JP3529994B2 - Verification circuit - Google Patents

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a collating circuit for comparing and collating the respective arithmetic results of two arithmetic means operating in synchronization with each other to confirm the operation of a microcomputer.

[0002]

2. Description of the Related Art Conventionally, microcomputers used in various signal processing devices are composed of a plurality of arithmetic units (MPUs).
(Nit) is used to perform the same processing, and each calculation result is compared and collated to ensure high reliability. Such a microcomputer is generally called a fail-safe microcomputer. For example, 2 MPUs
Is performed in a macro-synchronous operation (each MPU performs processing such as input, calculation, storage, and output in synchronization with a similar program), and the processing results of each MPU are compared and collated at regular intervals.

The structure of a conventional matching circuit in the above microcomputer is, for example, as shown in FIG.
It consists of two MPUs of the system and a general-purpose comparison circuit. However, FIG. 5 shows specific functional blocks of the U-system MPU, and the V-system functional blocks similar to this U-system are omitted. According to the circuit configuration of FIG. 5, the MPU of each system
Is synchronized by alternately outputting interrupt signals using an internal timer, and operates with a phase difference of ΔT / 2 (180 °), where ΔT is the period of each interrupt signal. As shown in FIG. 6, in the U system, for example, when an internal interrupt signal is generated, the interrupt process Ua is executed, and when an external interrupt signal from the V system is input, the interrupt process Ub is executed. .
In the interrupt processing Ua, output data (for example, data Au) to be sent to the comparison circuit is selected, and data Au is output to the comparison circuit until the next internal interrupt signal is generated (time ΔT). In the interrupt processing Ub, the input timing of the external interrupt signal is compared with the count value of the own system timer to check whether the own system timer is operating normally.
Further, with respect to the V system, the same processing as described above is performed with a delay of ΔT / 2 from the U system. As a result, the output data from each system is input to the comparison circuit at the timing as shown in FIG. 7, and the comparison circuit outputs, for example, a logical value 1 when the data of each system match as the comparison result. It outputs the logical value 0 when they do not match.

Therefore, when the MPUs of both systems are operating normally, the comparison circuit generates an alternating signal. The output of this comparison result is sent to the outside and taken into the MPU of each system for checking. When an abnormality of the comparison circuit is detected by checking the comparison result in each MPU, each MPU stops the operation of its own system. The alternating signal output from the comparison circuit to the outside is used, for example, to drive a relay via an alternating signal amplifier circuit and a rectifier circuit used as a fail-safe output circuit of signal equipment. In this case, when the microcomputer operates normally and an alternating signal is generated, the relay operates, and when the alternating signal is interrupted, the relay is restored to control the system on the safe side.

[0005]

However, in the above-mentioned conventional circuit configuration, the U system and the V system are mutually ΔT /
There is a problem that separate software is required to generate an interrupt signal having a phase difference of 2 and the development cost becomes huge. In addition to the two MPUs, a large-scale comparison circuit that compares a large number of bit widths (data width of data to be compared) has been required. Moreover, in order to check the normal operation of the comparison circuit, the comparison result must be returned to the MPU to perform the operation determination process.

Further, when the output data sent from each system to the comparison circuit have the same value continuously, an error occurs because the comparison results in continuous coincidence. Therefore, there is also a problem that the output data to the comparison circuit must be constantly changed. The present invention has been made by paying attention to the above points, and an MPU of each system is operated by the same software, and a collation circuit capable of ensuring high reliability by outputting data that can be easily compared and collated is provided. The purpose is to provide.

[0007]

Therefore, according to the invention described in claim 1 of the present invention, there are provided two clocks which individually carry out a timing operation, synchronously execute the same processing, and output the processed data respectively. In a collating circuit including a computing means and a comparing means for confirming the operation by comparing and collating the processing data of each computing means, each computing means is cycled at a predetermined time interval based on each timing operation. Synchronization based on an interrupt signal generator that generates first and second interrupt signals, a first interrupt signal generated by one arithmetic means, and a second interrupt signal generated by the other arithmetic means. And a synchronization adjustment unit that, when the first interrupt signal is generated, outputs the comparison data selected from its own processing data as transmission data to the counterpart computing means and holds the comparison data as its own comparison reference data, 20% When signal generator, said transmission data is bit-inverted output to calculation means of the other party, the second
A data control unit that bit-inverts the held comparison and comparison data when a predetermined time has elapsed after the generation of the interrupt signal, and a calculation of the other side when the first interrupt signal is generated and when the second interrupt signal is generated. A data comparing section for comparing whether or not the transmission data from the means and its own comparison and comparison data match, and outputting the comparison result to the comparing means; and when a predetermined time has elapsed after the second interrupt signal is generated. And a comparison unit that compares the transmission data from the calculation unit of the other party with the comparison data of its own, and if there is a mismatch, it detects an abnormality in itself and stops the operation, and the comparison unit is provided. A signal indicating a normal operation is output only when the comparison result output from the data comparison unit of each of the arithmetic units matches.

According to this structure, the interrupt signal generators of the respective arithmetic means generate the first and second interrupt signals having the same period and the phases shifted from each other, and the first and second interrupts generated by the different arithmetic means. The synchronization adjustment units synchronize with each other based on the signals, so that the arithmetic units operate with the same software to execute the same processing. In each calculation means,
First, when the first interrupt signal is generated, the data control section selects comparison data from its own processing data, and this comparison data is sent as transmission data to the counterpart computing means and at the same time as its own comparison reference data. Retained. Then, each data comparison unit compares the transmission data from the other party with its own comparison and comparison data, and outputs the result to the comparison means. At the time of normal operation, the comparison result indicating the coincidence of each data is sent from each arithmetic means to the comparison means, and the comparison means outputs a signal indicating the normal operation. Next, when the second interrupt signal is generated, each data control unit bit-inverts the transmission data and outputs the bit-inverted data to the calculation means of the other party. At this time, the comparison and comparison data retains the state before the second interrupt signal is generated until a predetermined time elapses after the second interrupt signal is generated, and bit-inverted data after the predetermined time elapses. Becomes Therefore, in the case of normal operation, when the second interrupt signal is generated, the transmission data from the other party and the comparison and comparison data of itself do not match, and the comparison result indicating this is sent from each arithmetic means to the comparison means, and the comparison means. Outputs a signal indicating normal operation. After a lapse of a predetermined time after the generation of the second interrupt signal, the transmission data and the comparison and reference data match. At this time, if the comparison results do not match, the abnormality detection unit determines its own abnormality occurrence and stops its operation.

According to a second aspect of the present invention, in the first aspect of the present invention, the data comparison unit indicates a logical value 1 when the transmission data and the comparison reference data match, and when they do not match. It is assumed that a 1-bit signal having a logical value of 0 is output as the comparison result. According to such a configuration, the comparison means can judge whether the 1-bit signal indicating the comparison result in each calculation means is coincident or non-coincident.

[0010]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a block diagram showing the configuration of the matching circuit of this embodiment. In FIG. 1, this circuit is
U as two arithmetic means for generating interrupt signals and operating in synchronization with each other, exchanging data and executing comparison processing.
The system MPU1 and the V system MPU2, and a comparison circuit 3 as a comparison means for comparing the comparison result outputs from the MPUs 1 and 2 of each system.

The U and V system MPUs 1 and 2 generate ΔT interrupt signals and ΔT / 2 interrupt signals, which are the first and second interrupt signals, in accordance with the counter values of the internal timers, respectively. Terminals 1a and 2a that output interrupt signals to the outside, terminals 1b and 2b that output ΔT interrupt signals to the outside, terminals 1c and 2c that input ΔT / 2 interrupt signals from the outside, and ΔT interrupt from the outside It has terminals 1d and 2d for inputting signals. Here, the U system ΔT interrupt signal output terminal 1b is connected to the U and V system ΔT interrupt signal input terminals 1d, 2
connected to d, the V system ΔT / 2 interrupt signal output terminal 2a is U,
Connected to each ΔT / 2 interrupt signal input terminal 1c, 2c of V system, U
The ΔT / 2 interrupt signal output terminal 1a of the system and the ΔT interrupt signal output terminal 2b of the V system are disconnected. In addition, each MPU1, 2
Has data output terminals 1e, 2e for outputting comparison data to another system and data input terminals 1f, 2f for inputting data from another system, as will be described later. And are connected. Furthermore, each MPU1,
2 is a comparison result output terminal 1 for outputting the data comparison result
g and 2g respectively.

The comparison circuit 3 includes a U system MPU 1 and a V system MP.
Each comparison result output of U2 is input, and an alternating signal is output depending on whether or not the comparison result outputs match each other. next,
The operation of this embodiment will be described. FIG. 2 is a diagram showing a flow of processing in the matching circuit. However, FIG. 2 shows specific functional blocks of the U-system MPU 1, and each processing is executed in the direction of the arrow.
The V system MPU 2 is the same as the U system, and is omitted. Further, FIG. 3 is a diagram showing changes in respective data of the U and V system MPUs 1 and 2.

In the figure, U and V system MPUs 1 and 2 each use an internal timer, and when the counter value of the timer becomes a value corresponding to the time ΔT, ΔT / 2, a ΔT interrupt signal and ΔT / 2. Output an interrupt signal (S1, S2, S2 'in Fig. 2). The ΔT interrupt signal output terminal 1b of the U system MPU1 outputs the ΔT interrupt signal input terminal 1b of both systems.
The ΔT / 2 interrupt signal sent to d, 2d and output from the ΔT / 2 interrupt signal output terminal 2a of the V system MPU2 is the ΔT / 2 interrupt signal of both systems.
It is sent to T / 2 interrupt signal input terminals 1c and 2c. In addition, U system M
The ΔT / 2 interrupt signal of PU1 and the ΔT interrupt signal of V system MPU2 are not used. Here, ΔT interrupt signal is U system MP
It is assumed that it is generated in U1 and the ΔT / 2 interrupt signal is generated in V system MPU2.

First, when a ΔT interrupt signal is generated (S2),
At each MPU 1 and 2, ΔT interrupt processing Fa is executed. In this ΔT interrupt processing Fa, it is first checked whether or not the input timing of the ΔT interrupt signal matches the time ΔT counted by the internal timer (S3, S4). That is, in the U system, the internal timer self-checks with the ΔT interrupt signal generated in the U system, and in the V system, the ΔT generated in the U system.
The operation of the internal timer of its own system is monitored using the interrupt signal. If the input timing of ΔT interrupt signal does not match,
The failure of the internal timer is judged and the operation of the MPU is stopped (S5). On the other hand, if the input timings of the ΔT interrupt signals match, the counter value of the internal timer is cleared (S6).

When the normal operation of the internal timer of each system is confirmed by the above processing, the MPUs 1 and 2 generate comparison data (S7). This comparison data is, for example, one of the data such as the flow number, the processing result, the content of the main memory, the failure diagnosis result, etc. in which the failure of the MPU is easily reflected.
The same data is selected until the next ΔT interrupt signal occurs. Here, as shown in FIG. 3, after the comparison data A is selected, the comparison data B,
It is assumed that C, ... Are sequentially selected.

Considering, for example, the U system, the comparison data A is temporarily stored in the U system, and the stored data is output from the data output terminal 1e as the output data A _UP (S
8), sent to the V-system data input terminal 2f and becomes the V-system input data A _UP . The output data A _VP from the V system is input to the data input terminal 1f and becomes the input data A _{VP of the} U system. Here, the data transmitted by the ΔT interrupt processing Fa is referred to as positive data, and is shown by A _UP , A _{VP and the} like shown in white in FIG. 3, and transmitted by the ΔT / 2 interrupt processing Fb described later. It is to be distinguished from the bit-inverted data (referred to as negative data, which are shown by AUN, AVN, etc. written in black in FIG. 3). The stored data in the U system is used as the comparison reference data A _UP without being bit-inverted here, and is compared with the input data A _VP from the V system (S10).

FIG. 4 (a) is a conceptual diagram summarizing the state of data during the ΔT interrupt processing. In the normal operation shown in the figure, the comparison data A _UP of the U system matches the input data A _VP, and the comparison result output indicating the comparison result is output from the comparison result output terminal 1g to the comparison circuit 3 (S11 ). This comparison result output has a logical value of 1 when the comparison results match and a logical value of 0 when the comparison results do not match,
The state immediately after the generation of the interrupt signal shall be maintained until the next generation of the interrupt signal. Further, in the V system, the same processing as described above is performed, and the comparison result output of the V system is output from the comparison result output terminal 1g to the comparison circuit 3.

Then, the comparison circuit 3 compares the comparison result outputs from the U and V systems to determine whether they match each other. When the comparison result outputs match, the comparison result output is output to the outside, and when the comparison result outputs do not match, the comparison result output is cut off to the outside. Note that once the output to the outside is cut off, the comparison circuit 3 continues to cut off the output even if the comparison result outputs match thereafter.

When the ΔT interrupt processing Fa is completed by the above operation and the ΔT / 2 interrupt signal is generated next (S2 ′), ΔT / 2
Interrupt processing Fb is performed. In the ΔT / 2 interrupt processing Fb, first, it is checked whether the input timing of the ΔT / 2 interrupt signal substantially matches the time ΔT / 2 counted by the internal timer (S3 ′, S4 ′). Here, the operation of the internal timer of the U system is monitored using the ΔT / 2 interrupt signal from the V system, and the internal timer self-check is performed in the V system. If the input timings of the ΔT / 2 interrupt signals do not match, it is judged that the internal timer has failed and the operation of the MPU is stopped (S5). If the input timings match, the process proceeds to the next data comparison process.

Considering, for example, the U system, the comparison data A selected in the ΔT interrupt processing Fa is maintained also in the ΔT / 2 interrupt processing Fb. On the other hand, regarding the output data, the storage data in the U system is bit-inverted to become the above-mentioned negative data AUN, and this inverted storage data is output as the output data AUN from the data output terminal 1e (S8), and the V system It is sent to the data input terminal 2f and becomes V-system input data AUN. At this time, the negative output data AVN from the V system is input to the data input terminal 1f and becomes the U system input data AVN.

Further, during a certain time after the ΔT / 2 interrupt signal is generated (a time shorter than the time until the next interrupt signal is generated, a time set in advance by software), The process of using the stored data in the U system as comparison and comparison data is interrupted. That is, the comparison and comparison data during this period is the same positive data A _UP as in the ΔT interrupt processing. Then, the comparison data A _UP and the input data A from the V system
Comparison with VN is performed (S10).

FIG. 4 (b) shows a conceptual diagram summarizing the state of each data at this time. During normal operation shown in the figure,
Since the comparison data A _UP of the U system and the input data A VN do not match, the comparison result output of the logical value 0 indicating the comparison result is output from the comparison result output terminal 1g to the comparison circuit 3.
On the other hand, for example, when there is a fixed failure in the transmission line between the U and V systems and abnormal operation occurs, the input data remains as positive data, so the comparison results match and the logical value The comparison result output of 1 is output to the comparison circuit 3. If the state of the comparison result output is determined immediately after the ΔT / 2 interrupt signal is generated, the same state is maintained until the next ΔT interrupt signal is generated. Further, in the V system, the same processing as described above is performed, and the comparison result output is output to the comparison circuit 3. Then, in the comparison circuit 3, it is judged whether or not the comparison result outputs from the respective systems match, and when they match, the comparison result output (logical value 0) is output to the outside, and when they do not match. Output to the outside is cut off.

Next, when a certain period of time has elapsed after the above ΔT / 2 interrupt signal was generated, the bit-inverted storage data is used as comparison control data, that is, the comparison control data becomes negative data AUN. . At this time, the transmission of the output data AUN to the other system is interrupted, and the input data of each system is maintained in the state before the interruption (negative). FIG. 4 (c) shows a conceptual diagram summarizing the state of each data at this time. Then, a negative data check is performed to compare the maintained input data with the comparative control data (S12 in FIG. 2).

The negative data check is performed to check whether a fixed failure or the like has occurred in the data transmission path in the own system. That is, when the fixed failure or the like occurs, the comparison reference data remains positive, so the comparison result with the input data becomes inconsistent, while when operating normally, each data becomes negative and the comparison result Match. Therefore, when the comparison results match, the processing of the own system is continued, and when they do not match, the processing of the own system thereafter is stopped (S13). When the processing of one system is stopped, the input data does not change in the subsequent processing in the other system as well, so that the failure of the other system is detected.

When the ΔT / 2 interrupt process Fb is completed by the above process and the next ΔT interrupt signal is generated, the above-mentioned ΔT interrupt process Fa is repeated, and the comparison process for the comparison data B, C, ... Are sequentially performed. Therefore, in the present embodiment, in the U-system MPU1, S1, S2, S2 'of FIG. 2 function as an interrupt signal generation unit, S3 to S6, S3', S4 'function as a synchronization adjustment unit, and S7- S9 functions as a data controller, S1
0 and S11 function as a data comparison unit, and S12 and S13 function as an abnormality detection unit. The same applies to the V system MPU2.

As a result, when each MPU is operating normally, an alternating signal is output from each of the U and V systems as a comparison result output, and only when the same alternating signal is output from each system, the comparison circuit is output. An alternating signal is output from 3 to the outside. On the other hand, if a failure occurs in any part of this circuit, the comparison result outputs from the respective systems do not match and the output of the alternating signal from the comparison circuit 3 disappears to detect the failure.

As described above, according to this embodiment, U,
ΔT interrupt signal and ΔT / 2 in V system MPU1 and 2 respectively
Generate an interrupt signal, U system ΔT interrupt signal and V system ΔT /
2 U and V system MPs that were previously operated by different software by adopting a configuration that uses an interrupt signal for synchronization
Since U can be operated by the same software, development cost can be reduced. Also,
Since the comparison circuit 3 only needs to compare the comparison result output from each MPU 1, 2, that is, the 1-bit alternating signal, the comparison circuit 3 can be realized with a small-scale circuit configuration. Furthermore, each M
In PU1 and PU2, the input data from the other system and the comparison data of its own system are compared, and the comparison processing is performed by appropriately inverting the bits of the comparison data to determine whether they are coincident or not. , A fixed failure in this circuit can be detected, and even if the comparison data continuously have the same value, the comparison result output sent to the comparison circuit 3 changes periodically to perform comparison. It is possible to prevent an error from occurring in the circuit 3.

[0028]

As described above, according to the first aspect of the invention, the first and second interrupt signals are generated in the respective arithmetic means, and the first and second interrupt signals generated by the different arithmetic means are generated. Since the two arithmetic units can be operated by the same software by using the configuration in which they are synchronized with each other, the development cost can be reduced. Further, in each arithmetic means, the transmission data from the other party is compared with its own comparison and comparison data, and the comparison processing is performed by appropriately inverting the bits of the comparison data and judging both coincidence and non-coincidence. By doing so, fixed failures etc. in this circuit can be reliably detected, and further,
Even if the comparison data continuously have the same value, the comparison result output sent to the comparison means changes periodically, so that it is possible to prevent an error from occurring in the comparison means.

In addition to the effect of the above-mentioned invention, the invention according to claim 2 is such that each data comparison section outputs the comparison result and a 1-bit signal, so that the comparison means is operated by each calculation means. Since it only needs to process the 1-bit signal of
The comparison means can be realized with a small-scale circuit configuration.

[Brief description of drawings]

FIG. 1 is a block diagram showing a configuration of an embodiment of the present invention.

FIG. 2 is a diagram illustrating a processing flow of the embodiment.

FIG. 3 is a diagram showing changes in each data according to the same embodiment.

FIG. 4 is a conceptual diagram summarizing data states at each processing stage of the above embodiment.

FIG. 5 is a diagram illustrating a configuration of a conventional matching circuit and a flow of processing.

FIG. 6 is a diagram showing changes in each data of a conventional matching circuit.

FIG. 7 is a diagram showing output data of each system and a comparison result of a conventional matching circuit.

[Explanation of symbols]

1 U MPU 2 V system MPU 3 comparison circuit 1a to 1g, 2a to 2g terminals Fa, Fb interrupt processing A, B, C,… Comparison data

─────────────────────────────────────────────────── ─── Continuation of the front page (72) Inventor Yasuo Saito 1-13-8 Kamikizaki, Urawa-shi, Saitama Nihon Signal Co., Ltd., inside the Yono Plant (56) Reference JP-A-59-132058 (JP, A) JP-A-7-129426 (JP, A) (58) Fields investigated (Int.Cl. ⁷ , DB name) G06F 11/16-11/20

Claims (2)

(57) [Claims] 1. An operation check is performed by comparing and collating the processing data of the respective computing means with the two computing means that individually perform the time counting operation, execute the same processing in synchronization, and output the processing data. A comparing circuit including a comparing means for performing, wherein each of the calculating means periodically generates a first and a second interrupt signal at a predetermined time interval based on each timing operation; Of the first interrupt signal generated by the calculating means and the second interrupt signal generated by the other calculating means, and a synchronization adjustment unit that synchronizes based on the second interrupt signal,
The comparison data selected from its own processed data is output as transmission data to the counterpart computing means and the comparison data is held as its own comparison reference data, and the transmission data is bit-inverted when the second interrupt signal is generated. And outputs to the calculation means of the other party, and bit-inverts the held comparison / contrast data when a predetermined time has elapsed after the generation of the second interrupt signal, and when the first interrupt signal is generated. A data comparison unit which, when the second interrupt signal is generated, compares whether or not the transmission data from the counterpart computing unit and its own comparison and comparison data match, and outputs the comparison result to the comparison unit; When a predetermined time elapses after the second interrupt signal is generated, the transmission data from the calculation means of the other party is compared with the comparison data of its own, and when they do not match, the occurrence of an abnormality of its own is detected. An abnormality detection unit for stopping the operation, wherein the comparison unit outputs a signal indicating normal operation only when the comparison result outputs from the data comparison units of the respective calculation units match. Matching circuit with. 2. The data comparing unit indicates a logical value 1 when the transmission data and the comparison reference data match each other,
The matching circuit according to claim 1, wherein a 1-bit signal indicating a logical value of 0 is output as a comparison result when they do not match.