JP5875475B2 - Security equipment - Google Patents

Description

  The present invention relates to a safety device such as a railroad security device that safely controls field equipment.

In railway security equipment that controls signal lights and turning machines, equipment failures can lead to serious accidents. Therefore, in the case of a railway security device, even if the device fails, a fail-safe configuration for controlling the entire device to the safe side is indispensable. Here, the "fail-safe", due to the failure of the components and the like, refers to a become a dangerous side control, such as lead to a serious accident Ikoto. In order to prevent dangerous-side control, a circuit that reliably detects a component failure is added to achieve safe-side control.

  In general-purpose systems, a configuration in which a CPU, an IO, and their peripheral circuits are operated by one oscillator is common. However, in the case of a configuration in which the CPU, the IO, and their peripheral circuits are operated by one oscillator, there is a possibility that the oscillator may operate if the output frequency fluctuates without failing to stop the oscillation. When the oscillator makes such a failure, reliable failure detection becomes impossible.

  In order to solve this problem, there is a configuration as shown in FIG. 10 that takes advantage of the dual system configuration. The A system clock signal 8 is connected from the output of the A system oscillator 1 to the A system CPU 3, the A system side A system measuring instrument 5, and the B system side A system measuring instrument 20. Similarly, on the B system side, the B system clock signal 23 is connected from the output of the B system oscillator 16 to the B system CPU 18, the B system side B system measuring instrument 21, and the A system side B system measuring instrument 6. In the A system comparison / status display 7, the measurement result of the A system measuring instrument 5 on the A system side is compared with the measurement result of the B system measuring instrument 13 on the A system side, and if these two measurement results match. If the oscillators are normal and different, any oscillator can be determined to be abnormal. The comparison result is reported to the A system CPU 3 as the A system status signal 14. The B system side also compares the measurement results using the same method. By carrying out this process periodically, it is possible to monitor with high accuracy that there is no abnormality in the oscillator.

  As a result, the A system comparison / status display 7 and the B system comparison / status display 22 can also perform mutual monitoring of the status of the A system and the B system. Communicate the state. In addition, the state of the B system can be constantly monitored and can be one of the state monitoring. By supplying the A system clock signal 8 to the A system measuring instrument 20 on the B system side, a clock signal independent of the A system oscillator 1 can be used without using extra parts. There are benefits. Since the configuration so far is the same for the B system as the A system, the description of the B system is omitted.

  However, in this method, it is unclear whether the A-system or B-system oscillator is abnormal. In addition, when an abnormality is detected, the system is stopped including the other normal oscillator, and there is a problem that the operation time of the system is shortened.

  To solve these problems, a method as disclosed in Patent Document 1 has been proposed. In Patent Document 1, the system clock is branched and supplied to the active clock distribution device and the standby clock distribution device, and the interruption is monitored inside them, and the buffer is alternatively output from the buffer to the system clock line. The device supplies the disconnection detection circuit with the system clock multiplied by n by the multiplier and monitors the disconnection based on the length of the half cycle of the system clock. When the disconnection is detected, the buffer control circuit A clock distribution system is described in which switching to is performed and a normal system clock is output.

JP 2004-64344 A

  Although it is possible to detect the abnormal oscillation of the clock oscillator with high accuracy using the multi-system configuration for the problem described in the background art, it is unknown whether the A-system or B-system oscillator is abnormal. . In addition, when an abnormality is detected, the system is stopped including the other normal oscillator, and the system operation time becomes a problem.

  In order to solve the above problems, the present invention determines which system's oscillator is abnormal after detecting the abnormality of the oscillator, disconnects the output of the abnormal oscillator, and supplies the output from the normal oscillator. An object of the present invention is to provide a security device that can perform switching control and extend the system operation time.

The security device of the present invention includes one self-system oscillator, a measuring instrument that measures the output of the self-system oscillator, a measuring instrument that is included in the self-system that measures the output of another system oscillator, and the two measuring instruments. A security device comprising a common system measuring instrument that measures the output of a reference oscillator serving as a reference for comparing the results, and having a dual system configuration control device having two systems of the same configuration oscillator and measuring instrument. ,
A reference standard for comparing the measurement result of the measuring instrument that measures the output of the local oscillator, the measurement result of the measuring instrument in the local system that measures the output of the other oscillator, and the result of the two measuring instruments By comparing the measurement results of the common measuring instrument that measures the output of the oscillator, the abnormality of the oscillator can be detected.

  According to the present invention, after detecting the abnormality of the oscillator, it is determined which system of the oscillator has become abnormal, the output of the abnormal oscillator is disconnected, and the switching control is performed such that the output is supplied from the normal oscillator, The operating time can be extended.

It is a figure for showing an outline of a security device of Example 1 of the present invention. It is a figure for demonstrating the state and operation | movement of a security device of Example 1 of this invention. It is a figure for demonstrating the state and operation | movement of a security device of Example 1 of this invention. It is a figure for demonstrating the state and operation | movement of a security device of Example 1 of this invention. It is a figure for demonstrating the state and operation | movement of a security device of Example 1 of this invention. It is a figure for showing the outline | summary of the security apparatus of Example 2 of this invention. It is a figure for demonstrating the state and operation | movement of the security apparatus of Example 2 of this invention. It is a figure for demonstrating the state and operation | movement of the security apparatus of Example 2 of this invention. It is a figure for demonstrating the state and operation | movement of the security apparatus of Example 2 of this invention. It is a figure for showing a prior art.

Embodiments of the present invention will be described below. In the security device of the embodiment of the present invention, one self-system oscillator, a measuring instrument that measures the output of the self-system oscillator, a measuring instrument that is included in the self-system that measures the output of another system oscillator, and the 2 Security equipped with a common system measuring instrument that measures the output of a reference oscillator that serves as a reference for comparing the results of two measuring instruments, and a control device with a dual system configuration that has two oscillators of the same configuration and two measuring instruments The apparatus compares the measurement result of the measuring instrument that measures the output of the local oscillator, the measurement result of the measuring instrument that is included in the local system that measures the output of the other oscillator, and the result of the two measuring instruments. Therefore, it is possible to detect the abnormality of the oscillator by comparing the measurement results of the common system measuring instrument that measures the output of the reference oscillator as a reference, and to measure the output of two or more other oscillators Two or more separate measuring instruments in the inside And a control device of a multi-system configuration having a multi-system measuring instrument, and a measurement result of a measuring instrument that measures the output of the self-system oscillator and a self-system that measures all system oscillator outputs other than the self-system by comparing the instrument measurement results with the inside, it is preferable to allow the oscillator failure detection. According to the present embodiment, even in a security device equipped with a control device having a multiple system configuration of triple system or more, it becomes possible to determine which system's oscillator has become abnormal after detecting the abnormality of the oscillator. .

  Further, in the embodiment of the present invention, the own system and other system clock signal changeover switch connected to the own system oscillator, and the own system and other system clock signal changeover switch connected to the other system oscillator are provided. It is desirable to control which clock signal changeover switch of the corresponding system by judging which system of the oscillator has become abnormal. According to the present embodiment, it is possible to perform switching control of the oscillator of the system in which the oscillator becomes abnormal by the own clock signal selector switch and the other clock signal selector switch.

  In addition, according to the embodiment of the present invention, after detecting abnormal oscillation, it is determined which system oscillator is abnormal, and the abnormal oscillator is disconnected from the control device, and oscillated from the normal oscillator. Since supply is possible, it is possible to ensure safety when the oscillator is abnormal.

  Hereinafter, a security device according to a first embodiment of the present invention will be described with reference to FIGS. The definition of the “security device” of the present invention has the configuration shown in FIG.

  FIG. 1 shows an outline of a security device according to Embodiment 1 of the present invention. In FIG. 1, the output of the A-system oscillator 1 is connected to an A-system clock switch 2 and a B-system clock switch 17. The A system clock signal 9 from the A system oscillator 1 through the A system clock changeover switch 2 is connected to the A system CPU 3, the A system side A system measuring instrument 5, and the B system side A system measuring instrument 20. Is done.

  Similarly, the output of the B system oscillator 16 is also connected to the A system clock switch 2 and the B system clock switch 17, respectively. The B system clock signal 24 from the B system oscillator 16 via the B system clock changeover switch 17 is connected to the B system CPU 18, the B system side B system measuring instrument 21, and the A system side B system measuring instrument 6. Is done. In addition to these, as a common system that does not belong to the A system and the B system, a common system oscillator 31 is prepared, and the output of each system is a common system measuring instrument 4 on the A system side, and a common system measurement on the B system side. Connected to the device 19.

  In the comparison / status display 7 of the A system, the measurement result of the A system measuring instrument 5 on the A system side, the measurement result of the B system measuring instrument 6 on the A system side, and the measurement result of the common system measuring instrument 4 on the A system side. Are determined to determine which system's oscillator is abnormal, and the status signal 14 of the A system is reported to the CPU 3 of the A system. At the same time, it can also serve as a switching control signal for the A-system clock selector switch 2.

  Further, since the A system comparison / status display 7 can also monitor the B system status, the A system error signal 15 is used to constantly transmit the status to the B system side. Also, from the B system side having the same configuration, the status of the B system is constantly monitored as the B system error signal 30 and is set as one of the statuses.

  In the above description, the measurement result of the A-system measuring instrument 5 on the A-system side, the measurement result of the B-system measuring instrument 6 on the A-system side, and the measurement result of the common-system measuring instrument 4 on the A-system side are compared with the hardware. However, the A-system CPU 3 to the A-system measuring instrument 5 on the A-system side, the B-system measuring instrument 6 on the A-system side, and the common-system measuring instrument 4 on the A-system side, By making the CPU access signal 10 referable, it is possible to determine by software.

  Next, the states and operations of the A-system clock selector switch 2 and the B-system clock selector switch 17 will be described. The states of the A-system clock selector switch 2 and the B-system clock selector switch 17 are in the following four cases depending on the states of the A-system oscillator 1, the B-system oscillator 16, and the common-system oscillator 31. Can be considered. Cases other than the following are considered as double abnormalities (two or more abnormalities), and are therefore not subject to abnormality detection.

(1) All-system oscillator normal (2) A-system oscillator abnormality (3) B-system oscillator abnormality (4) Common-system oscillator abnormality

(1) Normal state of all system oscillators When the A system oscillator 1, the B system oscillator 16, and the common system oscillator 31 are all normal, the measurement is performed by the A system measuring instrument 5 on the A system side, which is measured on the A system side. The result, the measurement result of the B system measuring instrument 6 on the A system side, and the measurement result of the common system measuring instrument 4 on the A system side are all the same. Similarly, the measurement result of the B-system measuring device 21 on the B-system side measured on the B-system side, the measurement result of the A-system measuring device 20 on the B-system side, and the measurement result of the common-system measuring device 19 on the B-system side. These three measurement results are all the same.

  Therefore, the A-system clock selector switch 2 and the B-system clock selector switch 17 are in the state shown in FIG.

(2) About A System Oscillator Abnormal State When the A system oscillator 1 becomes abnormal, the measurement result of the A system side B system measuring instrument 6 measured on the A system side and the A system side common system measuring instrument 4 The measurement results are the same, but are different from the measurement results of the A-system measuring instrument 5 on the A-system side. Therefore, the comparison / status display 7 determines that the A-system oscillator 1 is abnormal, reports the abnormality to the A-system CPU 3 as the A-system status signal 14, and switches the A-system clock selector switch 2. Control is performed. Also, an error is reported to the B system using the A system error signal 15.

On the other hand, on the B system side, the measurement result of the B system measuring instrument 21 on the B system side measured on the B system side is the same as the measurement result of the common system measuring instrument 19 on the B system side. This is different from the measurement result of the measuring instrument 20. Therefore, although the comparison / status display 22 determines that the A-system oscillator 1 is abnormal, since it is not its own oscillator, it reports an abnormality to the B-system CPU 18 and switches the B-system clock selector switch 17. There is no control. In the comparison / status display 22, the B system reports an error as the B system error signal 30. The state of this switch is shown in FIG.

(3) B-System Oscillator Abnormality State When the B-system oscillator 16 becomes abnormal, the measurement result of the A-system measuring instrument 5 on the A-system side measured on the A-system side and the common-system measuring instrument 4 on the A-system side The measurement results are the same, but are different from the measurement results of the B-system measuring instrument 6 on the A-system side. Therefore, in Comparative / status display 7, the oscillator 1 6 B system is determined to be abnormal, not a oscillator of the own system, the abnormality report to CPU3 of system A, and, the A-system clock selector switch 2 No switching control is performed. In the comparison / status display 7, the B system reports an error as the B system error signal 30.

On the B system side, the measurement result of the A system measuring instrument 20 on the B system side measured on the B system side is the same as the measurement result of the common system measuring instrument 19 on the B system side, but the B system measuring instrument 21 on the B system side. This is different from the measurement result. Therefore, the comparison / status display 22 determines that the B-system oscillator 16 is abnormal, reports the abnormality to the B-system CPU 18 as the B-system status signal 29, and controls the switching of the B-system clock selector switch 17. Is done. Also, an error is reported to the A system using the B system error signal 30. The state of this switch is shown in FIG.

(4) State of common system oscillator abnormality When the common system oscillator 31 becomes abnormal, the measurement result of the A system measuring instrument 5 on the A system side measured on the A system side and the B system measuring instrument 6 on the A system side The measurement results are the same, but are different from the measurement results of the common system measuring instrument 4 on the A system side. Therefore, the comparison / status display 7 determines that the common oscillator 31 is abnormal. However, since it is not its own oscillator, the abnormality report to the A-system CPU 3 and the A-system clock switch 2 Switching control is not performed.

Similarly, on the B system side, the measurement result of the A system measuring instrument 20 on the B system side measured on the B system side is the same as the measurement result of the B system measuring instrument 21 on the B system side. This is different from the measurement result of the system measuring instrument 19. Therefore, although the comparison / status display 22 determines that the B-system oscillator 16 is abnormal, since it is not its own oscillator, it reports an abnormality to the B-system CPU 18 and the B-system clock selector switch 17. Switching control is not performed. The state of this switch is shown in FIG.

  In this case, the mutual monitoring by the A system comparison / status display 7 and the B system comparison / status display 22 does not result in an error.

  Hereinafter, the security device according to the second embodiment of the present invention will be described with reference to FIGS. The basic configuration and basic idea of the invention are the same as those in FIG.

  In FIG. 6, the 1-system clock signal 41 that is the output of the 1-system oscillator 34 is connected to the 1-system clock switch 35, the 2-system clock switch 50, and the 3-system clock switch 65. . The initial state of each switch (state without abnormality) is the state shown in FIG. 6 because the output of its own oscillator 34, 49, 64 is used as the clock supply source.

  The 1-system clock signal 42 from the 1-system oscillator 34 via the 1-system clock changeover switch 35 is sent to the 1-system CPU 36, the 1-system side 1-system counter 37, the 2-system-side 1-system counter 52, and the 3-system side. 1 system counter 67. Similarly, the 2 system clock signal 57 from the 2 system oscillator 49 via the 2 system clock changeover switch 50 is supplied to the 2 system CPU 51, the 1 system side 2 system counter 38, the 2 system system 2 system counter 53, The 3 system clock signal 72 connected to the 3 system side 2 system counter 68 via the 3 system oscillator 64 from the 3 system oscillator 64 via the 3 system clock changeover switch 65 is connected to the 3 system CPU 66, the 1 system side 3 system counter 39, It is connected to the 3 system counter 54 on the 2 system side and the 3 system counter 69 on the 3 system side.

  In the 1-system status 40, the 1-system side 1-system counter status signal 44, which is the output count value of the 1-system oscillator 34 counted by the 1-system side 1-system counter 37, is counted by the 1-system side 2-system counter 38. 1 system side 2 system counter status signal 45 which is the output count value of the 2 system oscillator 49 and the 1 system system which is the output count value of the 3 system oscillator 64 counted by the 3 system counter 39 on the 1 system side Each side 3 system counter status signal 46 is compared.

  In this embodiment, the comparison is made by hardware, but the 1-system CPU 36 accesses the 1-system side 1-system counter 37, the 1-system side 2-system counter 38, and the 1-system side 3-system counter 39 respectively. By making it possible, it is also possible to compare the counter value by software.

  7 to 9 show the state of the clock signal changeover switch and the clock signal supply path when an abnormality occurs in the second embodiment.

  FIG. 7 shows the state of the 3 system clock signal changeover switch 65 when the 3 system oscillator 64 becomes abnormal and the clock supply method of the 3 system clock signal 72. FIG. 8 shows the state of the second system clock signal changeover switch 50 when the second system oscillator 49 becomes abnormal and the clock supply method of the second system clock signal 57. FIG. 9 shows the state of the 1-system clock signal changeover switch 35 when the 1-system oscillator 34 becomes abnormal and the clock supply method of the 1-system clock signal 42.

  If all of the first system oscillator 34, the second system oscillator 49, and the third system oscillator 64 are normal, the first system side is the output count value of the first system oscillator 34 counted by the first system counter 1 1 system counter status signal 44, 1 system side 2 system counter status signal 45 which is the output count value of 2 system oscillator 49 counted by 1 system side 2 system counter 38, and 1 system side 3 system Since the comparison results of the 3-system counter status signal 46 on the 1-system side, which is the output count value of the 3-system oscillator 64 counted by the counter 39, all match, the 1-system status 40 determines that all the oscillators are normal. To do.

If the count value of any of the systems is different from the other two systems, the comparison results are inconsistent and the status 40 of the first system is determined to be abnormal. When it is determined that the system 1 status 40 is abnormal, the system 1 status 40 reports an abnormality to the system 1 CPU 36 using the system 1 status signal 47. Simultaneously with this abnormality report, the 1-system clock signal switch 35 is controlled by the 1-system clock switch control signal 48, but the 1-system oscillator 34, the 2-system oscillator 49, and the 3-system oscillator 64 are controlled. The switching method of the system 1 clock changeover switch 35 differs depending on the system oscillator that becomes abnormal.

  For example, when an abnormality is detected by the system 1 oscillator 34, the circuit is disconnected from the output of the system 1 oscillator 34 by the system 1 clock changeover switch, and a clock signal is supplied from the system 2 oscillator 49. This state is shown in FIG.

  In the second embodiment, the clock supply is performed from the second-system oscillator 49, but supply from the third-system oscillator 64 may be used as long as there is no abnormality in the system. When an abnormality is detected by the second-system oscillator 49 or the third-system oscillator 64, the abnormality of the oscillator is detected, but since it is not the own-system oscillator, the switching control of the first-system clock switch 35 is not performed.

  The operation of the clock switch in system 1 has been described above, but the same operation is performed for system 2 and system 3. For example, when an abnormality is detected by the 2 system oscillator 49, the circuit is disconnected from the output of the 2 system oscillator 49 by the 2 system clock changeover switch 50, and the clock signal is supplied from the 3 system oscillator 64. This state is shown in FIG.

  In the second embodiment, the clock is supplied from the three-system oscillator 64, but supply from the first-system oscillator 34 may be used as long as there is no abnormality in the system. When an abnormality is detected by the first-system oscillator 34 or the third-system oscillator 64, the abnormality of the oscillator is detected, but since it is not the own-system oscillator, the switching control of the second-system clock selector switch 50 is not performed.

  The same operation is performed when an abnormality is detected by the three-system oscillator 64. This state is shown in FIG.

  Further, the 1-system status 40, the 2-system status 55, and the 3-system status 70 each have a configuration in which the own system status display and the own system status are transmitted to another system. As a result, an information exchange path is established by connecting the 1/2 system interconnection 79, the 2/3 system interconnection 80, and the 3/1 system interconnection 81. Monitoring becomes possible. Thereby, it is possible to grasp the abnormal state between systems.

  In addition, this invention is not limited to an above-described Example, Various modifications are included. For example, the above-described embodiments have been described in detail for easy understanding of the present invention, and are not necessarily limited to those having all the configurations described.

  Further, a part of the configuration of one embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of one embodiment. Further, it is possible to add, delete, and replace other configurations for a part of the configuration of each embodiment.

  In addition, each of the above-described configurations, functions, processing units, processing procedures, and the like may be realized in hardware by designing some or all of them, for example, with an integrated circuit. Each of the above-described configurations, functions, and the like may be realized by software by interpreting and executing a program that realizes each function by the processor. Information such as programs, tables, and files for realizing each function can be stored in a memory, a hard disk, a storage device such as an SSD (Solid State Drive), or a recording medium such as an IC card, an SD card, or a DVD.

  Further, the control lines and information lines indicate what is considered necessary for the explanation, and do not necessarily indicate all the control lines and information lines provided in the product. Actually, it may be considered that almost all the components are connected to each other.

1 A-system oscillator 2 A-system clock selector switch 3 A-system CPU
4 A system side common system measuring instrument 5 A system side A system measuring instrument 6 A system side B system measuring instrument 7 A system comparison / status display 8 A system clock signal 9 A system clock signal 10 A system CPU access signal 11 A system side common system instrument measurement result signal 12 A system side A system instrument measurement result signal 13 A system side B system instrument measurement result signal 14 A system status signal 15 A system status signal 15 Error signal 16 B system oscillator 17 B system clock switch 18 B system CPU
19 B system side common system measuring instrument 20 B system side A system measuring instrument 21 B system side B system measuring instrument 22 B system comparison / status display 23 B system clock signal 24 B system clock signal 25 B system CPU access signal 26 B system side common system instrument measurement result signal 27 B system side A system instrument measurement result signal 28 B system side B system instrument measurement result signal 29 B system status signal 30 B system status signal 30 Error signal 31 Common system oscillator 32 Common system clock signal 34 1 system oscillator 35 1 system clock switch 36 1 system CPU
37 1 system side 1 system counter 38 1 system side 2 system counter 39 1 system side 3 system counter 40 1 system status 41 1 system clock signal 42 1 system clock signal 43 1 system CPU access signal 44 1 1 system counter status signal 45 1 system 2 system counter status signal 46 1 system 3 system counter status signal 47 1 system status signal 48 1 system clock switch control signal 49 2 system oscillator 50 2 System clock changeover switch 51 2 system CPU
52 2 system side 1 system counter 53 2 system side 2 system counter 54 2 system side 3 system counter 55 2 system status 56 2 system clock signal 57 2 system clock signal 58 2 system CPU access signal 59 2 1 system counter status signal on system side 60 2 system counter status signal on system 2 side 61 3 system counter status signal on system 2 side 62 status signal on system 2 63 2 system clock changeover switch control signal 64 3 system oscillator 65 3 System clock selector switch 66 3 system CPU
67 System 3 side 1 system counter 68 System 3 side 2 system counter 69 System 3 side 3 system counter 70 System 3 status 71 System 3 clock signal 72 System 3 clock signal 73 System 3 CPU access signal 74 3 1 system counter status signal on system side 75 2 system counter status signal on 3 system side 76 3 system counter status signal on 3 system side 77 3 system status signal 78 3 system clock switch control signal 79 1/2 system system Mutual monitoring signal between systems 80 Mutual monitoring signal between systems of 2/3 system 81 Mutual monitoring signal between systems of 3/1 system

Claims (3)

A reference for comparing the results of the two measuring instruments, one measuring oscillator for measuring the output of the own oscillator, a measuring instrument in the own system for measuring the output of the other oscillator, A safety device having a dual system configuration control device having a common system measuring instrument that measures the output of the reference oscillator, and having two systems of the same configuration oscillator and measuring instrument,
A reference standard for comparing the measurement result of the measuring instrument that measures the output of the local oscillator, the measurement result of the measuring instrument in the local system that measures the output of the other oscillator, and the result of the two measuring instruments A safety device characterized in that the abnormality of an oscillator can be detected by comparing the measurement results of a common measuring instrument that measures the output of the oscillator. 2. The security device according to claim 1, further comprising: a self-system and another system clock signal changeover switch connected to the own system oscillator; and a self system and other system clock signal changeover switch connected to the other system oscillator. A security device comprising: determining which system oscillator has become abnormal and performing switching control of a clock signal selector switch of the corresponding system . 2. The security device according to claim 1, wherein after detecting abnormal oscillation, it is determined which system oscillator is abnormal, and the abnormal oscillator is disconnected from the control device, and oscillation is supplied from the normal oscillator. A security device characterized by being made possible.

Images