JP2024005993A - Digital output control system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To identify a faulty output device among a plurality of output devices that control each of a plurality of control objects in accordance with the logic of two telegraphic messages that include digital information, without disconnecting each output device.

SOLUTION: The present invention comprises: a first arithmetic device that generates and outputs a first telegraphic message that includes first digital control information; a second arithmetic device that generates and outputs a second telegraphic message that includes second digital control information; a plurality of telegraphic message comparators for inputting a telegraphic message separately from each other and comparing both, and that outputs a telegraphic message separately from each other when a condition based on this comparison is met; a plurality of output devices that generate a first control signal on the basis of the first telegraphic message, generates a second control signal on the basis of the second telegraphic message, and controls each of the plurality of control objects in accordance with the logical product of the generated first and second control signals; and a multiplexed serial bus that connects each of the plurality of telegraphic message comparators and each of the plurality of output devices to each other in series by a multiplexed transmission line, respectively.

SELECTED DRAWING: Figure 1

COPYRIGHT: (C)2024,JPO&INPIT

Description

The present invention relates to a digital output control system that controls a controlled object by collating a plurality of messages containing digital control information.

If incorrect control is performed in control processing devices that control railway signal lights and switches, it may lead to an accident. For this reason, high safety is required of control processing devices in the field of railway signals. As a method to achieve a high level of safety, for example, the CPUs (Central Processing Units) that make up the control processing unit are multiplexed, the outputs of each CPU are collated, and if the collation results do not match, it is possible to quickly A method is adopted in which the controlled object is stopped in a safe direction. As an example of this method, a bus matching type processing device has been proposed that realizes a fail-safe function by matching the buses of duplicated CPUs without using special fail-safe matching logic (patent (See Reference 1).

However, in the method described in Patent Document 1, it is necessary to operate the duplicated CPUs in synchronization, and it is technically difficult to increase the speed of the processing device itself. As a means to solve this problem, for example, a method has been proposed in which a fail-safe function is provided by software (see Patent Document 2). In this method, by exchanging input information and processing results of each CPU via a shared memory and comparing them using software, a fail-safe function is realized without assuming completely synchronous operation of each CPU.

Japanese Patent Application Publication No. 7-302207 Japanese Patent Application Publication No. 2003-311498

When configuring a system that safely controls safety devices such as railway signal lights and switching equipment by collating the outputs of redundant CPUs, the redundant CPUs can be connected to multiple output devices via redundant parallel buses. It is possible to connect. However, in this configuration, each output device is connected to each CPU in parallel via a duplex parallel bus, so one output device out of the plurality of output devices is connected to one of the duplex buses. If one bus interface fails, this failure interferes with the signals on the bus interface of the other system, and even interferes with the control of output devices other than the failed output device. In this case, after disconnecting all output devices one by one, check whether the other output devices other than the disconnected output device operate correctly, and all other output devices are now controlled correctly. In this case, it is necessary to determine that the disconnected output device is faulty, and it takes time to identify the faulty output device. Maintenance of devices that control railway signal lights and switches must be carried out at night when trains are not in operation, and there is a problem in that it is necessary to identify malfunctioning output devices in a short period of time.

An object of the present invention is to identify a failed output device among a plurality of output devices that control each of a plurality of control objects according to the logic of two messages containing digital information, without separating each output device.

In order to achieve the above object, the present invention includes a first arithmetic device that generates and outputs a first message including first digital control information, and a second arithmetic message that includes second digital control information. A second arithmetic unit that generates and outputs the first message and the second message are inputted separately and compared, and when a condition is satisfied by this comparison, the first message is generated. and a plurality of message verifiers that separately output the second message, and a first control signal based on the first message outputted from each of the plurality of message verifiers; A second control signal is generated based on the second message outputted from each message collation device, and each of the plurality of control targets is determined according to the AND of the generated first control signal and second control signal. and a multiplexed serial bus that connects each of the plurality of message verifiers and each of the plurality of output devices in series with each other via a multiplexed transmission path. do.

According to the present invention, a failed output device among a plurality of output devices that control each of a plurality of control objects according to the logic of two messages containing digital information can be identified without disconnecting each output device.

Problems, configurations, and effects other than those described above will be made clear by the following description of the mode for carrying out the invention.

1 is a block diagram showing a configuration example of a digital output control system according to a first embodiment of the present invention. FIG. 2 is a block diagram showing a configuration example of a message collation device according to Example 1 of the present invention. It is a block diagram showing an example of composition of a message collation device concerning Example 2 of the present invention.

Hereinafter, embodiments of the invention will be described based on the drawings. Note that when there are multiple components having the same or similar functions, the same reference numerals may be given different subscripts for explanation. Furthermore, if there is no need to distinguish between these multiple components, the subscripts may be omitted from the description.

FIG. 1 is a block diagram showing a configuration example of a digital output control system according to a first embodiment of the present invention. In FIG. 1, a digital output control system 1 includes a digital control device 10, a duplex serial bus 100, and a plurality of output devices 200a, . . . , 200n. The digital control device 10 is connected to each of the plurality of output devices 200a, . . . , 200n via a duplex serial bus 100. Each output device 200 is connected to a control target such as a signal light 300, for example.

The digital control device 10 includes an A-system CPU 11, a B-system CPU 12, a plurality of message verifiers 13a, . . . , 13n, and an OR circuit 14. The A-system CPU 11 and the B-system CPU 12 each function as a fail-safe CPU, and are configured as an arithmetic device or processor that executes arithmetic operations to control the signal light 300, etc., and generates and outputs a message containing digital control information. Ru. For example, the A-system CPU 11 generates a message including digital control information, and outputs the generated message (first message) to each output device 200 via each message verifier 13 and duplex serial bus 100. is configured as an arithmetic unit or a first processor. The B-system CPU 12 generates a message including digital control information, and performs a second calculation to output the generated message (second message) to each output device 200 via each message collation unit 13 and duplex serial bus 100. The processor may be configured as a device or a second processor.

Each message verifier 13 compares the message outputted from the A-system CPU 11 (first message) and the message outputted from the B-system CPU 12 (second message), and when the conditions of the comparison are satisfied, that is, both On the condition that all the messages match, the messages output from the A-system CPU 11 and the messages output from the B-system CPU 12 are output to each output device 200 via the duplex serial bus 100, respectively. In addition, each message verifier 13, when comparing the message outputted by the A-system CPU 11 and the message outputted by the B-system CPU 12, if at least a part of the two messages does not match, each message verifier 13 After a predetermined period of time has elapsed after all of the respective telegrams are stored in 13, a high level signal is output to the OR circuit 14 as a stop logic signal. When the OR circuit 14 receives a stop logic signal from one of the message verifiers 13, it outputs a stop signal 15 to the A-system CPU 11 and the B-system CPU 12, respectively, and stops the operation of the A-system CPU 11 and the B-system CPU 12, respectively. configured as a stop logic circuit. The duplex serial bus 100 is configured as a multiplex serial bus that connects each of the plurality of message verifiers 13 and each of the plurality of output devices 200 in series with each other through multiplexed transmission lines. That is, each message verifier 13 is connected to each output device 200 on a one-to-one basis via the duplex serial bus 100. At this time, the message outputted from the A-system CPU 11 (first message) and the message outputted from the B-system CPU 12 (second message) are divided into two systems and sent to each output device 200 via the redundant serial bus 100. transmitted to.

Each output device 200 is connected one-to-one to each message verifier 13 via a redundant serial bus 100, and is connected to an A-system bus interface (IF) 201, a B-system bus interface (IF) 202, and an A-system output control. 203 , a B-system output control section 204 , an A-system relay 205 , a B-system relay 206 , and a battery 207 . A signal light 300 is connected to one end of each relay 205, 206, and a battery 207 is connected to the other end of each relay 205, 206. The A-system bus interface (IF) 201 receives a message output from the A-system CPU 11 via the duplex serial bus 100 and outputs the input message to the output control unit 203 . The B-system bus interface (IF) 202 receives the message output from the B-system CPU 12 via the duplex serial bus 100 and outputs the input message to the output control unit 204 . The output control unit 203 discriminates the message output from the A-system CPU 11, generates a control signal (first control signal) according to the discrimination result, and controls the relay 205 to turn on or off based on the generated control signal. do. The output control 204 determines the message output from the B-system CPU 12, generates a control signal (second control signal) according to the determination result, and controls the relay 206 to turn on or off based on the generated control signal. .

At this time, if the contents of the A-system message and the B-system message are information for turning on the signal light 300, and the contents of the A-system message and the B-system message all match, the output control unit 203 The output control unit 204 simultaneously outputs control signals (on signals) for turning on the respective relays 205 and 206. When each relay 205, 206 is turned on by the on signal, the signal lamp 300 lights up. On the other hand, when an off signal is output from output control section 203 or output control section 204, relay 205 or relay 206 is turned off by the off signal, and signal lamp 300 is turned off. The output control unit 203 and the output control unit 204 can control the signal lamp 300 according to the AND of each control signal.

FIG. 2 is a block diagram showing a configuration example of a message collation device according to the first embodiment of the present invention. In FIG. 2, the message verifier 13 includes an A-system watchdog timer 20, a B-system watchdog timer 21, an A-system n-bit shift register 22, a B-system n-bit shift register 23, and an A-system shift clock oscillator 24. , a B-system shift clock oscillator 25 , an OR circuit 26 , an OR circuit 27 , and a comparator 28 .

The A-system watchdog timer 20 and the B-system watchdog timer 21 monitor the outputs of the A-system shift clock oscillator 24 and the B-system shift clock oscillator 25, respectively, and receive clocks from the A-system shift clock oscillator 24 and the B-system shift clock oscillator 25, respectively. If the signal is not output for a certain period of time or more, a high level signal is output to the OR circuit 14. That is, the A-system watchdog timer 20 and the B-system watchdog timer 21 measure time from when the A-system shift clock oscillator 24 and the B-system shift clock oscillator 25 stop oscillating, and the measured time becomes the set time. It is configured as a timer that outputs a high level signal (stop logic signal) to the OR circuit 14 when it exceeds the threshold.

The A-system n-bit shift register 22 inputs an A-system telegram containing n-bit digital data D1 to Dn as an A-system input signal 40, and the B-system n-bit shift register 23 receives as a B-system input signal 41, A B-system message containing n-bit digital data D1 to Dn is input. The A-system shift clock oscillator 24 oscillates when an oscillation condition (first oscillation condition) is satisfied, and outputs the A-system shift clock signal 42 to the A-system n-bit shift register 22. The B-system shift clock oscillator 25 oscillates when an oscillation condition (second oscillation condition) is satisfied, and outputs a B-system shift clock signal 43 to the B-system n-bit shift register 23.

When the A-system n-bit shift register 22 receives an A-system telegram containing n-bit digital data D1 to Dn, the A-system n-bit shift register 22 converts the input telegram into 1 in response to the shift clock signal 42 from the A-system shift clock oscillator 24. Shift bit by bit. When the B-system n-bit shift register 23 receives a B-system message including n-bit digital data D1 to Dn, the B-system n-bit shift register 23 converts the input message into 1 in response to the shift clock signal 43 from the B-system shift clock oscillator 25. Shift bit by bit.

At this time, in the process of shifting the data of each message 1 bit at a time, the comparator 28 shifts the message input to the A-system n-bit shift register 22 and the message input to the B-system n-bit shift register 23 by 1 bit. If all the contents of the n-bit message match, a high-level signal is output to one input terminal of the OR circuits 26 and 27 as a comparison result signal, and the n-bit message is If all the contents of the two do not match, a low level signal is outputted to one input terminal of the OR circuits 26 and 27 as a comparison result signal.

At this time, the A-system n-bit shift register 22 and the B-system n-bit shift register 23 use the OR circuit 26, which uses a low level signal as a logic signal indicating the storage state of each message, until all the messages are stored. 27 (input terminal of negative logic), and when all the messages are stored, a high level signal is sent to the OR circuits 26 and 27 as a logic signal indicating the storage state of each message. Output to the other input terminal (Negation logic input terminal).

The OR circuit 26 is configured as a first logic circuit that inputs a first logic signal indicating the storage state of the first message from the A-system n-bit shift register 22 and also inputs a comparison result signal from the comparator 28. Ru. The OR circuit 27 is configured as a second logic circuit that receives a second logic signal indicating the storage state of the second message from the B-system n-bit shift register 23 and also receives a comparison result signal from the comparator 28. Ru.

The OR circuits 26 and 27 use the high-level signal as an enable signal to operate the A-system shift clock oscillator 24 and the B-system shift clock oscillator 24 and B until all messages are stored in the A-system n-bit shift register 22 and the B-system n-bit shift register 23, respectively. The signals are output to the system shift clock oscillator 25, respectively. The A-system shift clock oscillator 24 to which the enable signal is input sequentially outputs the shift clock signal 42, and the B-system shift clock oscillator 25 to which the enable signal is input sequentially outputs the shift clock signal 43. On the other hand, when all the messages are stored in the A-system n-bit shift register 22 and the B-system n-bit shift register 23, the OR circuits 26 and 27 transmit the low level signal to the A-system shift clock oscillator 24 and the B-system n-bit shift register 23, respectively. It is output to the B-system shift clock oscillator 25. When low-level signals are input to the A-system shift clock oscillator 24 and the B-system shift clock oscillator 25, the A-system shift clock oscillator 24 and the B-system shift clock oscillator 25 each temporarily stop their respective oscillations.

At this time, when all the messages are stored in the A-system n-bit shift register 22 and the B-system n-bit shift register 23, if all the contents of the n-bit messages match in both, the comparator 28 A high level signal is output from the OR circuits 26 and 27 as a comparison result signal (match signal). Therefore, in response to the high-level signal from the comparator 28, the OR circuits 26 and 27 output a high-level signal as an enable signal to the A-system shift clock oscillator 24 and the B-system shift clock oscillator 25. do. As a result, the A-system shift clock oscillator 24 and the B-system shift clock oscillator 25 restart oscillation, respectively, and output shift clock signals 42 and 43.

That is, the A-system shift clock oscillator 24 and the B-system shift clock oscillator 25 operate the A-system n-bit shift register 22 and the B-system n-bit shift register from the time when the first data (D1) or flag pattern of each message is input. The shift clock signals 42 and 43 are output to the A-system n-bit shift register 22 and the B-system n-bit shift register 23, respectively, and while the telegrams are input to the A-system n-bit shift register 22 and the B-system n-bit shift register 23, Shift clock signals 42 and 43 are output to the B-system n-bit shift register 23.

On the other hand, when all the messages are stored in the A-system n-bit shift register 22 and the B-system n-bit shift register 23, respectively, the A-system shift clock oscillator 24 and the B-system shift clock oscillator 25 operate the OR circuits 26 and 27. The oscillation is stopped by a signal (a low-level signal) from , and the output of shift clock signals 42 and 43 to the A-system n-bit shift register 22 and the B-system n-bit shift register 23 is temporarily stopped. After this, the A-system shift clock oscillator 24 and the B-system shift clock oscillator 25 confirm that all the contents of each message stored in the A-system n-bit shift register 22 and the B-system n-bit shift register 23, respectively, match. In this case, the oscillation is restarted by the signals (high level signals) from the OR circuits 26 and 27, and the shift clock signals 42 and 43 are output to the A-system n-bit shift register 22 and the B-system n-bit shift register 23. resume.

As a result, the A-system n-bit shift register 22 outputs the A-system message containing n-bit digital data D1 to Dn as the A-system output signal 44 to the A-system bus interface 201, and the B-system n-bit shift register 23 outputs a B-system message including n-bit digital data D1 to Dn to the B-system bus interface 202 as a B-system output signal 45.

Here, if the bus interface 201 or bus interface 202 belonging to any one of the output devices 200 among the plurality of output devices 200 is out of order, the output control unit 203 or output connected to the failed bus interface 201 or bus interface 202 The control unit 204 turns off the relay 205 or 206 to control the relay 205 or the relay 206 to be on the safe side.

At this time, since each output device 200 is connected one-to-one to each message collation device 13 via the duplex serial bus 100, the bus interface belonging to any one output device 200 among the plurality of output devices 200 201 or the bus interface 202, this failure will not interfere with the control of the output devices 200 other than the failed output device, and only the output of the failed output device 200 will be safely turned off, allowing normal operation. All outputs of the output device 200 are turned on. Therefore, it is possible to easily determine which output device 200 is out of order based on the on state or off state of each output device 200.

Furthermore, since each message verifier 13 is connected one-to-one to each output device 200 via the redundant serial bus 100, each message can be verified even if the A-system CPU 11 and B-system CPU 12 are not synchronized. can do. In other words, even if the input timings of the messages inputted from the A-system CPU 11 and the B-system CPU 12 are different, each message collation device 13 will recognize each input message as long as each message is input within the set time. Can be compared. Further, each message collation unit 13 can output each input message to the output device 200 at the same timing when the contents of the input messages all match. Furthermore, each message collation unit 13 detects when the timings of the messages inputted from the A-system CPU 11 and the B-system CPU 12 are different from each other by more than a set time (when the difference in the input timing of each message is more than the set time), or If the contents of the input messages do not all match, the oscillation of the A-system shift clock oscillator 24 and the B-system shift clock oscillator 25 remains stopped, and the A-system shift clock oscillator 24 and the B-system shift clock oscillator 25 After the oscillation is stopped, when a set time has elapsed, the operations of the A-system CPU 11 and the B-system CPU 12 can be stopped, respectively, via the OR circuit 14.

According to the present embodiment, a failed output device among a plurality of output devices 200 that control each of a plurality of control objects according to the logic of two messages including digital control information is identified without disconnecting each output device 200. be able to. That is, by connecting each output device 200 and each CPU 11, 12 with the duplex serial bus 100, it is possible to easily identify a failed output device among the plurality of output devices 200 without disconnecting each output device 200. . Furthermore, according to this embodiment, since the messages generated by each CPU 11 and 12 are transmitted to each output device 200 via the duplex serial bus 100, the messages generated by each CPU 11 and 12 are collated at different timings. Even if the messages are input to the device 13, each message can be output to each output device 200 at the same timing. Therefore, the messages generated by each CPU 11, 12 can be verified by each message verifier 13 without completely synchronizing the two CPUs 11, 12. Further, even if a specific output device 200 fails, the operation of other output devices 200 is not affected, so it becomes easy to identify the failure part. Furthermore, even if the two CPUs 11 and 12 operate asynchronously, high-speed operation can be achieved by implementing the message collation unit 13 that autonomously synchronizes and performs comparison with a simple configuration.

In this embodiment, a device that verifies the match between digital data belonging to a specific range among the digital data belonging to each message is used as each message verifier, and the other configuration is the same as in the first embodiment. be.

FIG. 3 is a block diagram showing an example of the configuration of a message verifier according to a second embodiment of the present invention. In FIG. 3, the message verifier 13 includes an A-system watchdog timer 20, a B-system watchdog timer 21, an A-system n-bit shift register 22, a B-system n-bit shift register 23, and an A-system shift clock oscillator 24. , a B-system shift clock oscillator 25, an OR circuit 26, an OR circuit 27, and a comparator 28. Furthermore, as elements added to the first embodiment, an AND circuit 29, an AND circuit 30, and an A-system It includes an n-clock width pulse generator 31 and a B-system n-clock width pulse generator 32.

The comparator 28 differs in its function from that in the first embodiment, in that among the digital data D1 to Dn of each message, all digital data belonging to a specific range, for example, digital data D4 to D(n-1), match. The comparison result is output to the AND circuit 31 and the AND circuit 32. For example, the comparator 28 outputs a high-level signal to the AND circuit 29 and the AND circuit 30 when all the digital data D4 to D(n-1) match, and otherwise outputs a low-level signal to the AND circuit 29 and the AND circuit 30. The signal is output to AND circuit 29 and AND circuit 30. Note that the same components as in the first embodiment have the same functions as in the first embodiment.

The AND circuit 29 operates only when a high-level signal is output from the A-system n-bit shift register 22 in which all the messages (first message) are stored, and when a high-level signal is output from the comparator 28. , configured as a third logic circuit that outputs a high-level signal to the A-system n-clock width pulse generator 31, and otherwise outputs a low-level signal to the A-system n-clock width pulse generator 31. be done.

The A-system n-clock width pulse generator 31 outputs an n-clock width pulse signal (high-level pulse signal) to the OR circuit 26 in response to the high-level signal output from the AND circuit 29 . The OR circuit 26 outputs an n-clock width enable signal to the A-system shift clock oscillator 24 in response to the n-clock width pulse signal. The A-system shift clock oscillator 24 oscillates in response to an n-clock width enable signal, and outputs an n-bit A-system shift clock signal 42 to the A-system n-bit shift register 22. In addition, the OR circuit 26 outputs a high-level signal as an enable signal to the A-system shift clock oscillator 24 until all the messages are stored in the A-system n-bit shift register 22. When all the messages are stored, a low level signal is output to the A-system shift clock oscillator 24.

The AND circuit 30 operates only when a high-level signal is output from the B-system n-bit shift register 23 in which all the messages (second message) are stored, and a high-level signal is output from the comparator 28. , configured as a fourth logic circuit that outputs a high-level signal to the B-system n-clock width pulse generator 32, and otherwise outputs a low-level signal to the B-system n-clock width pulse generator 32. be done.

The B-system n-clock width pulse generator 32 outputs an n-clock width pulse signal (high-level pulse signal) to the OR circuit 27 in response to the high-level signal output from the AND circuit 30 . The OR circuit 27 outputs an n-clock width enable signal to the B-system shift clock oscillator 25 in response to the n-clock width pulse signal. The B-system shift clock oscillator 25 oscillates in response to an n-clock width enable signal, and outputs an n-bit B-system shift clock signal 43 to the B-system n-bit shift register 23 . The OR circuit 27 also outputs a high-level signal as an enable signal to the B-system shift clock oscillator 25 until all the messages are stored in the B-system n-bit shift register 23. When all the messages have been stored, a low level signal is output to the B-system shift clock oscillator 25.

That is, the A-system shift clock oscillator 24 and the B-system shift clock oscillator 25 operate the A-system n-bit shift register 22 and the B-system n-bit shift register from the time when the first data (D1) or flag pattern of each message is input. The shift clock signals 42 and 43 are output to the A-system n-bit shift register 22 and the B-system n-bit shift register 23, respectively, and while the telegrams are input to the A-system n-bit shift register 22 and the B-system n-bit shift register 23, and B-system n-bit shift register 23, shift clock signals 42 and 43 are output, respectively.

On the other hand, when all the messages are stored in the A-system n-bit shift register 22 and the B-system n-bit shift register 23, respectively, the A-system shift clock oscillator 24 and the B-system shift clock oscillator 25 operate the OR circuits 26 and 27. The oscillation is stopped by a signal (a low-level signal) from , and the output of shift clock signals 42 and 43 to the A-system n-bit shift register 22 and the B-system n-bit shift register 23, respectively, is temporarily stopped. Thereafter, the A-system shift clock oscillator 24 and the B-system shift clock oscillator 25 select a specific range of data from among the data of each message stored in the A-system n-bit shift register 22 and the B-system n-bit shift register 23, respectively. For example, when all digital data D4 to D(n-1) match, the oscillation is restarted by the signals from the OR circuits 26 and 27 (pulse signal with n clock width), and the n-bit shift of the A system is performed. The output of shift clock signals 42 and 43 is restarted to the register 22 and the B-system n-bit shift register 23, respectively.

As a result, the A-system n-bit shift register 22 performs the following operations when all the digital data D4 to D(n-1) in a specific range match among the A-system telegrams containing n-bit digital data D1 to Dn. As the A-system output signal 44, an A-system message containing n-bit digital data D1 to Dn is output to the A-system bus interface 201. The B-system n-bit shift register 23 outputs the B-system output when all digital data D4 to D(n-1) in a specific range match among the B-system telegrams containing n-bit digital data D1 to Dn. As a signal 45, a B-system message containing n-bit digital data D1 to Dn is output to the B-system bus interface 202.

Here, if the bus interface 201 or bus interface 202 belonging to any one of the plurality of output devices 200 fails, the output control unit 203 or The output control unit 204 turns off the relay 205 or 206 to control the relay 205 or the relay 206 to the safe side.

At this time, since each output device 200 is connected one-to-one to each message collation device 13 via the duplex serial bus 100, the bus belonging to any one output device 200 among the plurality of output devices 200 Even if the interface 201 or the bus interface 202 fails, this failure will not interfere with the control of the output devices 300 other than the failed output device, and only the output of the failed output device 200 will be safely turned off and normal operation will occur. All outputs of the output devices 200 are turned on. Therefore, it is possible to easily determine which output device 200 is out of order based on the on/off state of the output device 200.

Furthermore, since each message verifier 13 is connected one-to-one to each output device 200 via the redundant serial bus 100, each message can be verified even if the A-system CPU 11 and B-system CPU 12 are not synchronized. can do. In other words, even if the input timings of the messages inputted from the A-system CPU 11 and the B-system CPU 12 are different, each message collation device 13 will recognize each input message as long as each message is input within the set time. Can be compared. Moreover, each message collation machine 13 can output each input message to the output device 200 at the same timing when all the contents of data in a specific range among the input messages match. Furthermore, each message collation unit 13 detects when the timings of the messages inputted from the A-system CPU 11 and the B-system CPU 12 are different from each other by more than a set time (when the difference in the input timing of each message is more than the set time), or If the contents of the data in a specific range of each input message do not all match, the oscillations of the A-system shift clock oscillator 24 and the B-system shift clock oscillator 25 remain stopped, and the A-system shift clock oscillator 24 When a set time has elapsed after the oscillation of the B-system shift clock oscillator 25 is stopped, the operations of the A-system CPU 11 and the B-system CPU 12 can be respectively stopped via the OR circuit 14.

According to this embodiment, the same effects as in the first embodiment can be achieved. Further, according to the present embodiment, each message collation device 13 outputs each input message to the output device 200 at the same timing when all data contents in a specific range among the input messages match. It can be output. Furthermore, according to this embodiment, if the contents of data in a specific range of each input message do not all match, the oscillations of the A-system shift clock oscillator 24 and the B-system shift clock oscillator 25 are stopped. After the oscillation of the A-system shift clock oscillator 24 and the B-system shift clock oscillator 25 is stopped, the operation of the A-system CPU 11 and the B-system CPU 12 is stopped via the OR circuit 14 when the set time has elapsed. can be done.

Note that the present invention is not limited to the embodiments described above, and includes various modifications and equivalent configurations within the scope of the appended claims. For example, the embodiments described above have been described in detail to explain the present invention in an easy-to-understand manner, and the present invention is not necessarily limited to having all the configurations described.

In addition, each of the above-mentioned configurations, functions, etc. may be realized in part or in whole by hardware, for example by designing an integrated circuit, and a processor interprets and executes a program to realize each function. It may also be realized by software.

Information such as programs, tables, files, etc. that realize each function is stored in storage devices such as memory, hard disk, SSD (Solid State Drive), IC (Integrated Circuit) card, SD (Secure Digital) card, DVD (Digital Versatile), etc. (Disc) recording medium.

1 Digital output control system, 10 Digital control device, 11 A-system CPU, 12 B-system CPU, 13, 13a, ..., 13n Message verifier, 14 OR circuit, 20 A-system watchdog timer, 21 B-system watchdog Timer, 22 A-system n-bit shift register, 23 B-system n-bit shift register, 24 A-system shift clock oscillator, 25 B-system shift clock oscillator, 26, 27 OR circuit, 28 Comparator, 29, 30 AND circuit, 31 A System n-clock width pulse generator, 32 B-system n-clock width pulse generator, 200, 200a, ..., 200n Output device, 201 A-system bus IF, 202 B-system bus IF, 203, 204 Output control section, 300 signal light

Claims (7)

a first arithmetic device that generates and outputs a first message including first digital control information;
a second arithmetic device that generates and outputs a second message including second digital control information;
Inputting the first message and the second message separately, comparing the two, and outputting the first message and the second message separately when a condition based on the comparison is satisfied. multiple message verifiers,
A first control signal is generated based on the first message outputted from each of the plurality of message verifiers, and a second control signal is generated based on the second message outputted from each of the plurality of message verifiers. a plurality of output devices that generate control signals and control each of the plurality of control objects according to the logical product of the generated first control signal and the second control signal;
A digital output control system comprising: a multiplexed serial bus that connects each of the plurality of message verifiers and each of the plurality of output devices in series via a multiplexed transmission path. The digital output control system according to claim 1,
Each of the plurality of message verifiers is
a first shift clock oscillator that oscillates and outputs a first shift clock signal when a first oscillation condition is met;
a second shift clock oscillator that oscillates and outputs a second shift clock signal when a second oscillation condition is satisfied;
a first shift register that sequentially inputs and stores the first telegram in response to the first shift clock signal;
a second shift register that sequentially inputs and stores the second telegram in response to the second shift clock signal;
The first message stored in the first shift register and the second message stored in the second shift register are sequentially compared, and a comparison result signal from this comparison is sent to the first shift clock. an oscillator and a comparator outputting to the second shift clock oscillator;
A first logic signal indicating a storage state of the first message stored in the first shift register is input from the first shift register, and the comparison result signal is input from the comparator. a logic circuit,
A second logic signal indicating a storage state of the second message stored in the second shift register is input from the second shift register, and the comparison result signal is input from the comparator. A digital output control system comprising: a logic circuit; The digital output control system according to claim 2,
The first logic circuit is
When the logic of the first logic signal indicates that the first message has been input to the first shift register, a first enable signal for establishing the first oscillation condition is transmitted to the first shift register. the first enable signal for the first shift clock oscillator when the logic of the first logic signal indicates that all the first telegrams have been stored; After that, the logic of the comparison result signal changes between the contents of the first message stored in the first shift register and the second message stored in the second shift register. If the contents indicate that all the contents match, outputting the first enable signal to the first shift clock oscillator to restart oscillation by the first shift clock oscillator;
The second logic circuit is
When the logic of the second logic signal indicates that the second message has been input to the second shift register, a second enable signal for establishing the second oscillation condition is sent to the second shift register. the second enable signal for the second shift clock oscillator when the logic of the second logic signal indicates that the second telegram has all been stored; After that, the logic of the comparison result signal changes between the contents of the first message stored in the first shift register and the second message stored in the second shift register. The digital output is characterized in that when the contents indicate that all the contents match, the second enable signal is outputted to the second shift clock oscillator to restart oscillation by the second shift clock oscillator. control system. The digital output control system according to claim 1,
Each of the plurality of message verifiers is
a first shift clock oscillator that oscillates and outputs a first shift clock signal when a first oscillation condition is met;
a second shift clock oscillator that oscillates and outputs a second shift clock signal when a second oscillation condition is satisfied;
a first shift register that sequentially inputs and stores the first telegram in response to the first shift clock signal;
a second shift register that sequentially inputs and stores the second telegram in response to the second shift clock signal;
A first message in a specific range among the first messages stored in the first shift register and a second message in a specific range among the second messages stored in the second shift register. a comparator that sequentially compares the messages and outputs a comparison result signal from the comparison;
a first pulse generator that generates and outputs a first pulse signal when a first pulse generation condition is met;
a second pulse generator that generates and outputs a second pulse signal when a second pulse generation condition is met;
A first logic signal indicating the storage state of the first message stored in the first shift register is input from the first shift register, and the first pulse is input from the first pulse generator. a first logic circuit that inputs a signal;
A second logic signal indicating the storage state of the second telegram stored in the second shift register is input from the second shift register, and the second pulse is input from the second pulse generator. a second logic circuit that inputs the signal;
The first logic signal is input from the first shift register, and the comparison result signal is input from the comparator, and the logical product of the input first logic signal and the comparison result signal is performed. a third logic circuit that outputs a third logic signal to the first pulse generator;
The second logic signal is input from the second shift register, and the comparison result signal is input from the comparator, and the logical product of the input second logic signal and the comparison result signal is performed. a fourth logic circuit that outputs a fourth logic signal to the second pulse generator. The digital output control system according to claim 4,
The first pulse generator is:
outputting the first pulse signal to the first logic circuit when the logic of the third logic signal output from the third logic circuit satisfies the first pulse generation condition;
The second pulse generator is
outputting the second pulse signal to the second logic circuit when the logic of the fourth logic signal output from the fourth logic circuit satisfies the second pulse generation condition;
The first logic circuit is
When the logic of the first logic signal indicates that the first message has been input to the first shift register, a first enable signal for establishing the first oscillation condition is transmitted to the first shift register. the first enable signal for the first shift clock oscillator when the logic of the first logic signal indicates that all the first telegrams have been stored; After that, the logic of the first pulse signal matches the content of the specific range of the first message stored in the first shift register and the content stored in the second shift register. If the contents of the specified range of the second telegrams are all consistent, the first enable signal is output to the first shift clock oscillator, and the first shift clock oscillator outputs the first enable signal. restarts oscillation by the shift clock oscillator of
The second logic circuit is
When the logic of the second logic signal indicates that the second message has been input to the second shift register, a second enable signal for establishing the second oscillation condition is sent to the second shift register. the second enable signal for the second shift clock oscillator when the logic of the second logic signal indicates that the second telegram has all been stored; After that, the logic of the second pulse signal matches the content of the specific range of the first message stored in the first shift register and the content stored in the second shift register. If the contents of the specified range of the second telegrams are all consistent, the second enable signal is output to the second shift clock oscillator, and the second shift clock oscillator outputs the second enable signal to the second shift clock oscillator. A digital output control system characterized by restarting oscillation by a shift clock oscillator. The digital output control system according to claim 3 or 5,
The first shift register is
When the first shift clock oscillator resumes oscillation, outputting the first telegram stored in the first shift register to the multiplexed serial bus;
The second shift register is
A digital output control system characterized in that when the second shift clock oscillator resumes oscillation, the second telegram stored in the second shift register is output to the multiplexed serial bus. The digital output control system according to claim 3 or 5,
The digital output control system includes:
further comprising a stop logic circuit connected to the first arithmetic device and the second arithmetic device, respectively,
Each of the plurality of message verifiers is
The first shift clock oscillator measures time from when it stops oscillating, and outputs a first stop logic signal to the stop logic circuit when the measured time exceeds a first set time. a first timer to
The second shift clock oscillator measures time from when it stops oscillating, and outputs a second stop logic signal to the stop logic circuit when the measured time exceeds a second set time. further comprising a second timer for
The stop logic circuit is
In response to the first stop logic signal or the second stop logic signal, the first arithmetic device outputs the first message and the second arithmetic device outputs the second message. A digital output control system characterized by stopping.

Images