GB2315587A

GB2315587A - Computerized dual-system interlocking apparatus

Info

Publication number: GB2315587A
Application number: GB9704730A
Authority: GB
Inventors: Toshio Okajima; Atsushi Mukai
Original assignee: Mitsubishi Electric Corp
Current assignee: Mitsubishi Electric Corp
Priority date: 1996-07-19
Filing date: 1997-03-07
Publication date: 1998-02-04
Anticipated expiration: 2017-03-07
Also published as: GB9704730D0; FR2751445B1; FR2751445A1; GB2315587B; JP3216996B2; JPH1035495A

Abstract

A computerized dual-system interlocking apparatus offers a fast processing speed, an improved utilization and an easy-to-test characteristic, with a start/stop function provided in data matching between two CPUs. The apparatus comprises a data matching circuit (16) for determining data match between sets of data resulting from identical processes performed by a first CPU(7) and a second CPU(13) on identical input information, and wait circuits (19, 21) for making the first CPU(7) and second CPU(13) wait in standby for the processes during data matching operation, and for releasing the first CPU(7) and second CPU(13) free from the standby state when the data matching circuit (16) determines that the sets of data match, and a reset circuit (5) for issuing reset signals to the first CPU(7) and second CPU(13) when the sets of data fail to match.

Description

COMPUTERIZED DUAL-SYSTEM INTERLOCKING APPARATUS BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a computerized dual-system interlocking apparatus that controls a signal and a switch in a railroad station.

2. Description of the Related Art Fig. 13 shows a block diagram of a known computerized dual-system interlocking apparatus disclosed by "Railroad, Electronic Technology, and Computerized Interlocking Apparatus" (published in September 1993, pages 66-68), in which a dual-bus synchronization system employs two CPUs.

There are shown CPUs 7, 13 for executing identical processes with their buses synchronized, data buses 14, 18 for the respective CPUs 7, 13, a reset signal 4 for resetting the operations of CPUs 7, 13, a matching circuit 3 for matching one set of data output onto the data bus 14 against another set of the data output onto the data bus 18 for a correct match, and for issuing the data onto the main data bus (for example, the data bus 14 of CPU7) if both sets of data match, and for resetting the operations of CPUs 7, 13 without outputting the data when the sets of data output on the data buses 14, 18 fail to match.

There are also shown a general interface (I/F) module 33 constructed of a data input, a safety output, a general output and the like, an input/output relay module 34 operating in response to the data from the general I/F 33, field devices 35 such as a signal and switch that actually operate in the field in response to the data coming in from the input/output relay module 34, a control panel 1 for issuing route control data to a safety computerized dual-system interlocking apparatus, and a link system 2 for connecting the control panel 1 to an interlocking system 36. The sections except the field device 35 and the control panel 1 constitute a computerized dual-system interlocking apparatus.

The operation of the prior art apparatus is now discussed.

The interlocking system 36 in the computerized dual-system interlocking apparatus operates in response to a command from the control panel 1 via the link system 2. When identical information from the link system 2 is applied to each of the first CPU7 and second CPU13 in the interlocking system 36, the first CPU7 and the second CPU13 perform identical processes to the identical information, and give respective outputs to the matching circuit 3 via the respective data buses 14, 18.

The matching circuit 3 matches one set of data against another. If both sets of data are in agreement, both CPU7 and CPU13 operate normally. Based on the matched data, the general I/F module 33 issues a driving signal to the input/output relay module 34. The field device such as a signal or switch operates accordingly. If both sets of data fail to match, the matching circuit 3 determines that a fault lies in the first CPU7 or the second CPU13, and issues reset signals 4 to reset the first CPU7 and the second CPU13. The operation of the interlocking system 36 is suspended to prevent the field device such as the signal or switch from malfunctioning.

In the computerized dual-system interlocking apparatus thus constructed, the matching circuit is required to perform matching operation on the data input to and output from the CPUs including information and data not specifically related to the safety of traffic. Time delay arising from data matching presents difficulty speeding up the process in the CPUs, and thereby limiting the processing speed in the computerized dual-system interlocking apparatus. As a result, the number of signals and switches controlled by a single computerized dual-system interlocking apparatus is limited.

When a self diagnostic test is attempted on a single-side system CPU only of the apparatus, the CPU of interest cannot be isolated from the operation of the apparatus. Even when a data mismatch is detected in the data matching process on the CPUs with one of the CPUs suspected of being faulty, no self diagnostic test cannot be conducted.

When an error of the data mismatch takes place in the matching process of data input to and output from the CPUs, the CPUs have to be immediately reset with no other options allowed in recovering the computerized dual-system interlocking apparatus. In the event of an error due to a transient cause such as noise, from which the apparatus can be recovered, the CPUs have to be re-initialized to get the computerized dual-system interlocking apparatus started. This increases the frequency of suspensions of the computerized dual-system interlocking apparatus.

SUMMARY OF THE INVENTION Accordingly, it is an object of the present invention to provide a highly reliable computerized dual-system interlocking apparatus that allows data input to and output from CPUs to be selectively matched, and speeds up apparatus processing speed so that a large number of signals and switches are controlled, and decreases the frequency of suspensions of the apparatus due to an error attributed to a transient cause such as noise.

The computerized dual-system interlocking apparatus of the present invention, in its first aspect, comprises data matching means for causing a first CPU and a second CPU to perform identical processes to identical input information as necessary and for determining data match between sets of data resulting from the identical processes by matching one set of data against another, and reset means for issuing reset signals to the first and second CPUs when the sets of data fail to match.

The computerized dual-system interlocking apparatus of the present invention, in its second aspect, comprises data matching means for causing a first CPU and a second CPU to perform identical processes to identical input information as necessary and for determining data match between sets of data resulting from the identical processes by matching one set of data against another, standby state setting means for making the first and second CPUs wait in;standby for the processes during data matching operation, and for releasing the first and second CPUs free from the standby state when the data matching means determines that the sets of data match, and reset means for issuing reset signals to the first and second CPUs when the sets of data fail to match.

The computerized dual-system interlocking apparatus of the present invention, in its third aspect, comprises matching start means for issuing a data matching start signal in response to data write operations by the first and second CPUs, whereby the data matching means matches the sets of data resulting from the processes of the first and second CPUs when the data matching means receives the data matching start signal.

The computerized dual-system interlocking apparatus of the present invention, in its forth aspect, comprises matching start means for issuing a data matching start signal when it becomes necessary to match the sets of data resulting from the processes of the first and second CPUs, whereby the data matching means matches the sets of data resulting from the processes of the first and second CPUs when the data matching means receives the matching start signal.

In the computerized dual-system interlocking apparatus of the present invention, in its fifth aspect, the matching start means issues a start signal to the data matching means when the first and second CPUs generate predetermined write addresses, whereby the data matching means matches the sets of data resulting from the processes of the first and second CPUs when the write addresses are generated.

In the computerized dual-system interlocking apparatus of the present invention, in its sixth aspect, the matching start means issues a start signal to the data matching means in an information write mode during which the first and second CPUs write predetermined information, whereby the data matching means matches the sets of data resulting from the processes of the first and second CPUs in the information write mode.

The computerized dual-system interlocking apparatus of the present invention, in its seventh aspect, comprises counter means for counting the number of errors each time a data mismatch indicative of the computation error by the first and second CPUs is detected during data matching operation, whereby the reset means issues reset signals to the first and second CPUs when the error count exceeds a threshold value.

The computerized dual-system interlocking apparatus of the present invention, in its eighth aspect, comprises interrupt means for notifying the first and second CPUs of a computation error when a data mismatch indicative of the computation error by the first and second CPUs is detected during data matching operation.

In the computerized dual-system interlocking apparatus of the present invention, in its ninth aspect, the interrupt means notifies the first and second CPUs of a computation error when a data mismatch indicative of the computation error by the first and second CPUs is detected during data matching operation, and simultaneously, the interrupt means notifies the matching start means of the computation error to end the start signal to the data matching means, and the first and second CPUs independently perform fault diagnosis.

BRIEF DESCRIPTION OF THE DRAWINGS Fig. 1 is a block diagram showing a computerized dual-system interlocking apparatus according to an embodiment 1 of the present invention.

Fig. 2 is a flow diagram showing the operation of a matching circuit 3A in the embodiment 1 of the present invention.

Fig. 3 is a block diagram showing a computerized dual-system interlocking apparatus according to an embodiment 2 of the present invention.

Fig. 4 is a flow diagram showing the operation of a matching circuit 3B in the embodiment 2 of the present invention.

Fig. 5 is a block diagram showing a computerized dual-system interlocking apparatus according to an embodiment 3 of the present invention.

Fig. 6 is a flow diagram showing the operation of a matching circuit 3C in the embodiment 3 of the present invention.

Fig. 7 is a block diagram showing a computerized dual-system interlocking apparatus according to an embodiment 4 of the present invention.

Fig. 8 is a flow diagram showing the operation of a matching circuit 3D in the embodiment 4 of the present invention.

Fig. 9 is a block diagram showing a computerized dual-system interlocking apparatus according to an embodiment 5 of the present invention.

Fig. 10 is a flow diagram showing the operation of a matching circuit 3E in the embodiment 5 of the present invention.

Fig. 11 is a block diagram showing a computerized dual-system interlocking apparatus according to an embodiment 6 of the present invention.

Fig. 12 is a flow diagram showing the operation of a matching circuit 3F in the embodiment 6 of the present invention.

Fig. 13 is the block diagram showing the known computerized dual-system interlocking apparatus.

DESCRIPTION OF THE PREFERRED EMBODIMENTS Embodiment 1 The embodiment 1 of the present invention is now discussed. Fig. 1 is the block diagram showing a computerized dual-system interlocking apparatus according to the embodiment 1 of the present invention. In Fig. 1, components equivalent or identical to those described with reference to Fig. 13 are designated with the same reference numerals. There are shown a control panel 1 such as station control apparatus in a traffic control system for issuing route data to a safety computerized dual-system interlocking apparatus, and a link system 2 for connecting the control panel 1 to an interlocking system 36A.

The interlocking system 36A comprises a first CPU7, a second CPU13, wait circuits 19 and 21 as standby state setting means associated with CPU7 and CPU13, respectively, for making CPU7 and CPU13 wait in standby state for data processing during data matching of data input to and output from CPU7 and CPUl3, and a matching circuit 3A for performing data matching to the data input to and output from CPU7 and CPU13.

The matching circuit 3A comprises a latch 15 for storing the data output on the data bus 14 of CPU7, a latch 17 for storing the data output on the data bus 18 of CPU13, a data matching circuit 16 as data matching means for matching the data on the data bus 14 against the data on the data bus 18 (data processed by CPU7 and CPU13), a mismatch latch circuit 20 for storing an error signal E when an error (a mismatch between processed data) is detected through the data matching by the data matching circuit 16, a reset circuit 5 as reset means for issuing reset signals 4, 6 to CPU7 and CPU13, respectively, based on the error signal E from the mismatch latch circuit 20, to reset the operations of CPU7 and CPU13, and a matching start/stop circuit:10 as matching start means for starting/stopping data matching based on read signals 8, 11 and write signals 9, 12.

The operation of the interlocking system 36A of the computerized dual-system interlocking apparatus is now discussed.

CPU7 and CPU13 perform identical processes each time identical input data from the link system 2 is written on CPU7 and CPUl3, and then outputs data to the respective data buses 14, 18. The processed data on the data buses 14, 18 are fed to the data matching circuit 16 via the respective latches 15, 17.

The operation of the matching circuit 3A of the embodiment 1 is now discussed referring to the flow diagram in Fig. 2.

At step ST1, at the startup of the apparatus, CPU7 and CPU13 set beforehand the write signals 9, 12 or read signals 8, 10 of the processed data for a field device 35. At step ST2, CPU7 and CPU13 issue the write signals 9, 12 set for the field device 35, and determines whether the data is written.

When neither CPU? nor CPU13 issues the write signals 9 12 with no write operation performed, CPU7 and CPU13 execute control process of the field device without standby state in processing (step ST3), and thus output the processed data to the field device 35 through the latches 15, 17, the data matching circuit 16 and then an input/output bus 32.

When CPU7 and CPU13 issue the write signals 9, 12 to the matching start/stop circuit 10, it in turn issues a matching start signal S to the data matching circuit 16. CPU7 and CPU13 perform identical process to the identical input data, and output their processed data onto the respective data buses 14, 18 to store them on the respective latches 15, 17 and then to allow the data matching circuit 16 to receive them for data matching (step ST4). During data matching operation, the data matching circuit 16 activates the wait circuits 19, 21, thus keeping CPU7 and CPU13 in the standby state until the data matching operation is completed (step ST5). When the data matching circuit 16 determines at step ST6 the result of data matching to be correct and error-free, it stops activating the wait circuits 19, 21 and releases CPU7 and CPU13 out of standby state for a next step of process (step ST7).

When at step ST6, on the other hand, the data matching circuit 16 determines the result of data matching to be a mismatch between the process results by CPU7 and CPU13, regarding it as an error, the mismatch latch circuit 20 stores the error signal E that is the result given by the data matching circuit 16 (step ST8). The mismatch latch circuit 20 outputs the error signal E to the reset circuit 5, which in turn issues the reset signals 4, 6 to CPU7 and CPU13, respectively, to reset them. The operation of the interlocking system 36A now ends (step ST9). As a result, the field devices 35 such as the signals and switches are protected from erroneous processed data from CPU7 and CPU13 and are thus prevented from malfunctioning.

Embodiment 2 In the embodiment 1, when the data for controlling the field devices, if not specifically related to the safety of traffic, are written on CPU7 and CPU13, both CPUs process the data and then the processed data are continuously matched. To increase the processing speed of CPU7 and CPU13, only data that are specifically related to the safety of traffic may be selected, processed, and them matched. This arrangement sets CPU7 and CPU13 free from waiting in the standby state until the data matching circuit 16 completes data matching operation, each time data are written on CPU7 and CPU13.

Referring to Fig. 3, the embodiment 2 of the present invention is now discussed. In Fig. 3, components equivalent or identical to those described with reference to Fig. 1 are designated with the same reference numerals. There are shown a matching circuit 3B, an address bus 22 connected to CPU7, an address latch 23 for storing the address data of the address bus 22, an address bus 25 connected to CPU13, and an address latch 24 for storing the address data of the address bus 25.

The operation of the interlocking system 36B of the computerized dual-system interlocking apparatus is now discussed.

When CPU7 and CPU13 issue to the address buses 22, 25, respectively, addresses onto which data related to the safety of traffic are written, the matching start/stop circuit 10 reads the addresses through the address buses 22, 25, and issues the matching start signal S to the data matching circuit 16. CPU7 and CPU13 process the data specified by the addresses output onto the address buses 22, 25. The data matching circuit 16 receives the processed data from CPU7 and CPU13, through the data buses 14, 18, and the latches 15, 17, respectively, and then starts data matching operation.

The operation of the matching circuit 3B in the embodiment 2 is now discussed, referring to the flow diagram in Fig. 4. At step ST21, addresses within a specified range onto which data related to the safety are written are set in CPU7 and CPU13. The addresses are instruction data for causing the matching start/stop circuit 10 to initiate matching operation. The matching start/stop circuit 10 issues the matching start signal S to the data matching circuit 16 only when the matching start/stop circuit 10 receives the set addresses through the address buses 22, 25 of CPU7 and CPU13, and address latches 23, 24, respectively.

At step ST22, a determination is made of whether CPU7 and CPU13 issue the addresses within the specified range. If neither CPU7 nor CPU13 issues the addresses within the specified range, the wait circuits 19, 21 are not activated.

CPU7 and CPU13 therefore process fast the written data without any standby time involved (step ST3).

When at step ST22, CPU7 and CPU13 generate the addresses within the specified range, the matching start/stop circuit 10 issues the matching start signal S to the data matching circuit 16. The data matching circuit 16 collects through the latch 15, 17 the process results CPU7 and CPU13 present after processing the data of the addresses within the specified range (step ST4).

During data matching operation, the data matching circuit 16 activates the wait circuits 19, 21, thus keeping CPU7 and CPU13 in the standby state until the data matching operation is completed (step ST5). When the data matching circuit 16 determines at step ST6 the result of data matching to be correct and error-free, it stops activating the wait circuits 19, 21 and releases CPU7 and CPU13 out of standby state for a next step of process (step So7).

When at step ST6, on the other hand, the data matching circuit 16 determines the result of data matching to be a mismatch between the process results by CPU7 and CPU13, regarding it as an error, and the mismatch latch circuit 20 stores the error signal E that is the result given by the data matching circuit 16 (step ST8). The mismatch latch circuit 20 outputs the error signal E to the reset circuit 5, which in turn issues the reset signals 4, 6 to CPU7 and CPU13, respectively, to reset them. The operation of the interlocking system 36B now ends (step ST9). As a result, the field devices 35 such as the signals and switches are protected from erroneous processed data from CPU7 and CPU13 and are thus prevented from malfunctioning.

Embodiment 3 In embodiments 1 and 2, when data are written on CPU7 and CPUl3, both CPUs process the data to be used in data matching operation. The apparatus may start up from a test mode, such as an initialization, and then shift to an operation mode. Data matching may be performed only during the operation mode to diagnose CPU7 and CPUl3.

Referring to Fig. 5, the embodiment 3 of the present invention is now discussed. In Fig. 5, components equivalent or identical to those described with reference to Fig. 1 are designated with the same reference numerals. There are shown a matching circuit 3C, an operation mode signal 26 output from CPU7, and an operation mode signal 27 output from CPU13. When operation mode signals 26, 27 are output, the matching start/stop circuit 10 issues the matching start signal S to the data matching circuit 16.

The operation of the interlocking system 36C of the computerized dual-system interlocking apparatus is now discussed. CPU7 and CPU13 output the respective operation mode signals 26, 27 to the matching start/stop circuit 10, which in turn issues the matching start signal S to the data matching circuit 16. The data matching circuit 16 collects the processed data from CPU7 and CPU13 via the data buses 14, 18, and the latches 15, 17, respectively, to perform data matching.

Referring to the flow diagram in Fig. 6, the operation of the matching circuit 3C of the embodiment 3 is discussed.

At step ST31, the matching start/stop circuit 10 is set up so that the operation mode signals 26, 27, when output, initiate data matching while disabling data matching during initialization or test mode. At step ST32, when CPU7 and CPU13 issue no operation signals 26, 27, CPU7 and CPUl3 process written data without any standby time involved (step ST3).

When CPU? and CPU13 issue the operation mode signals 26, 27 at step ST32, the matching start/stop circuit 10 issues the matching start signal S to the data matching circuit 16 to activate it. The data matching circuit 16 collects via the latches 15, 17 the data that have been processed when CPU7 and CPU13 have issued the operation mode signals 26, 27 (step ST4), and then performs data matching operation to the processed data.

During data matching operation, the data matching circuit 16 activates the wait circuits 19, 21, thus keeping CPU7 and CPU13 in the standby state until the data matching operation is completed (step ST5). When the data matching circuit 16 determines at step ST6 the result of data matching to be correct and error-free, it stops activating the wait circuits 19, 21 and releases CPU7 and CPU13 out of standby state for a next step of process (step ST7).

When at step ST6, on the other hand, the data matching circuit 16 determines the result of data matching to be a mismatch between the process results by CPU7 and CPU13, regarding it as an error, and the mismatch latch circuit 20 stores the error signal E that is the result given by the data matching circuit 16 (step ST8). The mismatch latch circuit 20 outputs the error signal E to the reset circuit 5, which in turn issues the reset signals 4, 6 to CPU7 and CPU13, respectively, to reset them. The operation of the interlocking system 36C now ends (step ST9). As a result, the field devices 35 such as the signals and switches are protected from erroneous processed data from CPU7 and CPU13 and are thus prevented from malfunctioning. Since the data matching circuit 16 starts data matching when CPU7 and CPU13 successfully start up from the test mode such as initialization and shift into the operation mode, the processing speed of the entire apparatus is increased.

Embodiment 4 In preceding embodiments 1 through 3, the data matching circuit 16 resets CPU7 and CPU13 even when they suffer an transient error attributed to noise, for example, from which CPU7 and CPU13 can be recovered, without resetting themselves.

In this embodiment, an error is recognized as an actual error only when its error count exceeds a predetermind value, and CPU7 and CPU13 are then reset. This arrangement reduces the frequency of suspensions of the computerized dual-system interlocking apparatus.

Referring to Fig. 7, the embodiment 4 of the present invention is now discussed. In Fig. 7, components equivalent or identical to those described with reference to Fig. 1 are designated with the same reference numerals. There are shown a matching circuit 3D and an error counter 28 as counter means. The error counter 28 counts the error signals E output from the mismatch latch circuit 20, and issues an error indicator signal D to the reset circuit 5 to notifying it of the occurrence of a malfunction when the count exceeds the threshold.

The operation of the interlocking system 36D in the computerized dual-system interlocking apparatus is discussed.

CPU7 and CPUl3 perform identical processes each time identical input data from the link system 2 is written on CPU7 and CPU13 for startup of the apparatus, and then outputs data to the respective data buses 14, 18. The processed data on the data buses 14, 18 are fed to the data matching circuit 16 via the respective latches 15, 17.

In response to a mismatch, the data matching circuit 16 determines that a fault lies in-a:CPU, and issues its determination result in the form of an error signal E to the mismatch latch circuit 20 to be stored there. The error signal E is counted by the error counter 28. When the count exceeds the threshold, the error counter 28 issues the error indicator signal D to the reset circuit 5 to notify the occurrence of the malfunction.

The operation of the matching circuit 3D is discussed referring to the flow diagram in Fig. 8. At step ST1, CPU7 and CPU13 are set up so that data matching operation is initiated when CPU7 or CPU13 issues the write signal 9 or 12 to the matching start/stop circuit 10. At step ST2, a determination is made of whether CPU7 and CPU13 have issued the write signals 9, 12. If neither CPU7 nor CPU13 performs write operation, CPU7 and CPU13 perform control process of the field device without any standby time involved (step ST3), and output processed data to the field device 35 through the latches 15, 17 and the data matching circuit 16, and the input/output bus 32.

When CPU7 and CPU13 issue the write signals 9, 12 to the matching start/stop circuit 10, it in turn issues a matching start signal S to the data matching circuit 16. CPU7 and CPU13 perform identical process to the identical input data, and output their processed data onto the respective data buses 14, 18 to store them on the respective latches 15, 17 and then to allow the data matching circuit 16 to receive them for data matching (step ST4).

During data matching operation, the data matching circuit 16 activates the wait circuits 19, 21, thus keeping CPU7 and CPU13 in the standby state until the data matching operation is completed (step ST5). When the data matching circuit 16 determines at step ST6 the result of data matching to be correct and error-free, it stops activating the wait circuits 19, 21 and releases CPU? and CPU13 out of standby state for a next step of process (step ST7).

When at step ST6, on the other hand, the data matching circuit 16 determines the result of data matching to be a mismatch between the process results by CPU7 and CPU13, regarding it as an error, and the mismatch latch circuit 20 stores the error signal E that is the result given by the data matching circuit 16 (step ST8), and increases the count at the error counter 28 by +1 (step ST10). At step STll, a determination is made of whether the count exceeds the predetermind value. If the count is smaller than the threshold, the sequence goes back to normal path.

A count in excess of the threshold at step STl1 means a malfunction, and the result of determination is issued in the form of the error indicator signal D to the reset circuit 5.

Upon receiving the error indicator signal D, the reset circuit 5 issues the reset signals 4 and 6 to CPU7 and CPU13, respectively. Reading the reset signals over a predetermined computation cycle, CPU7 and CPU13 reset their operation (step ST9).

As a result, the field devices 3 and switches are protected from erroneous processed data from CPU? and CPU13 and are thus prevented from malfunctioning.

The use of the error counter 28 expedites recovery process from a transient error and thus enhances utilization of the entire apparatus.

If the data matching circuit 16 emits no error signal 1 for a predetermined period of time, the error counter 28 is reset to zero.

Embodiment 5 In the preceding embodiments, each of CPU7 and CPU13 resets its operation when it reads a reset signal over a predetermined computing cycle. -Thus, there is a time before a resetting operation takes place. In this embodiment, each time an error takes place, each of CPU7 and CPU13 is interrupted, regardless of the frequency of errors, so that CPU7 and CPU13 are forced to shift to their state for reading the reset signals from the reset circuit 5 with priority over other processings.

The embodiment 5 of the present invention is now discussed referring to Fig. 9. In Fig. 9, components equivalent or identical to those described with reference to Fig. 7 are designated with the same reference numerals. There are shown a matching circuit 3E and an interrupt generator circuit 29 as interrupt means. Receiving the error signal E output from the mismatch latch circuit 20, the interrupt generator circuit 29 issues interrupt outputs to CPU7 and CPU13. Designated 30 is an interrupt signal for CPU7, and 31 is an interrupt signal for CPU13.

The operation of the interlocking system 36E in the computerized dual-system interlocking apparatus is discussed.

CPU7 and CPU13 perform identical processes each time identical input data from the link system 2 is written on CPU7 and CPU13 for startup of the apparats, and then outputs data to the respective data buses 14, 18. The processed data on the data buses 14, 18 are fed to the data matching circuit 16 via the respective latches 15, 17 for data matching.

In response to a mismatch, the data matching circuit 16 determines that a fault lies in a CPU, and issues its determination result in the form of an error signal E to the mismatch latch circuit 20 to be stored there. The mismatch latch circuit 20 in turn issues the error signal E to the interrupt generator circuit 29. As a result, the interrupt generator circuit 29 issues the interrupt signals 30, 31 to CPU?, CPU13, respectively, to cause CPU7 and CPU13 to read the reset signals 4, 6, respectively,;from the reset circuit 5 with priority over other processings.

The error counter 28 counts the error signals E and issues the error indicator signal D to the reset circuit 5.

The reset circuit 5 outputs the reset signals 4, 6 to CPU7, CPU13 which are ready to read them. Thus, CPU7 and CPU13 immediately reset themselves.

The operation of the matching circuit 3E is discussed referring to the flow diagram in Fig. 10.

At step ST1, CPU7 and CPU13 are set up so that data matching operation is initiated when CPU7 and CPU13 issue the write signals 9 and 12 to the matching start/stop circuit 10.

At step ST2, a determination is made of whether CPU7 and CPU13 have issued the write signals 9, 12. If neither CPU7 nor CPU13 performs write operation, CPU7 and CPU13 perform control process of the field device without any standby time involved (step ST3), and output processed data to the field device 35 through the latches 15, 17, the data matching circuit 16, and the input/output bus 32.

When CPU7 and CPU13 issue the write signals 9, 12 to the matching start/stop circuit 10, it in turn issues a matching start signal S to the data matching circuit 16. CPU7 and CPU13 perform identical process to the identical input data, and output their processed data onto the respective data buses 14, 18 to store them on the latches 15, 17 and then to allow the data matching circuit 16 to receive them for data matching (step ST4).

During data matching operation, the data matching circuit 16 activates the wait circuits 19, 21, thus keeping CPU7 and CPU13 in the standby state until the data matching operation is completed (step ST5). When the data matching circuit 16 determines the result of data matching to be correct and error-free (step ST6), it stops activating the wait circuits 19, 21 and releases:CPU7 and CPU13 out of standby state for a next step of process (step ST7).

When at step ST6, on the other hand, the data matching circuit 16 determines the result of data matching to be a mismatch between the process results by CPU7 and CPU13, regarding it as an error, and the mismatch latch circuit 20 stores the error signal E that is the result given by the data matching circuit 16 (step ST8), and increases the count at the error counter 28 by +1 (step So10).

The data matching circuit 16 outputs the error signal E to activate the interrupt generator circuit 29, which in turn outputs the interrupt signals 30, 31 to CPU7, CPU13, respectively (step ST12). As a result, CPU7 and CPU13 are ready to read the reset signals 4, 6 from the reset circuit 5 with priority over other processings. At step STll, a determination is made of whether the count exceeds the threshold value. If the count is smaller than the threshold, the sequence goes back to normal path.

A count in excess of the predetermined value at step Still means a malfunction, and the result of determination is issued in the form of the error indicator signal D to the reset circuit 5. Upon receiving the error indicator signal D, the reset circuit 5 issues the reset signals 4 and 6 to CPU7 and CPU13, respectively. CPU7 and CPU13 are already interrupted and ready for reading the reset signals 4, 6, respectively. Upon receiving the reset signals 4, 6, CPU7 and CPU13 immediately reset their operations (step ST9), respectively.

As a result, the field devices 35 such as the signals and switches are protected from erroneous processed data from CPU7 and CPU13 and are thus prevented from malfunctioning.

The data matching circuit 16 notifies CPU7 and CPU13 of the occurrence of a malfunction through the interrupt generator circuit 29, speeding up recovery process from a transient error and thus enhancing utilization of the entire apparatus.

If the data matching circuit 16 emits no error signal E for a predetermined period of time, an interrupt generator circuit 29 is reset and the error counter 28 is reset to zero.

Embodiment 6 In the embodiment 5, the interrupt generator circuit 29 outputs the interrupt signals to CPU7 and CPU13 to make them ready for reading the reset signals. In this embodiment, an interrupt generator circuit 29a outputs interrupt signals 30 and 31 to CPU7 and CPU13, respectively, while issuing the interrupt signal 31 to the matching start/stop circuit 10 at the same time. The matching start/stop circuit 10 suspends the transmission of the matching start signal S to the data matching circuit 16 to stop data matching, allowing CPU7 and CPU13 to self diagnose independent of the matching operation.

The embodiment 6 of the present invention is now discussed referring to Fig. 11. In Fig. 11, components equivalent or identical to those described with reference to Fig. 9 are designated with the same reference numerals. There are shown a matching circuit 3F and an interrupt generator circuit 29a as the interrupt means. Receiving the error signal E output from the mismatch latch circuit 20, the interrupt generator circuit 29a issues interrupt outputs to CPU7 and CPU13. Designated 30 is an interrupt signal for CPU7, and 31 is an interrupt signal for CPUl3 and the matching start/stop circuit 10.

The operation of the matching circuit 3F is discussed referring to the flow diagram in Fig. 12. At step ST1, CPU7 and CPU13 are set up so that data matching operation is initiated when CPU7 and CPU13 issue the write signals 9 and 12 to the matching start/stop circuit 10. At step ST2, a determination is made of whether CPU7 and CPU13 have issued the write signals 9, 12. If neither CPU7 nor CPU13 performs write operation, CPU7 and CPU13 perform control process of the field device without any standby time involved (step ST3), and output processed data to the field device 35 through the latches 15, 17, the data matching circuit 16 and the input/output bus 32.

During data matching operation, the data matching circuit 16 activates the wait circuits 19, 21, thus keeping CPU7 and CPU13 in the standby state until the data matching operation is completed (step ST5). When the data matching circuit 16 determines the result of data matching to be correct and error-free (step ST6), it stops activating the wait circuits 19, 21 and releases CPU7 and CPU13 out of standby state for a next step of process (step ST7).

When at step ST6, on the other hand, the data matching circuit 16 determines the result of data matching to be-a mismatch between the process results by CPU7 and CPU13, regarding it as an error, and the mismatch latch circuit 20 stores the error signal E that is the result given by the data matching circuit 16 (step ST8), and increases the count at the error counter 28 by +1 (step ST10).

The data matching circuit 16 outputs the error signal E to activate the interrupt generator circuit 29a, which in turn outputs the interrupt signals 30, 31 to CPU7, CPU13, respectively (step ST12). At the:moment the interrupt signal 31 is issued to the matching start/stop circuit 5, the matching start signal S ends, immediately stopping data matching at the data matching circuit 16 (step ST13). CPU7 and CPU13 self diagnose independently. As a result, CPU7 and CPU13 speed up recovery process from a transient error regardless of the error count, and are set ready for reading the reset signals 4, 6 from the reset circuit with priority over other processings. At step STl1, a determination is made of whether the count exceeds the predetermined value. If the count is smaller than the threshold, the sequence goes back to normal path.

A count in excess of the prederemined value at step STIl means a malfunction, and the result of determination is issued in the form of the error indicator signal D to the reset circuit 5. Upon receiving the error indicator signal D, the reset circuit 5 issues the reset signals 4 and 6 to CPU7 and CPU13, respectively.

CPU7 and CPU13 are already interrupted and ready for reading the reset signals 4, 6, respectively. Upon receiving the reset signals 4, 6, CPU7 and CPU13 immediately reset their operations (step ST9), respectively. This prevents a hang-up of the program of the apparatus.

When an error is detected through data matching, each of CPU7 and CPU13 is allowed to self diagnose on itself. This speeds up recovery process from a transient error and enhances utilization of the entire apparatus. If the data matching circuit 16 emits no error signal E for a predetermined period of time, an interrupt generator circuit 29a is reset and the error counter 28 is reset to zero.

According to the first aspect of the present invention, the computerized dual-system interlocking apparatus comprises data matching means for causing a first CPU and a second CPU to perform identical processes to identical input information as necessary and for determining data match between sets of data resulting from the identical processes by matching one set of data against another, and reset means for issuing reset signals to the first and second CPUs when the sets of data fail to match. Thus, the computation time of data to be matched through the CPUs is shortened, and the control and processing time of the entire apparatus is shortened as well.

According to the second aspect of the present invention, the apparatus comprises data matching means for causing a first CPU and a second CPU to perform identical processes to identical input information as necessary and for determining data match between sets of data resulting from the identical processes by matching one set of data against another, standby state setting means for making the first and second CPUs wait in standby for the processes during data matching operation, and for releasing the first and second CPUs free from the standby state when the data matching means determines that the sets of data match, and reset means for issuing reset signals to the first and second CPUs when the sets of data fail to match. Thus, besides the advantage of the first aspect, sufficient time is allowed for checking the operation of the CPUs.

According to the third aspect of the present invention the apparatus comprises matching start means for issuing a data matching start signal in response to data write operations by the first and second CPUs, whereby the data matching means matches the sets of data resulting from the processes of the first and second CPUs when the data matching means receives the data matching start signal. Thus, the computation time of data to be matched through the CPUs is shortened, and the control and processing time of the entire apparatus is shortened as well.

According to the fourth aspect of the present invention, the apparatus comprises matching start means for issuing a data matching start signal when it becomes necessary to match the sets of data resulting from the processes of the first and second CPUs, whereby the data matching means matches the sets of data resulting from the processes of the first and second CPUs when the data matching means receives the matching start signal. Thus, the data matching efficiency of the apparatus is heightened.

According to the fifth aspect of the present invention, the matching start means issues a start signal to the data matching means when the first and second CPUs generate predetermined write addresses, whereby the data matching means matches the sets of data resulting from the processes of the first and second CPUs when the write addresses are generated.

The data write address range related to the safety of traffic is set beforehand such that the computation of the data to be matched is reliably performed.

According to the sixth aspect of the present invention, the matching start means issues a start signal to the data matching means in an information write mode during which the first and second CPUs write predetermined information, whereby the data matching means matches the sets of data resulting from the processes of the first and second CPUs in the information write mode. Data matching operation is carried out during the operation mode only with no matching operation initiated during the test mode. Thus, the test is easily performed, and the fault diagnosis of the apparatus is facilitated.

According to the seventh aspect of the present invention, the apparatus comprises counter means for counting the number of errors each time a data mismatch indicative of the computation error by the first and second CPUs is detected during data matching operation, and for causing the reset means to issue reset signals to the first and second CPUs when the error count exceeds a threshold value. By detecting immediately a transient mismatch due to noise, the recovery process from the error is sped up and utilization of the apparatus is heightened.

According to the eighth aspect of the present invention, the apparatus comprises interrupt means for notifying the first and second CPUs of a computation error when the data mismatch indicative of a computation error by the first and second CPUs is detected during data matching operation. Thus, the error status is immediately checked, and the recovery process from the transient mismatch is sped up.

According to the ninth aspect of the present invention, the interrupt means notifies the first and second CPUs of a computation error when the data mismatch indicative of the computation error by the first and second CPUs is detected during data matching operation, and simultaneously, the interrupt means notifies the matching start means of the computation error to end the start signal to the data matching means, and the first and second CPUs independently perform fault diagnosis. The recovery process from the transient mismatch is thus sped up.

Claims

WHAT IS CLAIMED IS:

1. A computerized dual-system interlocking apparatus comprising data matching means for causing a first CPU and a second CPU to perform identical processes to identical input information as necessary and for determining data match between sets of data resulting from the identical processes by matching one set of data against another, and reset means for issuing reset signals to the first CPU and second CPU when the sets of data fail to match.

2. A computerized dual-system interlocking apparatus comprising data matching means for causing a first CPU and a second CPU to perform identical processes to identical input information as necessary and for determining data match between sets of data resulting from the identical processes by matching one set of data against another, standby state setting means for making the first CPU and second CPU wait in standby for the processes during data matching operation, and for releasing the first CPU and second CPU free from the standby state when the data matching means determines that the sets of data match, and reset means for issuing reset signals to the first CPU and second CPU when the sets of data fail to match.

3. A computerized dual-system interlocking apparatus according to one of Claims 1 and 2 further comprising matching start means for issuing a data matching start signal in response to data write operations by the first CPU and second CPU, whereby the data matching means matches the sets of data resulting from the processes of the first CPU and second CPU when the data matching means receives the matching start signal.

4. A computerized dual-system interlocking apparatus according to one of Claims 1 and 2 further comprising matching start means for issuing a data matching start signal when becomes necessary to match the sets of data resulting from the processes of the first CPU and second CPU, whereby the data matching means matches the sets of data resulting from the processes of the first CPU and second CPU when the data matching means receives the matching start signal.

5. A computerized dual-system interlocking apparatus according to Claim 4 F wherein the matching start means issues a start signal to the data matching means when the first CPU and second CPU generate predetermined write addresses, whereby the data matching means matches the sets of data resulting from the processes of the first CPU and second CPU when the write addresses are generated.

6. A computerized dual-system interlocking apparatus according to Claim 4, wherein the matching start means issues a start signal to the data matching means in an information write mode during which the first CPU and second CPU write predetermined information, whereby the data matching means matches the sets of data resulting from the processes of the first CPU and second CPU in the information write mode.

7. A computerized dual-system interlocking apparatus according to one of Claims 1 through 6 further comprising counter means for counting the number of errors each time a data mismatch indicative of the computation error by one of the first CPU and second CPU is detected during data matching operation, whereby the reset means issues reset signals to the first CPU and second CPU when the error count exceeds a predetermined value.

8. A computerized dual-system interlocking apparatus according to Claim 7 further comprising interrupt means for notifying the first CPU and second CPU of a computation error when a data mismatch indicative of the computation error by one of the first CPU and second CPU is detected during data matching operation.

9. A computerized dual-system interlocking apparatus according to Claim 8, wherein the interrupt means notifies the first CPU and secod CPU of a computation error when the data mismatch indicative of the computation error by one of the first CPU and second CPU is detected during data matching operation, and simultaneously, the interrupt means notifies the matching start means of the computation error to end the start signal to the data matching means, and the first CPU and second CPU independently perform fault diagnosis.

10. A computerized dual-system interlocking apparatus substantially as hereinbefore described with reference to Figures 1 and 2; or Figures 3 and 4; or Figures 5 and 6; or Figures 7 and 8; or Figures 9 and 10; or Figures 11 and 12 of the accompanying drawings.