JPH01312602A - Fault time control system - Google Patents

Abstract

PURPOSE:To prevent a system under the control of a CPU from being adversely influenced even if an abnormality occurs in CPU itself by switching the system from an automatic control mode to a manual control mode by means of a CPU abnormality detection signal. CONSTITUTION:When a fault time control signal generation part 4 is in the automatic control mode, the fault time control signal is usually outputted to a controlled system 1 under the control of a CPU control circuit 2. When the abnormality of the CPU control circuit is detected by a CPU abnormality supervisory part 3, the fault time control signal generation part 4 is switched from the automatic control mode to the manual control mode by the CPU abnormality detection signal which the abnormality supervisory part 3 outputs. Thus, the fault time control signal is prevented from being transmitted to the controlled system 1 due to the control of the abnormal CPU, and therefore the system under the control of the CPU is prevented from being adversely influenced even if the abnormality occurs in the CPU itself.

Description

[Detailed Description of the Invention] [Summary] Regarding a failure control system that performs automatic control in response to a failure in a controlled system by controlling a CPU, the system under control of the CPU can be automatically controlled even if an abnormality occurs in the CPU itself. The purpose is to prevent any negative effects from occurring, and when a failure occurs in the controlled system, the CPU outputs an automatic control signal corresponding to the failure under the control of the CPU.
a U control circuit; a CPU abnormality monitoring unit that detects the occurrence of an abnormality in the CPU and outputs a CPU abnormality detection signal;
In automatic control mode, a failure control signal is output to the controlled system according to the automatic control signal, and in manual control mode, a failure control signal is output to the controlled system by manual control, The automatic control and manual control modes can be switched manually, and
The apparatus is configured to include a failure control signal generating section that is switched from the automatic control mode to the manual control mode in response to the CPU abnormality detection signal.

[Industrial application field]

The present invention relates to a failure control system that automatically controls a controlled system in response to a failure by controlling a CPU.

In a system that performs automatic control in response to a failure by controlling the CPU, when an abnormality such as a runaway occurs in the Bcpu itself, there is a risk that the runaway CPU will perform abnormal control.

Therefore, there has been a need for a technology that prevents a controlled system from being affected by a runaway CPU.

[Prior art and problems to be solved by the invention]

For example, in transmission terminal equipment, etc., which has a backup device in addition to the current device, when a fault occurs in the current device, it is controlled by a microprocessor (CPU). Some control switching to devices. In such a system, if an abnormality occurs in the microprocessor (CPU), depending on the abnormal state of the CPU, incorrect control may be performed even though no failure has actually occurred in the current device. This may result in switching from the active device to the standby device.

As in the example above, microprocessors (CP
In a system that performs control in response to the occurrence of a failure by control using a microprocessor (CP
U) If an abnormality occurs in the CPU itself, the system under control of the CPU will be greatly confused by its effects.

Therefore, in a system under the control of a CPU, it is necessary to avoid the effects of an abnormality occurring in the CPU itself.

The present invention has been made in view of the above problems.
It is an object of the present invention to provide a failure control system that prevents a system under control of a CPU from being adversely affected even if an abnormality occurs in the system itself.

[Means to solve the problem]

FIG. 1 is a basic configuration diagram of the present invention. In this figure, ■
2 is a controlled system, 2 is a CPU control circuit, 3 is a CPU abnormality monitoring section, and 4 is a failure control signal generation section.

The controlled system 1 is a system that, when a fault occurs in the system, receives control from another device in response to the fault.

When a fault occurs in the controlled system 1, the CPU control circuit 2 outputs an automatic control signal corresponding to the fault under the control of the CPU.

The CPU abnormality monitoring unit 3 detects the occurrence of an abnormality in the CPU and outputs a CPU abnormality detection signal.

The failure control signal generation unit 4 is configured to be switched between two control modes, an automatic control mode and a manual control mode, and in the automatic control mode, the failure control signal generating unit 4 is configured to control the controlled system 1 according to the automatic control signal. A control signal is output, and in the manual control mode, a failure control signal is output to the controlled system 1 by manual control. The automatic control mode and the manual control mode can be switched manually in both directions, and the automatic control mode is switched to the manual control mode by the CPU abnormality detection signal.

[For production]

When the fault control signal generator 4 is in the manual control mode, the fault control signal output to the controlled system 1 is c.
rt[J is performed only by manual control, regardless of the operation of the control circuit 2.

When the fault control signal generation unit 4 is in the automatic control mode, the fault control signal output to the controlled system l is as follows.
Normally, this is done under the control of the CPU control circuit 2, but
If the CPU abnormality monitoring unit 3 detects that the CPU control circuit 2
When an abnormality is detected, the failure control signal generating section 4 is switched from the automatic control mode to the manual control mode by the CPU abnormality detection signal output from the CPU abnormality monitoring section 3.

Therefore, for the controlled system l, an abnormal CP
A failure control signal under the control of U will no longer be sent.

〔Example〕

FIG. 2 is a configuration diagram of an embodiment of the present invention, in which when a failure occurs in the active device of the transmission terminal equipment, the active device is switched to the standby device under the control of the CPU. This figure shows the configuration of a redundant switching system for a terminal device.

In FIG. 2, 11 is the active device, 12 is the backup device, and 2
0 is a control circuit, 21 is a CPU, 30 is a CPU runaway monitoring circuit, 31 is a crawler circuit, 40 is a failure control signal generator, 41 is an automatic control switch, 42 is a manual control switch, and 43 is a mode switch. The switch 44 is an OR circuit, and 45 and 46 are working/standby changeover switches.

The active device 11 and the standby device 12 each have a configuration and function as a terminal device in a transmission system, and the active device 11 is normally used.

The control circuit 20 outputs an automatic control signal under the control of the CPU 21 to control the use of the standby device 12 in place of the active device 11 when some kind of failure occurs in the active device 11 .

The CPU runaway monitoring circuit 30 monitors abnormalities in the CPU 21 included in the control circuit 20, and when an abnormality is detected,
Outputs a CPU abnormality detection signal.

The latch circuit 31 receives the CPU from the CPU runaway monitoring circuit 30.
When the U abnormality detection signal is output, it is latched, and its output is applied to one input terminal of the OR circuit 44 in the failure control signal generation section 40. In the configuration shown in FIG. 2, the effective output of the CPU abnormality detection signal is “
1” level. Also, the launch circuit 3
1, after latching the CPU abnormality detection signal,
This state is maintained until the CPU 21 is reset.

The failure control signal generation unit 40 realizes the function of the failure control signal generation unit shown in FIG.
3 and an OR circuit 44. The output of the failure control signal generator 40 is applied to the control input terminals of the active/standby changeover switches 45 and 46, and the automatic control switch 41 and manual control switch 42 each receive the output through the mode changeover switch 43. They are connected in parallel to each other so as to switch connection/disconnection between the level and the ground level.

The automatic control switch 41 is controlled by an automatic control signal from the control circuit 20, and is closed when the automatic control signal becomes valid. Further, the manual control switch 42 is switched by manual control.

When the contact of the mode changeover switch 43 is connected to the automatic control switch 41 side, the control circuit 20
When the automatic control switch 41 is closed under the control of the automatic control signal from The state in which the active device 11 is used is controlled to be switched to the state in which the standby device 12 is used. That is, automatic control by the control circuit 20 is performed.

When the contact point of the mode changeover switch 43 is connected to the manual control switch 42 side, the output of the failure control signal generating section 40 is set to the ground level only when the manual control switch 42 is closed by manual control. Then, the active/standby changeover switches 45 and 46 are controlled together to switch from the state in which the current device 11 is used to the state in which the standby device 12 is used. That is, manual control is performed.

The mode changeover switch 43 is switched by the output of the OR circuit 44. The contact of the mode changeover switch 43 indicates that the output of the OR circuit 44 is valid (“1” level).
When , it is connected to the manual control switch 42 side,
When the output of the OR circuit 44 is invalid (“0” level), it is connected to the automatic control switch 41 side.

As described above, the output of the latch circuit 31 is applied to one of the two input terminals of the OR circuit 440, and a manual switching signal input from a manual switch (not shown) is applied to the other input terminal. Here, the manual switching signal “
The 1'' level corresponds to manual control mode and the '0'' level corresponds to automatic control mode.

In this way, the output of the OR circuit 44 is output when the manual switching signal is switched to the "L" level corresponding to the manual control mode, or when the output from the latch circuit 31 is output from the valid CPU.
It becomes valid when the abnormality detection signal is output, and switches the mode changeover switch 43 to the manual control switch 42 side, that is, sets the failure control signal generation section 40 to the manual control mode.

The operation of the system shown in FIG. 2 with the above configuration will be explained below.

First, in the manual control mode, if the operator closes the manual control switch 42, the failure control signal generator 4
The output of 0 becomes the ground level and controls both the working/standby changeover switches 45 and 46, thereby switching from the state in which the working device 11 is used to the state in which the standby device 12 is used.

Next, the normal automatic control mode, that is, the OR circuit 44
When the current device 11 is used with the manual switching signal applied to the "O" level, as long as the CPU 21 is normal, the output of the CPU runaway monitoring circuit 30, and therefore the output of the latch circuit 31, will be “0” level,
The output of the OR circuit 44 is at the 0" level. Therefore, the contact of the mode changeover switch 43 is connected to the automatic control switch 41 side, and when a fault is detected in the current device 11, the control circuit When the automatic control signal is output from 20, the automatic control switch 41 is closed, and the output of the failure control signal generating section 40 becomes the ground level, and the working/standby changeover switches 45 and 46 are controlled together. , the state in which the active device 11 is used is switched to the state in which the standby device 12 is used.

Here, in the above automatic control mode, if an abnormality occurs in the CPU 21 of the control circuit 20, the output of the CPU runaway monitoring circuit 30, and therefore the output of the latch circuit 31, becomes "1" level, and accordingly OR circuit 44
The output of is also at the "1" level. Therefore, the contact point of the mode changeover switch 43 is connected to the manual control switch 42 side, and the failure control signal generation section 40 is switched to the manual control mode. Therefore, after this, the abnormal C
Even if an automatic control signal is erroneously output from the control circuit 20 controlled by the PU 21, the output of the failure control signal generating section 40 will not reach the ground level in response to this erroneous automatic control signal.

〔Effect of the invention〕

According to the failure control system of the present invention, even if an abnormality occurs in the CPU itself, it is possible to prevent a system under the control of the CPU from being adversely affected.

[Brief explanation of the drawing]

FIG. 1 is a basic configuration diagram of the present invention, and FIG. 2 is a configuration diagram of an embodiment of the present invention. [Explanation of symbols] 1...Controlled system, 2...CPU control circuit,
3...CPU abnormality monitoring unit, 4.40...Failure control signal generation unit, 11...Active device, 12...Spare device, 20...Control circuit, 21...CPU, 30 ...CP runaway monitoring circuit, 31...Latch circuit, 41...Automatic control switch, 42...Manual control switch, 43...Mode changeover switch, 44...OR circuit, 45.46.・・Working/standby changeover switch. Basic configuration diagram of non-invention 1 Figure Fault detection signal Configuration diagram of an embodiment of the present invention

Claims (1)

[Claims] 1. When a failure occurs in the controlled system (1),
A CPU control circuit (2) that outputs an automatic control signal corresponding to the failure under the control of the CPU, and a CPU that detects the occurrence of an abnormality in the CPU and outputs a CPU abnormality detection signal.
U abnormality monitoring unit (3); in automatic control mode, outputs a failure control signal to the controlled system (1) according to the automatic control signal, and in manual control mode, outputs a failure control signal to the controlled system (1) by manual control; A fault control signal is output to the system (1), and the automatic control mode and manual control mode can be switched manually, and the automatic control mode can be switched to the manual control mode by the CPU abnormality detection signal. A failure control system comprising a failure control signal generation section (4).