JPH06348524A - Multiplexing controller - Google Patents

Abstract

PURPOSE:To provide a multiplexing controller which has high safety by detecting and securely disconnecting a faulty system and restarting the disconnected system without stopping control. CONSTITUTION:The multiplexing controller is a triple system consisting of identical computation controllers 1, 2, and 3, a controlled system 4, and a communication line for control data conversion which connects the respective computation controllers. A controller 10 overarching the arithmetic of the computation controller 1, a diagnostic device 11 which detects the control state of the controller 10, an output device 12 for control output data, an input device 13 for control input data, a control output switching device 14, a synchronous interruption controller 15 for the controller 10, a communication device 16 for control data switching, etc., are provided and an individual number discrimination device 17 for setting the individual number of the computation controller 1 and a switch 18 for causing a frequency signal to vary are newly provided as compared with a conventional multiplexing controller.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a multiplexing control device in which control devices are multiplexed in order to enhance the reliability and safety of a control system.

[0002]

2. Description of the Related Art Generally, multiplexing is performed in order to improve the reliability of a control device. For example, the correctness of the control state is verified by synchronizing a plurality of control computers, constantly checking the address buses and data buses of the computers, and making a majority decision. In the case of the triple system, even if one computer fails,
If the remaining two computers have no failure and match on the bus, it is considered that the validity of the data has been verified.

Further, in Japanese Patent Application Laid-Open No. 4-307633, a plurality of computers are connected by a data transmission line, control state diagnostic data are transmitted to each other, and the control state diagnostic data received from the other computers are self-contained. The control status diagnostic data of the computer is compared and collated by majority decision logic, and if it does not match the majority decision diagnostic data, it is judged that the control status diagnostic data of the own computer is incorrect, and the faulty abnormal computer is identified. There is. When the computer determined to be abnormal is the main system, its control output becomes the main system to which the other computer outputs the control output. However, the control output of an abnormal computer is cut off, but the function of exchanging control status diagnostic data with another normal computer remains.

[0004]

DISCLOSURE OF THE INVENTION Problems to be Solved by the Invention
In the multiplexing control device disclosed in Japanese Patent No. 633, three computers are used and one of the three computers outputs a control output as a main system to control a control target. The control state diagnostic data is exchanged between three computers, the correct control state diagnostic data is determined by the majority decision, and the normal / abnormal state of each computer is diagnosed by the correct control diagnostic data.

It is assumed here that an abnormality has occurred in one of the three computers. Detects a computer in which an abnormality has occurred due to the majority vote of three computers, and if the abnormal computer is the main system, remove it from the main system and output the control output from one of the two normal computers. It is selected as the main system and is in charge of control. However, the function for diagnosing the control state remains as described above, and if an abnormality occurs in another computer while the abnormal computer is not completely separated from the multiplexing system, two abnormal computers are A majority decision with one normal computer determines that a normal computer is abnormal and eliminates it. One of the two abnormal computers is selected as the main system and is in charge of control. In this way, if a double fault occurs in the triple system that monitors the control state of the computer by majority decision, it is the worst situation for safety that the abnormal computer controls.

Further, when the computer which has been disconnected due to the failure is started up, the system cannot be restored unless the normal system control is stopped.

As described above, it is not possible to use the system in which a high degree of safety is required only by detecting the faulty system by the majority vote of the computer and selectively controlling the main system. Therefore,
In order to realize a highly safe multiplexing control device
There is a demand for a technique for detecting a faulty system before a serious fault occurs and disconnecting the system from a diagnostic system based on a majority decision, and for restarting the system that has been disconnected without stopping control.

In view of the above problems, an object of the present invention is to detect a faulty system in a multiplex control device and disconnect it from a diagnostic system by majority decision, and to restart the disconnected system without stopping control. The purpose of the present invention is to provide a multiplex control device having a high degree of safety by carrying out.

[0009]

The above object is to provide a multiple control system for controlling an object to be controlled by one of a plurality of control devices and an abnormal control device of the plurality of control devices with inter-system diagnostic data. In the multiplex control device having the abnormal control device identification means for switching the control output to the controlled object in each control device, the abnormal control device identification means identifies an abnormal control device, This is achieved by providing each of the control devices with a separating means for changing the generation logic of the inter-system synchronization signal of the normal control device to disconnect the abnormal control device from the inter-system diagnosis system by the majority logic.

The above object is to identify a multiple control system for controlling a controlled object by one of the three control devices and an abnormal control device of the three control devices by the majority logic of inter-system diagnostic data. In a multiplex control device having in each control device abnormal control device identification means for switching the control output to the controlled object, when the abnormal control device identification means identifies an abnormal control device, a normal control device system This is achieved by providing each of the control devices with a separating means for changing the generation logic of the inter-sync signal and disconnecting the abnormal control device from the inter-system diagnostic system by the majority logic.

The above object is to provide each control device with means for detecting the restart and synchronizing the frequency of the output signal with the normal control device when the control device in which abnormality is detected is restarted after restoration. It is achieved by

[0012]

According to the above construction, when the majority data is not established by exchanging the diagnostic data among the plurality of control devices, an abnormality has occurred in one of the control devices. Therefore, the abnormal control device is identified by the majority logic. , The normal control devices work together to change the generation logic of the inter-system synchronization signal so as not to synchronize with the abnormal control device and disconnect the abnormal control device. In this way, by disconnecting the diagnostic system in addition to the control output system,
The abnormal controller is completely disconnected from the multiple system.

Regarding the restart of the failed system, it is detected that there is a system that has started up later by exchanging diagnostic data between a plurality of control devices, and the system that started up later and the normal system Both are incorporated into a multiple control system by synchronizing the frequency signals.

[0014]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will be described below with reference to the drawings.

FIG. 1 is a block diagram showing the overall configuration of a triple system control device according to an embodiment of the present invention. First, the configuration of this embodiment will be described.

In the figure, reference numerals 1, 2, and 3 are single calculation control devices, 4 is a control target controlled by the calculation control devices 1, 2, and 3, and 5 is a connection between the calculation control devices 1, 2, and 3. A communication line coupled to each other for exchanging data, 6 is a synchronous interrupt control line for performing synchronous interrupt control between the device systems between the calculation control devices 1, 2, 3 and 7 is a calculation control device 1, 2, 3 and a control target 4 A control input / output line for coupling with
It is a system configuration control line for selectively controlling one of two or three as a main device for performing control output.

The calculation control devices 1, 2 and 3 all have the same configuration and are connected by a communication line 5, an interrupt control line 6, a control input / output line 7 and a system configuration control line 8, but all the devices are connected. It is galvanically isolated. That is, the communication line 5 is
It conforms to the international standard technical standard IE ³ 802.3 and the like, and uses a coaxial cable as a transmission medium, and the device and the transmission medium are connected by a transformer (not shown).

Further, the control input / output line 7 complies with the international standard technical standard EIARS485, but the control input / output transmission power source and the device internal power source are electrically separated as separate systems so that Since it is electrically separated from the control input / output line 7, the devices are insulated from each other.

Further, the interrupt control line 6 and the system configuration control line 8
Adopts a current drive system, and the devices are electrically insulated by a photocoupler (not shown).

The inside of each of the calculation control devices 1, 2 and 3 is constructed as follows.

Reference numerals 10, 20, and 30 are control devices that are the center of calculation of the calculation control device, and 11, 21, and 31 are control devices 1.
A diagnostic device for detecting the control state of 0, 20, 30;
22 and 32 are control output data output devices, 13 and 23,
33 is an input device for control input data, 14, 24 and 34 are control output switching devices, 15, 25 and 35 are control devices 10,
Synchronous interrupt control devices 20 and 30 and communication devices 16 and 26 for exchanging control data between the control devices.
Reference numerals 17, 27 and 37 are individual number identification devices for setting individual numbers of the respective calculation control devices, and 18, 28 and 38 are switches for producing a change in frequency signal in the respective calculation control devices, which are conventional triple system control. This is a device newly provided in the device. In the following description, the triple computer control device 1,
2 and 3 will be called 1 system, 2 system and 3 system, respectively.

Next, the operation of this embodiment will be described.

The operation of the triple control device in FIG.
The operation of the system will be mainly described.

Any one of the calculation control devices 1, 2, and 3 becomes a main system for controlling the controlled object 4, and the main system periodically alternates. Hereinafter, the calculation control device that performs the control output will be referred to as a main system, and the other control devices will be referred to as a slave system.

The start timing of the control cycle of the control device 10 is based on the intersystem synchronization interrupt between the devices. The control clocks of the control device 10 are independent of each other. The devices do not synchronize at the instruction execution level but operate at the processing level in synchronization. Each device exchanges signals for synchronizing with each other, and when two or more signals are input, a synchronization interrupt is generated. The intersystem synchronization interrupt between the devices
This is performed by the synchronous interrupt controller 15. Control device 1
0 triggers an inter-system synchronous interrupt generated by the synchronous interrupt control device 15 as a trigger to start a control cycle.

Within the control cycle, the control unit 10 exchanges control data between the units by means of the communication unit 16.

FIG. 2 is an explanatory diagram showing the configuration of the control cycle of the embodiment of the present invention.

As shown in the figure, one control cycle is composed of two phases, a control phase and a diagnosis phase. The control phase is a phase in which the control device 10 performs an operation for controlling the controlled object 4, and the diagnosis phase is a phase in which the control states of the control devices of the three systems are diagnosed. In the diagnosis phase, self-diagnosis of the control device 10 and diagnosis of inter-device data majority processing implemented by software are performed. The diagnosis of the majority decision process is to confirm the ability to intentionally create data that causes inconsistency in all the control devices at a specific part of the data exchanged between the control devices, exchange the data, and detect the inconsistency in the exchange data. That is. If the majority is established in the control cycle, the frequency state is transited, and if the majority is not established in the diagnostic cycle, the frequency signal is transited.

The control device 10 and the controlled object 4 are connected as follows.

The control device 10 and the control input / output line 7 are always connected by the control data input / output device 13. Therefore, the control device 10 can always capture the data state on the control input / output line 7. On the other hand, the control data output device 12 is connected to the control output line 7 via each control output switching device 14.

Based on the control status of the control device 10, the diagnostic device 11 decides only the device that performs the control output, controls the corresponding control output switching device 14, and controls the control output device 12. Connect to output line 7.

In the control phase, after the synchronization processing by the intersystem synchronization interrupt, each control device inputs the same control state data from the controlled object at the same time. Regarding the input of the control state data, the calculation control device which is the main system at that time outputs an output request of the control state data to the controlled object 4, and the return of the control state data for this is fetched from each calculation control device. In the form.

Next, the input data taken in by each calculation control device is exchanged between the control devices via the communication device 16 to confirm its validity, and the input data is matched by the majority vote process. The control process for the controlled object 4 is executed under the matched input data, and the control output data is exchanged between the control devices, and is decided as the control output data by the majority process.

In this embodiment, the control input / output data between the control devices is exchanged by the communication device 16, and the majority exchange processing of the exchanged data is performed by software. When two or more pieces of data exchanged between the devices match, a majority decision is established. This processing is performed by software instead of hardware. Therefore, there is no point in multiplexing as a triple system unless the majority processing performed by software is normally performed.

In the diagnostic phase, the control unit synchronizes with the 3
The majority vote is always unsuccessful in one system. The majority decision data is exchanged and the ability to detect abnormal data is confirmed.

When the control state of each control device is normal,
In the control phase and the diagnostic phase, a frequency signal corresponding to the majority decision process is output as a control device diagnostic signal. That is, each control device outputs a signal <fn, i (control i system selection)> corresponding to the majority decision in the control phase. That is, each control device outputs a signal <fn, i (control i system selection)> corresponding to the majority decision in the control phase, and a signal <ft, i (diagnosis i system selection)> corresponding to the majority decision in the diagnosis phase. .

Further, as the control device diagnostic signal, not only the diagnosis result of the majority processing but also information about which device each control device including its own device is selected as the main system is added. This signal is input to the diagnostic devices 11, 21, 31 of the other calculation control devices.

FIG. 3 is an explanatory diagram showing changes in the control device diagnostic signal in the control cycle of the embodiment of the present invention.

The control device diagnostic signal reduces the number of connection signal lines between the control device 10 and the diagnostic device 11 and makes the internal circuit configuration of the diagnostic device 11 a fail-safe logic.
It was a frequency signal. As a result, the control device diagnostic signal is frequency-modulated in the control phase and the diagnostic phase in accordance with the predetermined operation performed by the majority decision process and which computer control device is selected as the main system. .

Further, when an abnormality is detected in the diagnosis of the majority decision processing, the abnormality detection device has a failure holding circuit so that it cannot participate in the triple system unless it is repaired or restarted. Here, the start-up of triple system configuration control and failure maintenance will be described.

FIG. 4 is a block diagram showing the configuration of the diagnostic circuit of the embodiment of the present invention.

FIG. 5 is a timing chart of signals flowing in the diagnostic circuit shown in FIG.

In the 1-system diagnostic circuit 11 shown in FIG. 4, the system normal delay signal 43 is a signal having a function of holding a fault state in the diagnostic circuit 11. When the system normal delay signal 43 becomes "0" at the frequency logic level, the diagnostic circuit 11 stops its function. To start up the configuration control of the triple system, the synchronous initial signal 41 is set to the frequency logic level "1" by the frequency logic majority decision of the initialization signals (A ₁ , B ₁ , C ₁ ). As a result, the system normal signal 42 and the system normal delay signal 4
3 is the frequency logic level "1". In the actual control of the triple system control device, when the diagnostic frequency signal from the control device 10 is switched to the frequency corresponding to the control phase and the diagnostic phase of the control cycle, the system normal signal 42 is temporarily turned off. However, if the frequency majority of the control signals (An, Bn, Cn) is established while the system normal delay signal 43 remains due to the off delay due to the frequency logic, the system normal signal 42 is restored and the system normal delay signal 43 is restored. 43 will be output continuously. Further, if each control device synchronously shifts to the diagnostic phase, the system normal signal 42 will continue to be output.

As shown in FIG. 5, control signals (An, Bn,
Cn) or the diagnostic signal (At, Bt, Ct) does not hold the frequency logic majority decision, and the system normal delay signal 43 becomes the frequency logic level "0" when the off delay time of the system normal delay signal 43 elapses. The computer controller having the diagnostic circuit 11 cannot be restored to the triple system because it is restarted.

The majority decision process is performed for main system selection and input / output data. A system in which this processing continuation does not match is regarded as a failure. The system regarded as a failure shifts and separates the frequency signal corresponding to the majority processing so that it cannot participate in the control unless the system is restarted. As a method of separating only the calculation control devices for which the majority decision is not established, an identification device for setting an individual number of each calculation control device and a mathematical expression are used.

Next, the identification and disconnection of the faulty system of the triple system will be specifically described.

For that purpose, the set value by the individual number identification device 17 for setting the individual number of the calculation control device and the switch 18 for producing the change of the frequency signal in the control device 10 is expressed by the formula 1 (determination formula of the diagnostic signal). It is input to and calculated, and the result is used for identification and separation.

Formula 1 gi (S ₁ i, S ₂ i) = {(S ₁ i + 1) × 10 + S ₂ i} m
od (i + 2) FIG. 6 is a front view of the switch according to the embodiment of the present invention.

The switch 18 shown in the figure is composed of two rotary switches Sw1 and Sw2 for inputting two kinds of frequency signals to the control device 10, and each rotary switch Sw1 and Sw2 has, for example, ten kinds of frequency. It has 10 contacts because it produces a signal.

Table 1 is a table showing set values of individual numbers of frequency signals input to each system. The setting values of the rotary switches Sw1 and Sw2 of the switch 18 depending on the setting values of the individual number identification device 17 as shown in Table 1 are operated in advance. That is, if it is a 1-system rotary switch Sw1, S
For both w2, 1 is set value, for 2 systems, 6 is set for both rotary switches Sw1 and Sw2, and for 3 systems, rotary switch Sw1 is 7, and Sw2 is 5, respectively.

[0051]

[Table 1]

In the case of the 1-system, identification and disconnection of the failed system are performed in the following steps.

Step 1 The frequency signal corresponding to the setting value (1) of the rotary switch Sw1 is substituted into S ₁ i of the mathematical formula 1, and the frequency signal corresponding to the setting value (1) of the rotary switch Sw2 is calculated to the mathematical formula 1. Substitute it into S ₂ i, and substitute the set value of the individual number identification device 17 into i of the last term. This operation gives gi (S ₁ i, S ₂ i)
Is calculated. This calculation is performed for all systems including one system.

Step 2 If all the systems are normal, the calculation results gi (S ₁ i, S ₂ i) will be the same, and 1 will be obtained for the normal system and 0 will be obtained for the abnormal system.

Table 2 shows the calculation result by the mathematical formula 1, and the calculation result of the 1st system becomes 0, and the 1st system is judged to be an abnormal system and becomes the stop system. In this step 2, the fault system identification is completed.

[0056]

[Table 2]

FIG. 7 shows an output pattern of the control device diagnostic signal according to the calculation result of the embodiment of the present invention.

In the figure, the control system diagnostic signals for each of the 1-system, 2-system, and 3-system are shown. The horizontal axis represents time, the vertical axis represents frequency f ₁ ,
The state where it changes with f ₂ is shown.

The system outputting the calculation result of step 31, that is, the normal system 2 and system 3, outputs the control device diagnostic signal by changing the output pattern so as to extend the time of f ₂ as shown in FIG. In this embodiment, f
_Although the time of ₂ is extended, the frequency of f ₂ may be changed to f ₃ , for example.

Step 4 In the inter-system diagnostic circuit 11, the control device diagnostic signal in which the output patterns output from the normal 2 system and 3 system are changed, the control device diagnostic signal in which the output pattern of the own system is not changed, and the system normal delay The AND of the three signals and the signal is not established at the time shown by the dotted line in FIG. 7, and the control phase signal and the diagnostic phase signal shown in FIG. 4 cannot be output. As a result, the abnormal 1 system is out of synchronization and the majority decision processing is performed. Will not be able to participate in the diagnostic system due to and will be completely separated from the Mie system.

Next, an example in which the separated abnormal one system is restored to the triple system after repairing will be described.

FIG. 8 shows a start-up sequence of the separated system 1 according to the embodiment of the present invention.

According to FIGS. 4 and 8, the 2nd system and the 3rd system are set to 1 during control.
Explain the case of restarting the system. After restoration, the first system exchanges data with the normal system via a communication line for exchanging data when it starts up, and outputs an initialization signal fi.
The normal 2nd system and 3rd system detect that the 1st system has started up by data exchange, and output the initialization signal fi. The output initialization signal fi is the synchronous initial signal 41 if the inter-system diagnostic circuit 11 outputs the initialization signal fi to the other system as well.
Becomes Frequency synchronization is performed by this signal, and the triple system is restored without synchronizing the control of the entire apparatus with the system that started up later.

[0064]

According to the present invention, when an abnormality occurs in one system constituting a multiplex system, the abnormal system is identified by the majority disagreement of the input / output processing results, and the normal system inter-system synchronization signal generation logic is used. By completely changing from the multiplex system without synchronizing with the abnormal system, it is possible to prevent double failure and provide a highly safe multiplexing control device.

Further, regarding the restart of the abnormal system, it is detected by the data exchange between the plurality of control devices that there is a system that started later, and the system that started later and the normal system are detected. By synchronizing the frequency signals of, the multiplexing control device can be restored to the multiplexing system without stopping.

[Brief description of drawings]

FIG. 1 is a block diagram showing an overall configuration of a triple system control device according to an embodiment of the present invention.

FIG. 2 is an explanatory diagram showing a configuration of a control cycle according to the embodiment of the present invention.

FIG. 3 is an explanatory diagram showing changes in a control device diagnostic signal within a control cycle according to the embodiment of the present invention.

FIG. 4 is a block diagram showing a configuration of a diagnostic circuit according to an embodiment of the present invention.

FIG. 5 is a timing chart of signals flowing in the diagnostic circuit shown in FIG.

FIG. 6 is a front view of the switch according to the embodiment of the present invention.

FIG. 7 shows an output pattern of a control device diagnostic signal according to a calculation result of the embodiment of the present invention.

FIG. 8 is a start-up sequence of the separated system 1 in the embodiment of the present invention.

[Explanation of symbols]

 1 Computer control device 2 Computer control device 3 Computer control device 4 Control target 5 Communication line 6 Synchronous interrupt control line 7 Control input / output line 8 System configuration control line 10 Control device 11 Diagnostic device 12 Output device 13 Input device 14 Control output switching Device 15 Synchronous interrupt control device 16 Communication device 17 Individual number identification device 18 Switch 20 Control device 21 Diagnostic device 22 Output device 23 Input device 24 Control output switching device 25 Synchronous interrupt control device 26 Communication device 27 Individual number identification device 28 Switch 30 Control Device 31 Diagnostic device 32 Output device 33 Input device 34 Control output switching device 35 Synchronous interrupt control device 36 Communication device 37 Individual number identification device 38 Switch Sw1 Rotary switch Sw2 Rotary switch

 ─────────────────────────────────────────────────── ─── Continuation of the front page (72) Inventor Hideyuki Hosaka 1070 Ige, Katsuta City, Ibaraki Prefecture Hitachi Ltd. Mito Plant

Claims (3)

[Claims] 1. A multiple control system for controlling a controlled object by one of a plurality of control devices, and an abnormal control device of the plurality of control devices are identified by a majority logic of inter-system diagnostic data, In a multiplex control device having an abnormal control device identification means for switching control output to a controlled object in each control device, when the abnormal control device identification means identifies an abnormal control device, a normal inter-system synchronization of the control device is performed. A multiplexing control device, wherein each control device is provided with a separating means for changing the signal generation logic to disconnect the abnormal control device from the inter-system diagnosis system based on the majority logic. 2. A multiple control system for controlling a controlled object by one of the three control devices and an abnormal control device of the three control devices are identified by a majority logic of inter-system diagnostic data, In a multiplex control device having an abnormal control device identification means for switching control output to a controlled object in each control device, when the abnormal control device identification means identifies an abnormal control device, a normal inter-system synchronization of the control device is performed. A multiplexing control device, wherein each control device is provided with a separating means for changing the signal generation logic to disconnect the abnormal control device from the inter-system diagnosis system based on the majority logic. 3. When each control device is provided with a means for detecting the restart and synchronizing the frequency of the output signal with a normal control device when restarting after repairing the control device in which an abnormality is detected. The multiplexing control device according to claim 1 or 2, which is characterized in that.