ l, blocks channel Kl and 541 and 542 in the channel K3, form 30 to 35, 40 to 45 and 50 to 55. Each block corresponds to a majority element. Each majority circuit 50, holds majority and error monitoring circuits 52 and 54, contains ML and FÜ according to its input signals. Their structure is shown in FIGS. 2 and 3 len α 1-an, b 1-bn, c 1-cn n-majority elements.
described in more detail. The output lines of the fault 45 leriiberwachungsschaltungen If an error occurs in the data processing plane are for better FÜ D II, the three channels of the Datenverarbei guide does not work in the block diagram of FIG. 1 processing plane DIII without restriction. Another one has been drawn in. Error, this time in the DIII level, therefore never leads to

An error message through an error monitor to the failure of the control system. By means of a relatively small-scale circuit, reference is made to a certain level and frequent activation of the majority-replaceable assembly. These circuits can then increase the reliability of the control assembly as a whole during the operation of the system, while maintaining the same system as shown in FIG. 1 not shown sound reliability of the individual elements,
ter bridged and replaced without that, regardless of the in the F i g. 2 shown

the signal flow in the case of a separated assembly under 55 majority circuits AiL that the continuation of work will break. of the tax system even after the occurrence of a:

FIG. 2 shows the structure and the arrangement to ensure errors, error monitoring of the majority circuits ML within the interconnections FÜ are necessary. These are also: monitoring level E / II, which is connected downstream between the data processing and the majority circuits ML of each data processing level DII and the data processing level 60 and should be a level D III, using the example of analog erroneous processing by comparing each input blocks 80 of FIG. 1 for one data direction. individual channel output signal with the correspond

The task of the majority circuit is to recognize those from the other two channels and to bring them to three parallel data processing channels K 1 to display. Depending on the logical combination K 3 of the data processing level D II (it corresponds to the degree of comprehension of the individual detector signals is a corresponding to the block controls 26, 27 and 28 of the more precise or less precise localization of the error Fig. 1) output signals al-an , bl-bn, cl-cn lers possible from the display. In general, even if one channel fails, three-channel wi are enough to have as many error signals as wi

Pluggable and thus easily interchangeable assemblies are available.

In FIG. 3, the signals a1, b1, e1, etc. correspond to those in FIG. 2, since the fault monitoring circuit FÜ and the majority circuit ML are always connected in parallel to the same output lines. In addition, negated output signals oil, FT, FT etc. are required, which are generated by converters PD 581 to 586.

For the error signals FKH, ie errors in output line 1 (al) in channel 1, FK 2.1, ie errors in output line 1 (bl) in channel 2 and FK 3.1, ie errors in output line 1 (el) in channel 3, one obtains for the involved signal lines al, b 1, el from the three data processing channels, which carry identical signals in undisturbed operation, the following truth table:

Signal states bl el 0 ^ error L FK 2.1 FK 3.1 al L. L. FK 1.1 L. L. L. L. 0 L. L. 0 L. 0 L. L. 0 L. L. 0 0 L. L. L. L. L. L. 0 L. L. 0 L. 0 0 0 L. 0 0 L. L. L. 0 0 0 0 L. L. L. 0 L.

It is obtained in the appropriate Maxterm form

FK 1.1 = (oil + bl + el) (al + EI + el)
FX 2.1 = (al + FI + el) (oil + fcl + el)
FK3.1 = (al + bl + el) (oil + FI + el).

Corresponding logical functions can be derived for the functionally related signal outputs α2, bl, d up to an, bn, cn. The circuit derived from the aforementioned conditions

ίο can therefore be used in multiple ways and therefore forms the one from an OR / AND gate, z. B. 503, 523, 543, existing basic element for the construction of the error monitoring circuits in blocks 50, 52 and 54. According to the number of signals η , n-FÜ-Elcmcnte are in each of the FÜ-circuits 50, 52 and 54 for each channel.

The individual error signals FK 1.1 to FKl.n; FK 2.1 to FKl.n and FK 3.1 to FK3.n are disjunctive to total error signals FK 1, FK 2 and FK 3

ao tively combined with safe logic modules. Since an error signal with a 0 signal appears, used for combining AND gates 504, 524 and 544, which provide the disjunction for 0 signals.

Quiescent current operated signal lights are provided for the visual display. A disjunctive link of all error signals can trigger an acoustic message. Also, it's via an interrupt possible to have an error in the operating log printed out.

For this purpose 3 sheets of drawings

509 544/1;

Claims (2)

the type and number of modules used! Patent claims: must be freely combinable. The effort for control and addressing must be done with klei 1. Modularly structured, fail-safe control system for the transmission of digital information 5 expansion stages increase accordingly, functions, whereby the control system consists of three iden- The control system is practiced with the process computer, table information processing channels - a program-controlled E.n- / output channel ver is built in which the same data is linked isochronously; therefore the computer redetermines the type are processed and between the channels direction of the information transports of the controlling majority circuits with measures to their io systems through input-output commands, which he in semerr Error protection and for the regeneration and starting program is found, show faulty signals provided An input / output operation via the control are, characterized in that the system requires the processing of a sequence u..r each of the majority and error over several I / O commands of the computer, each. monitoring circuits used logic control 15 command carries out a certain micro-operation. Linking element is an alternating current module and how z. B. Information input, output, test de? is designed such that it is in an arbitrary state of an addressed control system module gen own defect, regardless of the condition and error test. pending input signals, no AC voltage. The control system that receives the I / O commands. at its exit. ²⁰ decodes them and uses them to control the 2. Control system according to claim 1, sekenn- internal information and control signal transpone. is characterized by the arrangement of separate majo- In addition, output information and rity and error monitoring circuits are stored in the address and the input information for The input in the computer is kept ready for each cable within the monitoring levels. There are nal and for every data direction. 25 tax systems known (Richards, »Electronic Digital Systems ", John Wiley & Sons Inc., New York 1966, pp. 596 to 607), in which to increase the Availability of the system a redundant technology. such as a system structure made up of three identical 30 table channels with also redunaant Majority circuits for error recovery, is provided. A disadvantage of such a tax The invention relates to a modular system that is in spite of the redundant technology built fail-safe control system for transmission can in principle not be ruled out that of digital information, the control system 35 erroneous signals dangerous operating conditions out can call three identical information processing channels. The latter can in particular then gen is constructed in which the same data is generated synchronously if as a result of an incorrect L-valued chronologically processed and between the channels output signal of the majority logic connected downstream Majority circuits with measures for their facilities such as relays, signals and the like Error protection and for regeneration and display 4 °. Although there is a circuit arrangement for of faulty signals are provided. Fault detection known (DT-AS 12 92 892), the Such a control system is required for those relating to circuit technology where, when used in an automation system, it is more likely that "L-bits" will be forged into "O-bits" for control and monitoring by industrial professionals than vice versa, however one of the processes, manufacturing and movement processes of all 45 types of arrangement is not suitable, faulty L-Si type. In all applications there is a direct (on- gnals to be prevented. If such a line) connection exists between the automation system and control systems in a safe automation system and system to be automated, so that change systems are used, for example to control the operating status or the requirements and monitoring of Nuclear power plant !!, chemian the plant can be quickly recorded, evaluated and converted into 5 ° see industrial plants, vehicles and their Si control actions. cherungseinrichtungen in transport is used in the control system, also called Verkehrsvertciler, which introduces errors to disastrous consequences, has this d \ · task information can graze caused by words hurt between where human lives at risk or major property-Pro / cßreehnor and peripherals, so it will transport in both directions. To the pe- 55 heightened requirements for security and availability; all facilities are provided. calculated, the data and measured values in one process The conditions are read as follows: capture and u \ c. Information and control commands placed:
to the process or to its supervisory bodies output. Peripheral devices are also included in this 6 ° a) Due to a single error in a component connection all facilities within the tes, a signal connection or a peripheral Process the exchange of information between devices (e.g. defective sensor) Allow human and process computer, such. B. no incorrect data outputs or tax Illuminated displays, keyboards, teletypewriters commands. In particular, may and protocol typewriters. 65 even with defective majority circuits in the Due to its expansion, the control system does not have to connect any downstream modules in the event of a fault. lcot be adapted to a special task can be controlled, can; d. that is, it must have a modular structure, and b) the automation system must be