JPH028938A - Duplex processor - Google Patents

Abstract

PURPOSE:To maintain the fail safe property held by each system when system switching is performed and at the same time, to secure the continuity of the process as long as possible by providing collating means which collate the output content of another system with that of its own system and an initializing means which initializes the systems when monitoring signals are inputted. CONSTITUTION:The 1st system 1A which is a main system is constituted of output interfaces 1A1 and 1A3 and an arithmetic processing section 1A2 and when the output content of the system 1A does not coincide with that of the 2nd system 1B having the same constitution as that of the system 1A at the time of the occurrence of abnormality, a disagreement signal is outputted from collating means 1A4 and 1B4 to initializing means 1A5 and 1B5 and a fault detecting signal is outputted from a processing section 1A2 to a duplux system management device 1C. Upon receiving the fault detecting signal, the device 1C outputs a monitoring signal Bi to the initializing means 1B5 and the means 1B5 outputs an initializing signal Br to the processing section 1B2. Simultaneously, the means 1B5 outputs a switching signal Cb to a switching circuit 1D and a device 1E to be controlled is switched and connected to the output circuit 1B3 of the 2nd system 1B. Thus the fail safe property held by each system can be maintained and the continuity of the process can be secured as long as possible at the time of system switching.

Description

DETAILED DESCRIPTION OF THE INVENTION [Industrial Application Field] The present invention relates to a standby dual system processing device for outputting processing results to a control device where safety is particularly required.

[Prior Art] A conventional standby dual system processing device, as shown in Fig. 3,
Input interface 2At, i calculation processing unit 2A2. A first system 2A consisting of an output interface 2A3, and an input interface 2B1. Arithmetic processing unit 2B2. Input information D common to the second system 2B consisting of the output interface 2B3
i, the dual system management device 2C monitors the diagnosis results by the self-diagnosis function of the arithmetic processing units 2Az and 2Bz of each prefecture, and if no fault signal is input from the first system, the switching circuit 2
A switching command Ca is given to D to connect the output interface 2A3 of the first system to the controlled device 2E (that is, to make the first system the main system), and the processing result DO of the first system 2A is transferred to the controlled device 2E. output to the dual system management device 2.
When C inputs a failure signal from the first system, switching circuit 2
A switching command cb is given to D to connect the output interface 2B3 of the second system 2B to the control device 2E, that is, the system is switched from the second system which was a slave system to the main system, and the second system The processing result DO of 2B is output to the controlled device 2E.

Then, the dual system management device 2C inputs the storage status of the main system and transfers it to the processing unit of the slave system periodically or when the n-report changes, and becomes the main system. The transferred information is used in the secondary system to continue processing subsequent input information, thereby ensuring continuity of processing at the time of system switching.

[Disadvantages of the prior art] By the way, when a dual system processing device is applied to a control device that requires high safety, such as railway signal control or railroad crossing control, it is necessary to ensure continuity of processing when switching systems, as well as to maintain continuity in the event of a failure. Since fail-safe performance that is maintained on the safe side is required, it is not possible to adopt the conventional method of simply transferring the storage state of the main system to the slave system at the time of system switching.

In other words, even if each prefecture has its own fail-safe properties and its output is on the safe side, there is no logic in the process of simply copying (transferring) the memory state from the master to the slave. , fail-safety is not guaranteed.

Therefore, when applying a conventional dual-system processing device to a control device that requires safety, it is important to check whether the transfer of the storage state of the main system to the slave system at the time of system switching was performed in a fail-safe manner. Since it is necessary to check this, it is necessary to add a logical operation section to the dual system management device. Therefore, it is necessary to add hardware and develop software for checking, which increases costs and makes it difficult to actually Moreover, it is difficult to implement.

Therefore, when using a conventional dual-system processing device as a control device that requires safety, safety is given a higher priority than processing continuity by initializing the main system when switching systems. Therefore, the continuity of processing is given up.

However, since the main system is always initialized when switching systems, the entire system stops functioning at that moment. Train operations may be disrupted due to abnormal operations such as the shut-off 1uIF device momentarily closing and then opening again.
There was a risk of interfering with level crossing control.

[Technical problem to be solved] Taking the above points into account, the present invention checks whether continuous processing is possible at the time of system switching by simply adding 11 simple configurations to each prefecture, and confirms that it is possible. If confirmed, the processing results of the main system after switching are output as they are, and if it is confirmed that continuous processing is not possible, the main system after switching is initialized. The aim is to maintain the fail-safe nature of the system and ensure as much continuity of processing as possible.

[Means for Solving the Problems] The standby dual system processing device according to the present invention is provided in each prefecture with (a) collation means for comparing the output contents of the other system and the output contents of the own system; and (b) and initialization means for initializing the own system when a discrepancy signal is input from the own system's verification means and a monitoring signal output by the dual system management device is input when a failure occurs in the main system. Features.

[Operation] The dual system management device uses the first system as the main system as long as it is normal, connects the first system to the controlled device, and outputs the processing results to the controlled device.

When the self-diagnosis function of the first system detects a failure and outputs a failure signal to the dual system management device, the dual system management device gives a supervisory signal to the initialization means of the second system, and at that time the second system It is checked whether the verification means of the system is outputting a mismatch signal, and a switching command is given to the switching circuit to connect the second system to the device to be controlled.

The second-system collation means collates the output content of its own system with the output content immediately before the failure occurs, which is given from the first-system arithmetic processing unit. If the matching result is a match, the matching means does not input the mismatch signal to the initializing means of the first system, so the initialization conditions of the initializing means are not satisfied, so the second system uses the processing results up to that point. , continue processing the information that will be input from then on, and output the processing results.

On the other hand, if the matching results do not match, the second system matching means inputs a mismatch signal to the white thread initialization means. As a result, the initializing means satisfies the initializing conditions and supplies the initializing signal to the arithmetic processing section of its own system, so that the second system is initialized. Therefore, the second system, which has been designated as the main system, starts processing the information that will be input from now on, and outputs the results to the controlled device.

If a failure occurs in the second system that was operating as the main system, the dual system management device gives a supervisory signal to the initialization means of the second system, and also gives a switching signal to the switching circuit to switch the second system on. Connect to the controlled device. The collation means and initialization means of the second system operate in the same manner as described above.

Embodiments of the Invention Next, embodiments of the invention will be described based on the drawing of FIG.

The standby dual system processing device according to the present invention has input interfaces IA1. Performance processing unit IA2. A first system IA consisting of an output interface IA3 and an input interface IB
z calculation processing unit IB2. Common input information Di is given to the second system IB consisting of the output interface IB3, and the dual system management device IC is used to control the calculation processing units IAz, I of each prefecture.
Monitor the diagnosis result by the self-diagnosis function of Bz, and if no failure signal is input from the -system, give the switching command Ca to the switching circuit ID to connect the output interface IA3 of the -system to the controlled device IE. Processing result of system D
o to the controlled device IE, and when the dual system management device IC receives a failure signal from the second system, connect the output interface B3 of the second system B to the switching circuit ID and the second system B to the controlled device IE. There is no difference from the conventional method in that system switching is performed by giving a switching command cb for switching, and the processing results of the second system B are output to the controlled device IE.

In the dual system processing device according to this invention, each prefecture IA,
1B arithmetic processing unit IA2. IB2 includes collation means IAa and IBa for collating the output content of the arithmetic processing unit of the other system and the output content of the arithmetic processing unit of the own system, and the collation means I of the own system.
Initialization means IAsIB is provided, which initializes the own system when inputting the monitoring signals At and Bi output by the dual system management device IC when a failure occurs in the other system when Aa, IBa or a mismatch signal is output. ing.

The data to be verified by the verification means IAa and IB4 varies depending on the application of the processing device, such as a single signal such as ON and OFF, or data composed of multiple bits, and the configuration of the verification means also varies. , depending on these, and is output as "1" only when the verification result is a mismatch.

Initialization means IA5. The IBS consists of an AND gate, and when a monitoring signal indicating that another system has failed is input from the dual system management device while the verification means is outputting a mismatch signal, the initialization condition is satisfied. and gives an initialization signal to the arithmetic processing section of its own system.

The effect of the above configuration will be explained based on the time chart of FIG. 2.

Assuming that the first system IA and the second system IB, both of which are normal, are powered on and started in this order with a time difference to, even if the same information D1 is input to both systems, processing will not be completed for a certain period of time t1 after startup. Since the results do not match, the output contents of each prefecture are in a state of mismatch until the time point Ta.

However, if there is no failure in each prefecture, the dual system management device IC sends supervisory signals Ai and B to the initialization means of either system.
Since i is not output, each prefecture's arithmetic processing unit I A2
, IB2 continues processing the input information D1 without being initialized. And information is relatively discrete,
Since input is performed sparsely, at time Ta, the second system whose rise is delayed also outputs the same processing result, so as long as both systems are normal, the output content will match, and from now on input = +W report D2. Since the processing results for D3... usually match, the collation means IAa and IBa do not output them.

Also, the reception processing speed of the input interface IA1.1B1 of each system and the arithmetic processing unit IA2. I
Based on the difference in the processing speed of B2, there will be a shift in the output timing of the processing result corresponding to the newly input information. At this point in time, the output contents of the two systems may momentarily become inconsistent, but eventually match. However, in this case as well, since each prefecture is normal, the initialization means tAs,
IBs are not output.

If an abnormality occurs in the second system, which is currently the main system, at time Td, and the output content does not match the output content of the second system, the matching means IAa and IB4 send a discrepancy signal. It is output to the initialization means IAS and IB5. Since the arithmetic processing units IAz, , and IB2 in each prefecture perform self-diagnosis, the arithmetic processing unit IA2 provides a failure detection signal to the dual system management device IC when an abnormality occurs in its own system. Therefore, the dual system management device IC outputs the monitoring signal Bi to the initialization means IB of the second system, so that the initialization means IB, which has already input the mismatch signal, is satisfied with the initialization condition and starts automatically. An initialization signal Br is given to the arithmetic processing unit IB2 of the system. In addition, the dual system management device IC gives a switching signal cb to the switching circuit ID based on the failure detection signal from the second system, and connects the output circuit IA3 of the second system to the controlled device IE until then. The output circuit IB3 of the second system is connected to the controlled device IE, and the second system is made the main system. Therefore, the second system starts processing based on the information to be inputted from now on, and outputs the processing result to the controlled device IE via the output circuit IB3 and the switching circuit ID.

When the monitoring signal Bi is input to the initialization means IBs of the second system based on a failure of the second system, if the output contents of the two systems match, the verification means IB4 does not output, so the initialization means Since tB does not give an initialization signal to the arithmetic processing unit IB2, the arithmetic processing unit continues processing using the processing results up to that point and the information to be input thereafter, and outputs the processing results to the controlled device IE. .

Even if a failure occurs in the second system while it is operating as the main system, the verification means IA4 and the initialization means IA
5 is activated and the supervisory signal At is input from the dual system management device IC to the initialization means IA5, if the dual output contents match, the main system continues processing while the second system continues. If the double output contents do not match, the -th system arithmetic processing unit IA2 is initialized and becomes the main system.

[Effects of the Invention] As described above, in the dual system processing device according to the present invention, each prefecture has a verification means for verifying the storage state of the other system and the output content of the own system, and a verification means for the own system. It has a simple configuration because it is equipped with an initialization means that outputs a mismatch signal and initializes its own system when the monitoring signal output by the dual system management device is input when a failure occurs in another system. By adding it, it is possible to judge whether continuous processing is possible when switching systems, and if the verification result is a match, the main system processing after switching is continued, and if there is a mismatch, the main system is initialized. Fail-safe output is always ensured, and processing continuity is ensured to the maximum extent possible.

Such a dual system processing device is used for controlling railway signal safety equipment, etc.

[Brief explanation of the drawing]

FIG. 1 is a block diagram schematically showing the configuration of a dual system processing device according to the present invention, and FIG. 2 is a time chart explaining the operation. FIG. 3 is a block diagram schematically showing the configuration of a conventional dual system processing device. 1A...First system, iAl...Human interface, IA2...Arithmetic processing unit, IA3...Output interface, IA4...Verification means, IAS...Initialization means, 1B... -Second system, 1B1...Input interface, IE2...Arithmetic processing unit, 1B3...Output interface, IBa...Verification means, 1B! I...Initialization means, IC...Dual system management device, Ai, Bi...Monitoring signal, Ar, Br...Initialization signal, ID...Switching circuit, IE...Controlled object Device. J"'-1-

Claims (1)

[Scope of Claims] Each system has: (a) a collation means for collating the output content of the other system with the output content of the own system; (b) a discrepancy signal is input from the collation means of the own system, and
A dual system processing device comprising: initialization means for initializing its own system when a monitoring signal input from a dual system management device is input when a failure occurs in the other system.