JP5788022B2 - Fail-safe electronic control unit - Google Patents

Description

  The present invention relates to a fail-safe electronic control device that is applied to industrial equipment such as hoists and cranes operated by an operating device such as a push button unit.

  In the fail-safe electronic control device, in order to detect an abnormality of the fail-safe electronic control device, the arithmetic processing units are multiplexed and collation of the arithmetic processing results is performed.

  Such verification includes bus verification and software verification. The bus verification is limited by hardware, and the circuit is complicated and expensive. On the other hand, software verification is to verify the calculation result by software, and verification is performed by sending an interrupt request signal to the other microcomputer of one microcomputer, so that the problem of independent control cannot be maintained. Had.

  Further, in order to improve the overall processing performance of the fail-safe electronic control device, the peripheral device (for example, display device and communication device) is controlled with respect to the drive device (for example, the engine electronic control device) that drives the main body. For arithmetic processing that does not require relatively high safety, such as the above-mentioned arithmetic processing, different arithmetic processing is executed by a plurality of arithmetic processing units, and safety such as arithmetic processing at the time of drive control of the driving device is required. As for complex arithmetic processing, fail-safe electronic control that executes the same arithmetic processing in a plurality of arithmetic processing units and collates the results of the same arithmetic processing in order to detect abnormality of the arithmetic processing unit itself of the fail-safe electronic control device An apparatus has been proposed (for example, Patent Document 1). In such a fail-safe electronic control device, in addition to a plurality of arithmetic processing units, each arithmetic processing unit is asynchronously written with data about the result of the same arithmetic processing when performing processing that requires safety. And a collation circuit for collating data on the result of the same arithmetic processing written in the compressor.

JP 2010-113388 A

  In industrial equipment where the operator controls the operation of the equipment by pressing a push button switch corresponding to each operation of the equipment such as a hoist, a microcomputer is used in the drive unit to support the operator and various maintenance is performed. Management of data such as operation history necessary for the operation, display and warning of the operation state of the equipment. Here, peripheral devices (for example, various display devices) for the drive device (for example, hoist winding motor drive control unit) in order to provide a multi-function and fail-safe electronic control device at a low price while also making the drive device a microcomputer. For arithmetic processing that does not require relatively safety, such as arithmetic processing related to the control of the control, priority is given to efficiency, and arithmetic processing that is different in a plurality of arithmetic processing units (for example, display or push button of hoist operating state and maintenance data) For arithmetic processing that requires strict safety, such as arithmetic processing related to the control of the drive unit, for the arithmetic processing related to display on the switch unit, the same arithmetic processing (for example, winding) (Computation processing related to motor hoisting operation, lowering operation, and stopping operation) and collating the results with each other Preferably, detecting an abnormality of an electronic control device I.

  However, since the conventional fail-safe electronic control device requires a verification circuit to detect an abnormality in the fail-safe electronic control device, the configuration of the fail-safe electronic control device is complicated and the control device is expensive. Has the problem of becoming.

  An object of the present invention is to realize a multi-function and fail-safe device such as a hoist at low cost, and in particular, in a fail-safe electronic control device that multiplexes arithmetic processing units applied to a device such as a hoist. An object of the present invention is to realize a fail-safe electronic control device having a simple and inexpensive configuration while maintaining the independent controllability of each arithmetic processing unit.

  In order to solve such a problem, the present invention is a fail-safe electronic control device applied to a device operated by an operating device, and the same input signal is input from the operating device to drive and control the device. , Having a plurality of control units that mutually input and output output signals generated based on the input signal, each of the plurality of control units has a calculation processing unit, the calculation processing unit is a pulse signal of a fixed period For each pulse period, a first calculation process is performed in which the output signal is collated to detect the presence or absence of an abnormality in the calculation processing unit. When the first calculation process does not detect a collation abnormality in the collation, the output signal An operation command signal for driving and controlling a device corresponding to the output from at least one control unit of the plurality of control units, and when a collation abnormality is detected in the collation, the arithmetic processing unit includes a calculation process for prohibiting the operation of the device, The arithmetic processing unit of at least one control unit among the control units of the number executes a second arithmetic processing other than the first arithmetic processing, and the pulse signal pulse during the execution of the second arithmetic processing The fail-safe electronic control is characterized in that the second calculation process is interrupted each time the first calculation process is detected, the first calculation process is executed, and the second calculation process is resumed after the first calculation process is ended. Providing equipment.

  According to the present invention, a multi-function and fail-safe device such as a hoist can be realized at low cost, and in particular, a fail-safe electronic control device that is applied to a device such as a hoist and that multiplexes arithmetic processing units. Is to achieve a fail-safe electronic control device having a simple and inexpensive configuration while maintaining the independent controllability of each arithmetic processing unit.

  In the present invention, the pulse signal is preferably used as an interrupt request signal for the arithmetic processing unit to interrupt the second arithmetic processing and execute the first arithmetic processing.

  In the present invention, the pulse signal is preferably generated based on an AC voltage signal from a commercial AC power supply.

  In the present invention, the arithmetic processing unit performs collation a plurality of times, and continuously detects the coincidence between the output signal of the control unit including the arithmetic processing unit and the output signal of the arithmetic processing unit of another control unit twice or more. In this case, it is preferable to determine that there is no abnormality in the fail-safe electronic control device.

FIG. 1 is a block diagram of a system having a fail-safe electronic control device according to an embodiment of the present invention. FIG. 2 is a flowchart of control of the hoist and the display unit of the fail-safe electronic control device of FIG. FIG. 3 is a flowchart of control of the hoist and the communication unit of the fail-safe electronic control device of FIG. FIG. 4 is a flowchart of the interrupt process of FIGS. FIG. 5 is a waveform diagram of a 50 Hz AC voltage, a pulse signal as an interrupt request signal, a winding operation signal, and a winding command signal when there is no abnormality in the fail-safe electronic control device.

An embodiment of a fail-safe electronic control device according to the present invention will be described in detail with reference to the drawings.
FIG. 1 is a block diagram of a system having a fail-safe electronic control device according to an embodiment of the present invention. The system shown in FIG. 1 includes a hoist 1 as a device, a pulse signal generator 2 that generates a pulse signal with a constant period, a push button unit 3 as an operating device, and a fail-safe electronic control device having independent controllability. 4, a display unit 5 as a peripheral device, and a communication unit 6 as another peripheral device. In the present embodiment, the fail-safe electronic control device 4 is configured by a microcomputer and includes two control units 4a and 4b as a plurality of control units and IIC buses 4c and 4d.

  The hoist 1 includes a hoisting unit 12 having a hoisting mechanism for hoisting and lowering a hook 11 that suspends a suspended load, and a hoisting drive unit 13 that drives the hoisting unit 12.

  The winding drive unit 13 includes an AC power supply circuit 14 connected to a commercial AC power supply of 50 Hz or 60 Hz, a motor 15, a motor drive control unit 16, an electromagnetic relay 17, a circuit breaker 18, and a solid state relay circuit 19 And having.

  The AC power supply circuit 14 supplies power to the motor drive control unit 16. The motor 15 is a three-phase induction motor that is connected to the winding mechanism of the winding unit 12 and winds and lowers the hook 11 by the rotation of the motor 15. The motor drive control unit 16 includes an inverter control unit having a converter, a smoothing capacitor, an inverter, or the like, or a power circuit having a forward / reverse switching circuit including a power electromagnetic switch, and an operation command from the fail-safe electronic control circuit 4 The rotation of the motor 15 is controlled by the signal.

  When an abnormality detection signal indicating that an abnormality has been detected is input from the fail-safe electronic control device 4, the electromagnetic relay 17 outputs a power cutoff signal to the circuit breaker 18. The breaker 18 forcibly cuts off the electric power supplied from the AC power supply circuit 14 to the motor drive control circuit 16 when a power cut-off signal is input from the electromagnetic relay 17, and rotates the motor 15, that is, hoist 1 hoisting / lowering operation. Is prohibited. Since the hoist 1 has an unexcited operation brake (not shown), when the electric power supplied to the motor drive control unit 16 is cut off, the unexcited operation brake is automatically operated and the hoist 1 is stopped.

  The solid state relay circuit 19 receives a winding command signal or a lowering command signal as an operation command signal from the fail-safe electronic control device 4 so that the hoist 1 operates according to the winding command signal or the lowering command signal. A signal is output to the motor drive control unit 16.

  In the block diagram of the system having the fail-safe electronic control device of FIG. 1, when the winding command signal or the lowering command signal from the control unit 4a and the control unit 4b coincides, the solid state relay circuit 19 Is output to the motor drive control unit 16. Note that the entire circuit can be simplified so that only one of the operation command signals of the control unit 4a and the control unit 4b is directly output to the motor drive control unit 16.

  The pulse signal generator 2 includes an AC power supply circuit 21 connected to a commercial AC power supply of 50 Hz or 60 Hz as in the AC power supply circuit 14, and a bidirectional photocoupler 23 connected to the power supply 21 via a resistor 22. When the power supply frequency is 50 Hz, a pulse signal having a constant cycle of 1/100 second (10 milliseconds) is output, and when the power supply frequency is 60 Hz, 1/120 second (about 8.3 Outputs a pulse signal with a constant period of milliseconds.

  The bidirectional photocoupler 23 includes light emitting diodes 24a and 24b provided on the input side, and a phototransistor 25 provided on the output side. The emitter of the phototransistor 25 is grounded, and the collector of the phototransistor 25 is a resistor. 26 is connected to a direct current power source (not shown).

  With such a configuration, a pulse signal having a constant period is stably generated based on the AC voltage signal of the AC power supply 21, and fail-safe electronic control is performed through the node S 1 between the collector of the phototransistor 25 and the resistor 26. Input to the control units 4a and 4b of the apparatus 4, respectively.

  The push button unit 3 is an operating device for an operator to instruct the hoisting and lowering operations of the hoist 1 to the fail-safe electronic control device 4. For this purpose, the push button unit 3 has a winding button 31a and a lowering button 32b.

  The winding button 31a generates a winding operation pulse signal that is a pulse signal having a constant cycle based on the AC power supply frequency. For this purpose, the winding button 31a includes an AC power supply circuit 32a connected to a commercial AC power supply of 50 Hz or 60 Hz, etc., like the AC power supply circuit 14, and a bidirectional photocoupler connected to the AC power supply circuit 32a via a resistor 33a. 34a and a switch 35a for maintaining or disconnecting the connection between the AC power supply circuit 32a and the bidirectional photocoupler 34a.

  The bidirectional photocoupler 34a includes light emitting diodes 36a-1 and 36a-2 provided on the input side, and a phototransistor 37a provided on the output side. The emitter of the phototransistor 37a is grounded, and the phototransistor 37a. Is connected to a DC power source (not shown) through a resistor 38a.

  With such a configuration, while the switch 35a is in the on state, that is, while the winding button 31a is being pressed, the winding operation pulse signal fails through the node S2 between the collector of the phototransistor 37a and one end of the resistor 38a. The hoist 1 is wound up by being input to the control units 4a and 4b of the safe electronic control unit 4, respectively.

  The lowering button 31b generates a lowering operation pulse signal that is a pulse signal having a constant cycle based on the AC power supply frequency. For this reason, the lowering button 31b is connected to the AC power supply circuit 32b connected to a 50 Hz or 60 Hz commercial AC power supply and the like and the bidirectional power supply connected to the AC power supply circuit 32b via the resistor 33b, like the winding button 31a. A photocoupler 34b and a switch 35b for maintaining or disconnecting the connection between the AC power supply circuit 32b and the bidirectional photocoupler 34b are provided.

  The bidirectional photocoupler 34b includes light emitting diodes 36b-1 and 36b-2 provided on the input side and a phototransistor 37b provided on the output side. The emitter of the phototransistor 37b is grounded, and the phototransistor 37b. Are connected to a DC power source (not shown) through a resistor 38b.

  With such a configuration, while the switch 35b is in an ON state, that is, while the lowering button 31b is continuously pressed, the lowering operation pulse signal is transmitted to the node S3 between the collector of the phototransistor 37b and one end of the resistor 38b. Is input to the control units 4a and 4b of the fail-safe electronic control device 4 and the hoist 1 is lowered.

  The control unit 4a includes a substrate 41a, an input unit 42a, a memory 43a, a clock oscillator 44a, a CPU 45a as an arithmetic processing unit, an input / output unit 46a, an output unit 47a, a communication unit 48a, and a bus 49a. Have. Similarly, the control unit 4b includes a substrate 41b, an input unit 42b, a memory 43b, a clock oscillator 44b, a CPU 45b as an arithmetic processing unit, an input / output unit 46b, an output unit 47b, a communication unit 48b, And a bus 49b.

  An input unit 42a, a memory 43a, a clock oscillator 44a, a CPU 45a, an input / output unit 46a, an output unit 47a, a communication unit 48a, and a bus 49a are formed on the substrate 41a. Similarly, an input unit 42b, a memory 43b, a clock oscillator 44b, a CPU 45b, an input / output unit 46b, an output unit 47b, a communication unit 48b, and a bus 49b are formed on the substrate 41b. Each of the substrates 41a and 41b is preferably a one-chip microcomputer from the viewpoint of miniaturization and cost reduction.

  Each of the input units 42a and 42b has a plurality of input ports to which the winding operation pulse signal and the lowering operation pulse signal from the push button unit 3 are input as input signals. Presence / absence of input of a constant period pulse signal at the winding operation pulse signal and lowering operation pulse signal input ports of the input units 42a and 42b is detected by the CPUs 45a and 45b, respectively, and a regular constant period pulse based on the frequency of the AC power supply is detected. When a signal is input, an H level hoisting operation signal or a lowering operation signal is generated, and when the hoisting operation pulse signal and the lowering operation pulse signal are detected at the same time, there is no input of a pulse signal with a constant period. In the case or when an illegal pulse signal is detected, an L level winding operation signal or a winding operation signal is generated. Note that it is preferable to display an abnormality on the display unit 5 assuming that the push button unit 3 or the signal transmission path is abnormal when an irregular pulse signal other than noise is detected by the CPU 45a or the CPU 45b.

  The memories 43a and 43b store the programs of the CPUs 45a and 45b, respectively, and are generated based on the winding operation signal or the lowering operation signal data generated by the CPUs 45a and 45b, the winding operation signal or the lowering operation signal, respectively. The CPU 45a and 45b respectively write output signal data, hoisting operation pulse signals or lowering operation pulse signals, hoisting operation signals or lowering operation signals, data related to various arithmetic processing performed based on output signals, and the like. . Output signals generated based on the winding operation signal or the lowering operation signal are input / output between the control unit 4a and the control unit 4b via the ports of the input / output units 46a and 46b.

  Further, various data generated by the control unit 4a is obtained via the IIC bus 4c and stored in the memory 43b, and various data generated by the control unit 4b is obtained via the IIC bus 4c and obtained by the memory 43a. It is preferable to store in.

  The clock generators 44a and 44b output clock signals having a predetermined clock frequency (for example, 16 MHz) to the CPUs 45a and 45b, respectively.

  The CPUs 45a and 45b execute hoist control programs stored in the CPUs 45a and 45b based on the clock signals input from the clock generators 44a and 44b, respectively. When the pulse signal from the pulse signal generator 2 is input to the respective interrupt request signal input ports of the CPUs 45a and 45b, the CPUs 45a and 45b are respectively connected to the hoist in response to the pulse period of the pulse signal as the interrupt request signal. 1 is executed based on the winding operation signal or the lowering operation signal, and when there is no collation abnormality in the calculation result, a winding command signal or a lowering command signal is generated and output. The winding command signal and the lowering command signal are programmed so as not to generate an H level at the same time.

  In addition, the CPUs 45a and 45b respectively control the control units stored in the memories 43a and 43b in response to the pulse period of the pulse signal from the pulse signal generator 2 in order to detect an abnormality in the fail-safe electronic control unit 4. The output signal data of 4a, 4b and the output signal data of the other control unit 4b, 4a input to the input / output units 46a, 46b are collated at least twice.

  The coincidence between the data of the output signals of the control units 4a and 4b stored in the memories 43a and 43b and the output signal of the control unit 4b is a predetermined number of times even if a predetermined number of preset times (for example, 10 times) is repeated. If the detection is not continued (for example, twice), the CPUs 45a and 45b determine that the fail-safe electronic control device 4 has an abnormality.

  The above-described collation of the output signal data by the CPUs 45a and 45b is performed according to the collation programs stored in the memories 43a and 43b, respectively. The CPU 45a and 45b indicate that the collation result, that is, the fail-safe electronic control device 4 is abnormal. The collation data as to whether or not there is is generated as one of the data of the various arithmetic processes.

  The generated collation data is not only stored in the memories 43a and 43b by the CPUs 45a and 45b, but also transmitted to the other control units 4b and 4a by the CPUs 45a and 45b, and the respective memories 43b and 45a are transmitted by the other CPUs 45b and 45a. 43a and the control units 4a and 4b share the collation result with each other.

  Further, the CPU 45a controls the display unit 5 according to the display unit control program stored in the CPU 45a. For this purpose, the CPU 45a executes a calculation process related to the control of the display unit 5 as a second calculation process, and generates a video signal representing hoist operation or maintenance data based on the data of the various calculation processes.

  Further, when the CPU 45a detects the rising edge of the pulse signal at the interrupt request signal input port of the CPU 45a while executing the arithmetic processing related to the control of the display unit 5, the CPU 45a interrupts the arithmetic processing related to the control of the display unit 5. Then, the arithmetic processing related to the drive control of the hoist 1 as the interrupt processing is executed as the first arithmetic processing, and the arithmetic processing related to the control of the display unit 5 is resumed after completing the arithmetic processing related to the drive control of the hoist 1. That is, such interruption processing and resumption of calculation processing relating to the control of the display unit 5 after completion of the interruption processing are executed every time the rising edge of the pulse signal is detected.

  Further, the CPU 45b controls the communication unit 6 according to the communication unit control program stored in the CPU 45b. For this purpose, the CPU 45b executes a calculation process related to the control of the communication unit 6 as a second calculation process, and sends a push button unit display control signal for controlling the display operation in the push button unit 3 to the above various calculation processes. Generate based on data.

  Further, when the CPU 45b detects the rising edge of the pulse signal at the interrupt request signal input port of the CPU 45b while executing the arithmetic processing related to the control of the communication unit 6, the CPU 45b interrupts the arithmetic processing related to the control of the communication unit 6. Then, the arithmetic processing related to the drive control of the hoist 1 that is the interrupt processing is executed as the first arithmetic processing, and the arithmetic processing related to the control of the communication unit 6 is resumed after completing the arithmetic processing related to the drive control of the hoist 1. That is, the interruption process and the resumption of the calculation process related to the control of the communication unit 6 after the completion of the interruption process are executed every time the rising edge of the pulse signal is detected.

  Note that the processing capability of the CPU 45a may be the same as or different from the processing capability of the CPU 45b. For example, at least one of the CPU 45a and the CPU 45b can be configured by an inexpensive CPU having a minimum function necessary for performing arithmetic processing related to drive control of the hoist 1 that requires safety. Further, the CPU 45b can be constituted by a CPU manufactured by a manufacturing process different from that of the CPU 45a. In this case, the CPU 45b is manufactured by the same manufacturing process as that of the CPU 45a. It can be made lower than the case.

  The IIC bus 4c transfers the data of the input signal of the control unit 4a and the collation data to the control unit 4b and the serial data line SDA for transferring the data of the input signal of the control unit 4b and the collation data to the control unit 4a, A serial clock line SCL for synchronizing these input signal data and verification data.

  The display unit 5 is configured by, for example, a liquid crystal display (LCD) and displays character information corresponding to an operation or maintenance signal input from the input / output unit 46a. The communication unit 6 includes a communication port for transmitting and receiving a push button unit display control signal, and outputs the push button unit display control signal input from the input / output unit 46b to the push button unit 3 to generate a push button unit display control signal. Display control of the push button unit 3 is performed according to the above.

  FIG. 2 is a flowchart of hoist and display unit control executed by the control unit 4a of the fail-safe electronic control device of FIG. In the flowchart shown in FIG. 2, first, in step S1, the CPU 45a performs initial setting of the control unit 4a by resetting a power source (not shown) of the control unit 4a.

  In step S2, an interrupt is permitted, and thereafter, every time the CPU 45a inputs the pulse signal of the pulse signal generator 2 (H level signal of a constant cycle) to the interrupt request signal input port of the CPU 45a, the CPU 45a Execute the interrupt processing described.

  In the input signal processing in step S3, the CPU 45a generates a winding operation signal and a lowering operation signal from the winding operation pulse signal and the lowering operation pulse signal from the push button unit 3, and writes them in the memory 43a. At this time, it is preferable to determine whether the winding operation pulse signal and the lowering operation pulse signal input to the input unit 42a are regular pulse signals based on the commercial AC power source, and when an illegal pulse is detected. It is preferable to execute a predetermined abnormality process.

  The input signal processing step S3 in the flowchart of FIG. 2 can be included in the input signal processing step S14 in the flowchart of FIG. 4 described later. Further, the input signal processing step S3 in the flowchart of FIG. 2 can be omitted.

  In step S <b> 4, the CPU 45 a performs a display process for displaying operation or maintenance data, and outputs a display signal to the display unit 5.

  FIG. 3 is a flowchart of hoist and communication unit control executed by the control unit 4b of the fail-safe electronic control device of FIG. In the flowchart shown in FIG. 4, first, in step S <b> 1 ′, the CPU 45 b performs initial setting of the control unit 4 b by resetting a power supply (not shown) of the control unit 4 b.

  In step S2 ′, the interrupt is permitted, and thereafter, every time the CPU 45b inputs the pulse signal of the pulse signal generator 2 (H level signal of a constant cycle) to the interrupt request signal input port of the CPU 45b, the CPU 45b Execute the interrupt processing described.

  In the input signal processing in step S3 ', the CPU 45b generates a winding operation signal and a lowering operation signal from the winding operation pulse signal and the lowering operation pulse signal from the push button unit 3, and writes them in the memory 43b. At this time, it is preferable to determine whether the winding operation pulse signal and the lowering operation pulse signal input to the input unit 42b are regular pulse signals based on the commercial AC power supply, and when an illegal pulse is detected It is preferable to execute a predetermined abnormality process.

  The input signal processing step S3 'in the flowchart of FIG. 3 can be included in the input signal processing step S14 in the flowchart of FIG. 4 described later. Further, the input signal processing step S3 'in the flowchart of FIG. 3 can be omitted.

  In step S <b> 4 ′, the CPU 45 b executes external communication processing and outputs a push button unit display control signal to the communication unit 6.

  FIG. 4 is a flowchart of arithmetic processing common to the CPUs 45a and 45b, and is a flowchart of the interrupt processing described in the flowcharts of FIGS. 2 and 3, in which an interrupt request signal is input to the interrupt request signal input port of the CPUs 45a and 45b. It is executed every time. In the flowchart shown in FIG. 4, first, in step S11, the CPUs 45a and 45b reset the first count values N stored in the memories 43a and 43b to zero, respectively. Thereafter, in step S12, the CPUs 45a and 45b reset the second count values M stored in the memories 43a and 43b to zero, respectively.

  In step S13, the CPUs 45a and 45b add 1 to the first count value N. Thereafter, in step S14, the CPUs 45a and 45b write the data of the input signals input to the respective input units 42a and 42b into the respective memories 43a and 43b.

  Thereafter, in step S15, the CPUs 45a and 45b execute arithmetic processing relating to drive control of the hoist 1 based on the input signal. Thereafter, in step S16, the CPUs 45a and 45b store the input signal and the data of the output signal generated based on the data of the memories 43a and 43b (the winding operation signal or the lowering operation signal and the upper limit signal and the lower limit signal not shown). Write to 43a and 43b, respectively. Thereafter, in step S17, the CPUs 45a and 45b collate whether or not the output signals of the control units 4a and 4b match.

  Thereafter, in step S18, it is determined whether or not the collation result in step S17 is collation abnormality. If it is determined that there is no collation abnormality, in step S19, the CPUs 45a and 45b add 1 to the second count value M. Thereafter, in step S20, the CPUs 45a and 45b determine whether or not the count value M exceeds a specified number of times (for example, 2). If the count value M does not exceed the specified number, the process returns to step S13. On the other hand, if the count value M exceeds the specified number of times, in step S21, the CPUs 45a and 45b execute hoist drive control processing such as output of the winding command signal or the lowering command signal to the solid state relay circuit 19. . M is preferably 2 or more from the viewpoint of safety.

  If it is determined in step S18 that the collation is abnormal, in step S22, the CPUs 45a and 45b determine whether or not the count value N exceeds a specified number of times (for example, 10). If the count value N does not exceed the specified number, the process returns to step S12. On the other hand, if the count value N exceeds the specified number of times, in step S23, the CPUs 45a and 45b determine that there is an abnormality in the fail-safe electronic control unit 4, and output an abnormality detection signal to the electromagnetic relay 17 or the like. The abnormal process is executed independently.

  In a device operating at a low speed, such as a hoist, when there is a lot of noise or the like and the operation is not stable, the electromagnetic relay 17 is connected only when the abnormality process of step S23 is executed in a plurality of consecutive interrupt processes. It can also be changed to validate the output abnormal signal.

  The specified number of times used in step S20 and step S22 is set in advance in consideration of the processing capabilities of the CPUs 45a and 45b, the presence or absence of noise, and the like. When the processing capability of the CPU 45a is different from the processing capability of the CPU 45b, it is preferable that the specified number of times used in Step S20 and Step S22 in the CPU 45a is different from the specified number of times used in Step S20 and Step S22 in the CPU 45b.

  FIG. 5 shows a 50 Hz alternating current when there is no abnormality in the fail-safe electronic control device, a pulse signal from the pulse signal generator 2, and a winding operation signal generated by the CPUs 45 a and 45 b from the winding operation pulse signal from the push button unit 3. 4 is a waveform diagram of a winding command signal output as a calculation result by CPUs 45a and 45b.

  When the CPU 45a, 45b detects the rising edge of the pulse signal at the time t1 when the fail-safe electronic control device 4 executes the arithmetic processing related to the control of the display unit 5 or the communication unit 6, the CPU 45a, 45b Alternatively, the arithmetic processing related to the control of the communication unit 6 is interrupted and the arithmetic processing related to the drive control of the hoist 1 is executed. That is, at time t1, the CPUs 45a and 45b receive the interrupt request signal and execute interrupt processing.

  At a time t2 when a predetermined time (for example, 1 millisecond) has elapsed from the time t1, the CPUs 45a and 45b end the arithmetic processing related to the drive control of the hoist 1, that is, the interrupt processing, and the arithmetic processing related to the control of the display unit 5 or the communication unit 6. To resume.

  When the fail-safe electronic control device 4 is normal, the procedure from step S13 to step S20 in the flowchart of FIG. 4 is repeated at least twice between time t1 and time t2, and then the process proceeds to step S21, and the output unit 47a , 47b output an L level winding command signal.

  The arithmetic processing relating to the restarted control of the display unit 5 or the communication unit 6 is performed until the next rising edge of the pulse signal is detected, that is, until the time t3 when a predetermined time (for example, 9 milliseconds) elapses from the time t2. 45b. During this time, the output units 47a and 47b continue to output the L level winding command signal.

  Thereafter, the CPUs 45a and 45b start arithmetic processing (interrupt processing) related to driving control of the hoist 1 from time t3 when the next rising edge of the pulse signal is detected, and for a predetermined time (for example, 1.5 milliseconds from time t3). ) The process is executed until the elapsed time t4, and the arithmetic processing related to the control of the display unit 5 or the communication unit 6 is executed until the time t5 when a predetermined time (for example, 8.5 milliseconds) elapses from the time t4.

  The waveform diagram of FIG. 5 illustrates a case where the winding operation signal changes from L level to H level at time t3 'between time t2 and time t3. In this case, since the CPUs 45a and 45b operate asynchronously at the clock signal level, in the verification processing step S17 in the flowchart of FIG. 4 immediately after time t3 ′, the verification target data does not match. “Verification error”. Therefore, in the flowchart of FIG. 4, steps S12 to S18 are repeated in a predetermined number of times (for example, 10 times) until the collation abnormality is resolved. Thereafter, when the collation abnormality is resolved and “no collation abnormality” continues M times (for example, twice) a predetermined number of times, the hoist control processing step S21 is executed, and at time t4, the CPUs 45a and 45b send the winding command signal to L The level is changed to the H level and output, and the arithmetic processing (interrupt processing) related to the drive control of the hoist 1 is completed.

  Thereafter, the resumed calculation processing related to the control of the display unit 5 or the communication unit 6 is executed until the next rising edge of the pulse signal is detected. During this time, the output units 47a and 47b continue to output the H level winding command signal.

  Thereafter, the CPUs 45a and 45b start calculation processing (interrupt processing) related to the drive control of the hoist 1 from time t5 when the next rising edge of the pulse signal is detected, and a predetermined time (for example, 1 millisecond) has elapsed from time t5. The calculation process for controlling the display unit 5 or the communication unit 6 is performed until the time t7 when a predetermined time (for example, 9 milliseconds) elapses from the time t6.

  In this case, since the winding operation signal continues at H level without change from time t5, the output of the H level winding command signal is continued.

  Similarly, at time t8 when a predetermined time (for example, 5 seconds) has elapsed from time t7, the CPUs 45a and 45b similarly start arithmetic processing (interrupt processing) related to the drive control of the hoist 1, and for a predetermined time (for example, 1) from time t8. At time t9 when milliseconds have elapsed, arithmetic processing relating to control of the display unit 5 or communication unit 6 is resumed, and arithmetic processing for controlling the restarted display unit 5 or communication unit 6 is performed for a predetermined time (from time t9). For example, the process is executed until time t10 when 9 milliseconds have elapsed.

  In this case, the winding operation signal changes from the H level to the L level between time t8 and time t10, more specifically, at time t9 ′ between time t9 and time t10, but the winding operation is performed from time t8 to time t9. Since the signal is at the H level, the winding command signal between time t8 and time t10 remains at the H level.

  Thereafter, the CPUs 45a and 45b start arithmetic processing (interrupt processing) related to the drive control of the hoist 1 from time t10 when the next rising edge of the pulse signal is detected, and for a predetermined time (for example, 1.2 milliseconds from time t10). ) The process is executed until the elapsed time t11, and the arithmetic processing for controlling the display unit 5 or the communication unit 6 is executed until the time t12 when a predetermined time (for example, 8.8 milliseconds) elapses from the time t11.

  In this case, since the hoisting operation signal is at the L level from time t10, the hoisting command signal is changed from the H level in the hoist control process of step S21 in the flowchart of FIG. Since the output is changed to the L level, the winding command signal from the time t11 when the arithmetic processing (interrupt processing) related to the drive control of the hoist 1 is completed to the time t12 when the next rising edge of the pulse signal is detected is L Become a level.

  Thereafter, the CPUs 45a and 45b perform the calculation process (interrupt process) related to the drive control of the hoist 1 and the calculation process related to the display unit 5 or the communication unit 6 from the pulse signal generator 2 (the H level at a constant cycle). Repeatedly based on the signal) period.

  According to the present embodiment, the first calculation process that strictly emphasizes safety regarding the drive control of the hoist 1 and the second calculation process that does not require strict safety regarding the control of the display unit 5 or the communication unit 6 are performed. When the fail-safe electronic control device 4 having two arithmetic processing units 45a and 45b, which are combined with each other, is used for the hoist 1, it is specially used to detect whether or not the fail-safe electronic control device 4 has an abnormality. No matching circuit is required. Therefore, the fail-safe electronic control device 4 has a high degree of hardware freedom, and can therefore have a simple and inexpensive configuration.

  Further, according to the present embodiment, the interrupt request signal is generated using the bidirectional photocouplers 24a and 24b based on the AC voltage signal of the AC power supply circuit 21 connected to the highly reliable commercial AC power supply. The first calculation process related to the drive control of the hoist 1 can be surely executed at a constant cycle (10 milliseconds for a 50 Hz AC power supply and about 8.3 seconds for a 60 Hz AC power supply).

  Further, according to the present embodiment, the first calculation process related to the drive control of the hoist 1 is interrupted by interrupting the calculation process related to the control of the display unit 5 or the communication unit 6, which is the second calculation process, for each interrupt request signal having a fixed period. Even if the CPU 45a operates asynchronously with the CPU 45b by executing the arithmetic process and restarting the second arithmetic process after finishing the first arithmetic process, the first arithmetic process for collating the results of the respective arithmetic processes Can be executed at the same timing without affecting the performance of the control target.

  Further, since the CPUs 45a and 45b can execute separate second calculation processes when the first calculation process is not being executed, the processing capability of the entire control device can be improved efficiently. . In other words, a fail-safe electronic control device used for hoists, cranes and the like can be realized using an inexpensive microcomputer, one-chip microcomputer, and the like.

  A short time mismatch between the output signal of the control unit 4a and the output signal of the control unit 4b due to the CPU 45a operating asynchronously with the CPU 45b immediately after detecting the rising edge of the pulse signal of the pulse generator 2 as the interrupt request signal. Can not be avoided. The CPUs 45a and 45b erroneously determine such a short-time mismatch as an abnormality of the fail-safe electronic control unit 4. According to the present embodiment, the output signal of the control unit 4a and the output signal of the control unit 4b are collated a plurality of times, and the match between the output signal of the control unit 4a and the output signal of the control unit 4b is more than a specified number of times ( (Preferably twice or more) Since it is determined that there is no abnormality in the fail-safe electronic control device 4 when detected continuously, electromagnetic noise or an error in output verification caused by the CPU 45a operating asynchronously with the CPU 45b Judgment can be reliably avoided with a simple circuit configuration.

  The present invention is not limited to the above-described embodiment, and many changes and modifications can be made. For example, in the above embodiment, the case where the fail-safe electronic control device according to the present invention is applied to a hoist has been described. However, the present invention can also be applied to other industrial equipment such as a crane. Also, peripheral devices other than the display unit, communication unit, and parameter setting unit can be used as the peripheral devices.

  In the above embodiment, the case where the fail-safe electronic control device according to the present invention does not include a pulse signal generator has been described. However, the fail-safe electronic control device according to the present invention may include a pulse signal generator. it can.

  In the above embodiment, the case where the fail-safe electronic control device according to the present invention has two control units has been described. However, the fail-safe electronic control device according to the present invention has three or more control units. You can also.

  In the above embodiment, the case where a highly reliable pulse signal is generated based on an AC voltage signal of a highly reliable 50 Hz commercial AC power supply has been described. However, a highly reliable pulse signal is Can be generated based on other signals having a high frequency (for example, an AC voltage signal of a commercial AC power supply having a frequency other than 50 Hz or 60 Hz).

  In the above embodiment, the case where the rising edge of the pulse signal is detected has been described. However, the present invention can also be applied to the case where a portion other than the rising edge of the pulse signal (for example, a falling edge) is detected. .

  In the above embodiment, the case where the push button unit has the winding button and the lowering button has been described. However, the push button unit may have a button (for example, a stop button) other than the winding button and the lowering button. In addition, an operation unit other than the push button unit can be used.

  Moreover, in the said embodiment, although the case where a 2nd calculation process was a calculation process regarding control of a display part and a communication part was demonstrated, a 2nd calculation process is a display part and communication with respect to the drive device which drives a main body. The second arithmetic processing can be performed by an arithmetic processing unit of at least one control unit among the plurality of control units.

  In the above embodiment, the case where the hoisting operation signal or the lowering operation signal is used as the input signal has been described. However, a signal other than the hoisting operation signal or the lowering operation signal (for example, a stop signal from the hoist) is input signal. Can also be used.

  Further, in the above embodiment, the first arithmetic processing is executed by the interrupt request signal. However, in addition to the interrupt processing, the pulse signal generator 2 can be controlled during the second arithmetic processing by a software technique such as polling. It is also possible to start the first arithmetic processing in response to a pulse signal having a fixed period to be output.

  Moreover, in the said embodiment, although the winding button and the lowering button each have the structure which produces | generates a pulse signal, you may have the structure which produces | generates the signal of H level or L level.

  Furthermore, although the case where the 1st speed specification hoist was used was demonstrated in the said embodiment, the multistage speed hoist which employ | adopted the multistage pushbutton switch for the pushbutton unit can also be used.

Claims (4)

A fail-safe electronic control device applied to equipment operated by an operating device,
In order to drive and control the device, the same input signal is input from the operation device, and has a plurality of asynchronous control units that mutually input and output output signals generated based on the input signal,
Each of the plurality of control units has an arithmetic processing unit,
The arithmetic processing unit collates the output signal in order to detect the first arithmetic processing related to the drive control of the device and the presence / absence of abnormality of the arithmetic processing unit for each pulse period of the pulse signal having a constant period. Computation processing related to
The arithmetic processing relating to the collation of the output signal is an operation command signal for driving and controlling the device corresponding to the output signal when no collation abnormality is detected in the collation, at least one control unit of the plurality of control units And when the collation abnormality is detected in the collation, the arithmetic processing unit includes a calculation process for prohibiting the operation of the device,
The arithmetic processing units of at least two control units of the plurality of control units execute a second arithmetic processing different from the first arithmetic processing or the arithmetic processing related to collating the output signal , Computation relating to interrupting the second computation process and detecting the first computation process and the output signal each time a pulse of the pulse signal is detected during the execution of the second computation process processing is executed, the second arithmetic processing resumes after completing the processing operation regarding the carrying out the verification of the first arithmetic processing and the output signal,
The second calculation process executed by the calculation processing unit of one of the at least two control units is different from the second calculation process executed by the calculation processing unit of another control unit. And
The arithmetic processing unit performs the collation a plurality of times, and continuously detects a mismatch between the output signal of the control unit including the arithmetic processing unit and the output signal of the arithmetic processing unit of another control unit a predetermined number of times. When the coincidence between the output signal of the control unit including the arithmetic processing unit and the output signal of the arithmetic processing unit of another control unit is continuously detected twice or more, an abnormality is detected in the fail-safe electronic control device. A fail-safe electronic control device characterized in that it is determined that there is no .   2. The fail-safe electronic control device according to claim 1, wherein the pulse signal is an interrupt request signal for the arithmetic processing unit to interrupt the second arithmetic processing and execute the first arithmetic processing.   The fail-safe electronic control device according to claim 1, wherein the pulse signal is generated based on an AC voltage signal from a commercial AC power supply. The device is a hoist;
The pulse signal is generated by a pulse signal generator connected to a commercial AC power source,
The controller is
A winding button that is connected to the commercial AC power source and generates a winding operation pulse signal based on the AC power source frequency;
A lowering button that is connected to the commercial AC power source and generates a lowering operation pulse signal based on the AC power source frequency;
The fail-safe electronic control device according to claim 1.

Images