JP2015184953A - Fail-safe control apparatus and fail-safe control method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a fail-safe control apparatus capable of selecting plural processing modes with a single mode selection switch while ensuring fail-safe performance.SOLUTION: The fail-safe control apparatus includes: a mode selection switch capable of selecting a desired processing mode from plural processing modes; plural nonvolatile memories for storing plural pieces of mode selection information selected by the mode selection switch; plural CPUs that determines a processing mode according to the mode selection information; and a collation section that compares and monitors outputs from the plural CPUs. The single mode selection switch is shared by the plural CPUs and each of the plural CPUs includes the nonvolatile memory.

Description

  The present invention relates to a fail-safe control device and a fail-safe control method, and is preferably applied to a fail-safe control device and a fail-safe control method for realizing fail-safe processing mode selection of a control device having a plurality of processing modes. is there.

  In a field requiring high safety such as a railway security device, a control device that controls multiplexed processing performs fail-safe control. That is, in the fail-safe control, the control device collates the processing results of the multiplexed processing, and continues normal operation if the processing results match, and transitions to a safe state as the system if they do not match.

  On the other hand, when the control device of the same hardware is used for a plurality of different purposes, it may be necessary to change the control program for each application destination and execute control processing depending on the use conditions of the control device. In such an application, when individual software is created for each control program, it becomes necessary to manage a plurality of software, and the management cost of the software increases.

  Therefore, a plurality of control program changes are prepared as processing modes in one software in advance to unify software management. Specifically, in accordance with an input from a switch or the like, the mode selection information selected from the processing mode prepared in the software is acquired and the process is switched.

  For example, Patent Document 1 discloses a technique for storing mode selection information in a nonvolatile memory based on the state of a switch, reading a mode from the nonvolatile memory when power is turned on, and performing control according to the mode. Has been. However, in patent document 1, fail-safe property is not considered.

  In fail-safe control devices, control must not be executed in the wrong processing mode due to misrecognition of mode selection information. Therefore, the switch input status can be validated by multiplexing switch inputs and comparing the switch input statuses. A method for confirming sex can be considered. For example, Patent Document 2 discloses a technique for comparing and collating multiplexed inputs. FIG. 4 is an example of a configuration in which switches are duplicated in a fail-safe control apparatus having duplicated CPUs.

JP-A-7-324735 JP-A-7-302207

  As shown in FIG. 4, when the switches are multiplexed, the number of parts increases, and it is difficult to reduce the size of the control device. Further, with the increase in the number of parts, the failure rate of the entire control device may increase and the operating rate may deteriorate.

  However, in order to prevent an operation in an incorrect processing mode due to a switch failure or the like, it is necessary to make the mode selection information redundant and to check the soundness of the mode selection information. Even if switches are multiplexed, all switches may be set to the wrong mode selection as well, and it is necessary to check the mode selection status of the control device by the maintenance personnel of the control device. It was.

  An object of the present invention is to provide a fail-safe control device and a fail-safe control method capable of selecting a plurality of processing modes with one mode selection switch without impairing the fail-safe property.

  In order to solve such a problem, in the present invention, a mode selection switch capable of selecting a desired processing mode from a plurality of processing modes, and a plurality of nonvolatile memories storing mode selection information selected by the mode selection switch; A plurality of CPUs that determine a processing mode according to the mode selection information, and a collation unit that compares and monitors outputs from the plurality of CPUs, and the one CPU is shared by the plurality of CPUs, A fail-safe control device is provided, wherein each of a plurality of CPUs is provided with the nonvolatile memory.

  According to this configuration, each of the plurality of CPUs stores the mode selection information selected by the mode selection switch in the nonvolatile memory, and each of the plurality of CPUs is stored in the nonvolatile memory. A processing mode is determined according to the mode selection information, and outputs from the plurality of CPUs are compared and monitored. As a result, software management can be facilitated while selecting multiple processing modes with a single mode selection switch without impairing fail-safety, preventing the increase in size of devices and the deterioration of operating rates. it can.

  According to the present invention, in the mode selection of a control device having a plurality of processing modes, a plurality of processing modes can be selected with a single mode selection switch without impairing fail-safety, thereby preventing an increase in the size of the device and operating rate. Software management can be facilitated while preventing deterioration of the software.

It is a block diagram which shows the structure of the fail safe control apparatus which concerns on the 1st Embodiment of this invention. It is a flowchart which shows the detail of the mode selection process concerning the embodiment. It is a block diagram which shows the structure of the fail safe control apparatus which concerns on the 2nd Embodiment of this invention. It is a block diagram which shows the structure of the conventional fail safe control apparatus.

  Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

(1) First Embodiment (1-1) Configuration of Fail-Safe Control Device FIG. 1 is a block diagram showing a configuration of a fail-safe control device according to the present embodiment. The fail-safe control device includes a CPU 1a and a CPU 1b, which are processors that execute arithmetic processing of the dual system control device. As shown in FIG. 1, a nonvolatile memory 2a is connected to the CPU 1a via a bus 3a, and a nonvolatile memory 2b is connected to the CPU 1b via a bus 3b.

  The nonvolatile memory 2a and the nonvolatile memory 2b store an area for storing two processing modes (processing mode 1 and processing mode 2) and an area for storing processing mode selection information (denoted as mode selection information in the figure). And are arranged.

  The operation states of the CPU 1a and the CPU 1b are monitored by the collation unit 4 by comparing the collation data 5a from the CPU 1a with the collation data 5b from the CPU 1b. The verification data 5a and the verification data 5b are the bus states of the CPU 1a and CPU 1b and the input / output data of the CPU 1a and CPU 1b.

  The collation result collated by the collation unit 4 is notified to the CPU 1a and the CPU 1b by the collation determination signal 6. When an abnormality is monitored by the verification unit 4, the CPU 1a and CPU 1b are notified that there is an abnormality in the CPU 1a or CPU 1b, and the CPU 1a and CPU 1b stop operating. When the collation result of the collation unit 4 is normal, the CPU 1a can output the output 7a and the CPU 1b can output the output 7b. Therefore, the output 7a and the output 7b are controlled by the output unit 8. 10 is output as a fail-safe control output 9.

  The state of the mode selection switch 13 (indicated as a switch in the figure) is transmitted as mode selection switch information 14 to each CPU. The mode selection switch 13 is composed of a plurality of bits and is coded by adding redundant bits in order to facilitate discrimination when a switch fails.

  In this embodiment, since there are two processing modes, 1-bit switch information can be realized, but the switch information is made redundant to 2 bits. For example, when processing mode 1 is selected, switch information is defined as “10”, and when processing mode 2 is selected, switch information is defined as “01”.

  The CPU 1a or CPU 1b creates mode selection information based on the mode selection switch information 14, and writes the created mode selection information in the corresponding storage areas of the nonvolatile memories 2a and 2b. At this time, the mode selection information should avoid a characteristic value such as “0000h” so that it can be easily discriminated when the nonvolatile memory fails. For example, when the processing mode 1 is selected, the mode selection information is defined as “A0A0h”, and when the processing mode 2 is selected, the mode selection information is defined as “0B0Bh” and the nonvolatile memory 2a and Write to the non-volatile memory 2b.

  The CPU 1a and the CPU 1b select their processing mode based on information stored in the nonvolatile memory 2a and the nonvolatile memory 2b. When referring to the mode selection information of the nonvolatile memory 2a and the nonvolatile memory 2b, each mode selection information is compared and verified by the verification unit 4. If the mode selection information matches, the processing mode is selected normally. On the other hand, when the mode selection information does not match, the CPU 1a and CPU 1b are notified that the processing mode selection information does not match, and the CPU 1a and CPU 1b execute processing such as operation stop.

  Further, the CPU 1a and the CPU 1b input their own mode selection states to the abnormality detection means 12 as mode selection state signals 11a and 11b. The abnormality detection means 12 displays the state of the input mode selection state signals 11a and 11b. As the state display of the mode selection state signal 11a and the mode selection state signal 11b by the abnormality detection means 12, for example, the states of the mode selection state signal 11a and the mode selection state signal 11b are displayed by LEDs or the like.

  The maintenance staff can visually check the display state of the abnormality detection means 12 and determine whether the mode selection state is normal or abnormal. The maintenance staff monitors the state displayed by the abnormality detection means 12 when the apparatus is activated for the first time, and confirms that the intended processing mode is selected. Thereby, the mode selection switch 13 is in a failure state, and based on the information of the mode selection switch 13, the wrong mode selection information is stored in the nonvolatile memories 2a and 2b, and the wrong processing mode is selected and executed. This can be prevented.

  As another embodiment of the abnormality detection means 12, the mode selection state signal 11a and the mode selection state signal 11b may be compared to determine whether or not they match. For example, when the control device side determines that the mode selection state signals do not match, the operation of each CPU may be stopped by a reset signal.

(1-2) Details of Mode Selection Processing Next, the mode selection processing executed by each CPU 1a and CPU 1b in the present embodiment will be described with reference to FIG. Each process after the power is turned on is constantly monitored by the collation unit 4, and it is constantly monitored that the operations of the CPU 1a and the CPU 1b are the same.

  As shown in FIG. 2, the CPU 1a and the CPU 1b read the values of the processing mode selection information areas of the nonvolatile memory 2a and the nonvolatile memory 2b after the control device is powered on (S101).

  Then, the CPU 1a and CPU 1b determine whether or not a valid value is set in the processing mode selection information in the processing mode selection information area read in step S101 (S102).

  If it is determined in step S102 that the processing mode selection information is a value indicating an unset state, the processes in and after step S103 are executed. Examples of the value indicating that the processing mode selection information is not set include “FFFFh” when the mode selection information is 16 bits.

  When the processing mode selection information is not set, the CPU 1a and the CPU 1b determine that the mode selection information areas of the nonvolatile memory 2a and the nonvolatile memory 2b are not written, and execute acquisition of switch information (S103). Each CPU 1a and CPU 1b that have acquired the switch information in step S103 creates mode selection information based on the acquired switch information (S104).

  Then, the CPU 1a and CPU 1b write mode selection information to the nonvolatile memory 2a and nonvolatile memory 2b (S105), and then read the nonvolatile memory to check whether the set value is written correctly (S106).

  If it is determined in step S106 that the values set in the nonvolatile memory 2a and the nonvolatile memory 2b are correctly written, the CPU 1a and the CPU 1b execute an operation according to the selected processing mode (S108). On the other hand, if writing to the nonvolatile memory 2a and the nonvolatile memory 2b fails in step S106, that is, if there is an abnormality in the mode selection information written to the nonvolatile memory, the CPU 1a and the CPU 1b stop operating. (S107).

  In step S102, when it is confirmed that a valid value (for example, A0A0h or 0B0Bh) is set in the mode selection information when the mode selection information is acquired after the power is turned on, the CPU 1a and the CPU 1b select immediately. The operation is executed according to the processed mode (S108).

  On the other hand, when it is determined in step S102 that an invalid value is set in the mode selection information, the CPU 1a and the CPU 1b stop the operation of the control device (S109).

  As described above, when the mode selection information is not set, that is, only when the power is turned on for the first time, the CPU 1a and the CPU 1b acquire the state information of the mode selection switch 13. Thereafter, when the power is turned on again, the CPU 1a and the CPU 1b acquire mode selection information of the nonvolatile memories 2a and 2b, and execute a mode selection process. Therefore, once the state of the mode selection switch 13 is stored in the nonvolatile memories 2a and 2b, it is not necessary to consider the failure state of the mode selection switch 13, and it is possible to prevent deterioration in the operating rate of the apparatus. Become.

(2) Second Embodiment (2-1) Configuration of Fail-Safe Control Device Next, the configuration of the fail-safe control device according to the second embodiment of the present invention will be described with reference to FIG. Hereinafter, a configuration different from that of the first embodiment will be described in detail, and description of the same configuration will be omitted.

  In this embodiment, as shown in FIG. 3, in addition to the configuration of the first embodiment, memory rewriting means 15a and 15b for rewriting the nonvolatile memory 2a and the nonvolatile memory 2b are added. Yes.

  In the first embodiment, the mode selection information is stored in the nonvolatile memory 2a and the nonvolatile memory 2b only once at the time of initial startup. However, in the present embodiment, the nonvolatile memory 2a and the nonvolatile memory are stored. The mode selection information stored in the memory 2b can be rewritten. Specifically, the memory rewriting unit 15a and the memory rewriting unit 15b can initialize the mode selection information stored in the non-volatile memory 2a and the non-volatile memory 2b, and repeatedly store new mode selection information. Yes.

  In the present embodiment, the initialization of the nonvolatile memories 2a and 2b is performed by the memory rewriting means 15a and the memory rewriting means 15b during maintenance of the control device. Specifically, when the control device is turned on again by maintenance personnel, the mode selection information is set in the nonvolatile memory 2a and the nonvolatile memory 2b based on the information of the mode selection switch 13.

  Then, the CPU 1a and the CPU 1b select their processing mode based on the information stored in the nonvolatile memory 2a and the nonvolatile memory 2b. The CPU 1a and CPU 1b input their own mode selection states to the abnormality detection means 12 as mode selection state signals 11a and 11b. Then, the maintenance staff or the CPU monitors the state of the abnormality detection means 12 and confirms that the intended mode selection has been performed. As described above, also in the present embodiment, the soundness of the mode selection switch 13 can be confirmed in the same manner as in the first embodiment.

  In the first embodiment and the second embodiment, an example in which one processing mode is selected from the two processing modes has been described. However, the present invention is not limited to this example, and three or more processing modes can be selected. Similarly, when selecting one processing mode, the soundness of the mode selection switch 13 can be confirmed. Further, the type of processing mode to be switched can be applied to any of the whole program, a part of the program, or constants and variables used in the program.

1a, 1b CPU
2a, 2b Nonvolatile memory 3a, 3b Bus 4 Collation unit 5a, 5b Collation data 6 Collation result determination signal 7a, 7b Output data 8 Output unit 9 Control output 10 Control target 11a, 11b Mode selection state signal 12 Abnormality detection means 13 Mode selection switch 14 Mode selection switch information 15a, 15b Memory rewriting means

Claims (14)

A mode selection switch capable of selecting a desired processing mode from a plurality of processing modes;
A plurality of nonvolatile memories storing mode selection information selected by the mode selection switch;
A plurality of CPUs for determining a processing mode according to the mode selection information;
A verification unit that compares and monitors outputs from the plurality of CPUs,
One mode selection switch is shared by the plurality of CPUs, and each of the plurality of CPUs includes the nonvolatile memory.
A fail-safe control device. The mode selection information is stored in each nonvolatile memory at initialization,
2. The fail-safe control device according to claim 1, wherein each of the plurality of CPUs selects a processing mode in accordance with the mode selection information stored in the nonvolatile memory included in each CPU. The said collation part compares and collates the said mode selection information preserve | saved at each said non-volatile memory, and notifies a collation result to these several CPU, The one of Claim 1 or 2 characterized by the above-mentioned. Fail-safe control device. An abnormality detection means for detecting that the mode selection by the mode selection switch is abnormal,
The plurality of CPUs detect that the mode selection information is inconsistent and mode selection by the mode selection switch is abnormal when the collation unit is notified that the mode selection information is inconsistent. The fail-safe control device according to claim 1, wherein the fail-safe control device is notified. The mode selection information selected by the mode selection switch is redundantly encoded,
The fail-safe control apparatus in any one of Claims 1-4.   The fail-safe control device according to claim 1, wherein the mode selection information stored in the nonvolatile memory is redundantly encoded. Memory rewriting means for rewriting the mode selection information stored in the nonvolatile memory,
The memory rewriting means rewrites the mode selection information stored in the non-volatile memory with the mode selection information selected by the mode selection switch when the power of the apparatus is turned on again. The fail-safe control apparatus in any one of 1-6. A fail-safe in which a plurality of CPUs share a mode selection switch capable of selecting a desired processing mode from a plurality of processing modes, and each of the plurality of CPUs includes the nonvolatile memory. A fail-safe control method in a control device, comprising:
Each of the plurality of CPUs storing mode selection information selected by the mode selection switch in the nonvolatile memory;
Each of the plurality of CPUs determines a processing mode according to the mode selection information stored in the nonvolatile memory;
Comparing and monitoring outputs from the plurality of CPUs;
A fail-safe control method comprising: The mode selection information is stored in each nonvolatile memory at initialization,
The fail-safe according to claim 8, further comprising a step of each of the plurality of CPUs selecting a processing mode according to the mode selection information stored in the non-volatile memory provided in each CPU. Control method. 10. The method according to claim 8, further comprising a step of comparing the mode selection information stored in each of the nonvolatile memories and notifying the plurality of CPUs of a verification result. The fail-safe control method described in 1. The fail safe control device includes an abnormality detection means for detecting that the mode selection by the mode selection switch is abnormal,
When the plurality of CPUs are notified that the mode selection information is inconsistent by the collating unit, the above-described detection that the mode selection information does not match and the mode selection by the mode selection switch is abnormal. The fail-safe control method according to claim 8, further comprising a step of notifying the means. The mode selection information selected by the mode selection switch is redundantly encoded,
The fail-safe control method according to any one of claims 8 to 11.   The fail-safe control method according to claim 8, wherein the mode selection information stored in the nonvolatile memory is redundantly encoded. The fail safe control device includes a memory rewriting means for rewriting the mode selection information stored in the nonvolatile memory,
The memory rewriting means includes a step of rewriting the mode selection information stored in the nonvolatile memory with the mode selection information selected by the mode selection switch when the power of the apparatus is turned on again. The fail-safe control method according to any one of claims 8 to 13.

Images