JPH09319401A - Parallel duplex system electronic interlocking device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a parallel duplex system electronic interlocking device with which trouble in the operation of control object equipment at the time of system switching can be prevented while keeping the continuity of control outputs before and after the system switching. SOLUTION: A 1st interlock control system 1 as an active system and a 2nd interlock control system 2 as a standby system are operated at all times, the active system dispatches a cyclic redundancy code(CRC) of control output as the control arithmetic result through mirror memories 7a and 7b to the standby system, and the standby system compares that CRC with the CRC of control output as the control arithmetic result of present system. When they are not coincident with each other, a fault signal is outputted. Thus, a system switcher 3 inhibits switching from the active system to the standby system, and the control outputs are prevented from being discontinuous by system switching.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a parallel dual system electronic interlocking device in which an interlocking control system is configured as a dual system and can be switched to a standby system when a use system fails.

[0002]

2. Description of the Related Art In a conventional parallel dual-system electronic interlocking device, similar inputs are made in parallel in both systems, and the two systems are synchronized so that the calculation results of the used system and the standby system are the same. Came. FIG. 15 is a block diagram showing the main configuration of a conventional device disclosed in, for example, Japanese Patent Laid-Open No. 3-292257. In the figure, reference numeral 1 is a first interlocking control system, and 1a is a control unit mounted on the first interlocking control system 1, which has a CPU and executes a program which functions as an interlocking device by the CPU. Reference numeral 1b is an external I / F for connecting the control unit 1a and the controlled device 6 and 1c is a control output line for transmitting a control output to the controlled device 6 1d.
Is a display line for receiving information from the controlled device 6. Reference numeral 1e is a cycle timer for determining the program execution cycle of each control unit of the first interlocking control system 1 and the second interlocking control system 2. 2 is a second interlocking control system, which is the first
A control unit 2a having the same function as the interlocking control system 1, an external I / F 2b, a control output line 2c, a display line 2d, and a cycle timer 2e are present or connected. 3
Is a system switching device. Depending on the state of this system switching device 3, only the external I / F of either the first interlocking control system 1 or the second interlocking control system 2 is made to function, and the output of the other system is set. To cut. Four
Reference numeral a is a system status signal that connects the system switching unit 3 and the control unit 1a, and system reference signal 4b is a system failure signal that indicates a failure state of the first interlocking control system 1. Similarly, 5a is a system status signal and 5b is a system failure signal of the second interlocking control system 2.

In such a conventional parallel dual system electronic interlocking device, when the first interlocking control system 1 is the use system and the second interlocking control system 2 is the standby system, the information from the controlled device 6 is , Is transmitted via LAN, and is input in parallel to both interlocking control systems 1 and 2 through the display lines 1d and 2d. On the premise of this information, the control units 1a and 2a synchronously perform data processing and control. Instruction information is sent to the controlled device 6 through the output lines 1c and 2c. However, since the output of the second interlocking control system 2, which is a standby system, is normally cut, it is the output of the first interlocking control system 1 that functions. Like the first interlocking control system 1, the second interlocking control system 2 receives information from the controlled device 6 and operates equivalently to prepare for an abnormality.

First interlocking control system 1 and second interlocking control system 2
Regarding the processing synchronization with the system, when the system in use is operating normally, the cycle is set to be correct and the cycle timer 2e of the standby system is set to match the timer in the system in use to synchronize the two systems. ing. Next, the procedure for switching the system from the active system to the standby system is shown. In each of the interlocking control systems 1 and 2, the control units 1a and 1b constantly determine an abnormality, and when an abnormality is detected, the system failure signals 4b and 5b of the system in which the abnormality is detected are output. In the system switching device 3, when the system failure signal 4b from the first interlocking control system 1 is detected, the control output of the in-use system is cut and the second interlocking control system 2, that is, the standby system is switched to the in-use system. As a result, the second interlocking control system 2 comes to function.

[0005]

In the conventional parallel dual system electronic interlocking device as described above, the use system and the standby system are arranged in parallel on the assumption that the input data from the controlled devices are the same information. Inputting and performing control calculation and outputting the result, but it is not confirmed whether the contents of each control output are the same, so there is a difference in the contents of both control outputs. There was a case where system switching occurred and the continuity of control output was not maintained before and after system switching. If the control output becomes discontinuous, there is a problem in that the control target device causes various problems.

The present invention has been made to solve the above problems, and its purpose is to maintain the continuity of control output before and after the system switching and to operate the controlled equipment during the system switching. It is to obtain a parallel dual system electronic interlocking device that can prevent trouble.

[0007]

Means for Solving the Problems Input data input by a use system and used for control calculation is transferred to the standby system through a mirror memory, and in the standby system, control calculation is performed using the transferred input data. A means for performing, a means for calculating the check value of each output data in the use system and the standby system, a means for comparing the check values of the output data of both systems in the standby system, and when the comparison results do not match. A means for outputting failure information as a failure of the standby system is provided.

Further, the check value is calculated as a CRC.

The check value is calculated as a checksum.

Further, when the input data is transferred from the use system to the standby system, there are provided means for adding a counter value which is incremented for each transfer cycle, and means for adding the above-mentioned counter value to the check value of the output data for comparison. ing.

In addition to the means for adding the check value of the input data when the check value of the output data is transferred from the used system to the standby system, and in the standby system, in addition to the comparison of the check values of the output data of both systems, It is provided with means for comparing the check values of the input data of both systems.

In addition, when data is transferred from the active system to the standby system, a queue is provided on the mirror memory, enqueue (register to the queue) in the active system, and dequeue in the standby system (from the queue). Read).

Further, when data is transferred from the active system to the standby system, an interrupt is generated from the active system to the standby system after writing the data, and the interrupt generation is used as a data read timing in the standby system. is there.

Further, when data is transferred from the use system to the standby system, the use system updates the write status after writing the data, and the standby system reads the data by monitoring the write status at regular intervals. The timing is set.

[0015]

BEST MODE FOR CARRYING OUT THE INVENTION

Embodiment 1. FIG. 1 is a block diagram showing a main configuration when control is performed using a parallel dual system electronic interlocking device according to an embodiment of the present invention. In the figure, 1 to 6 are the same as or equivalent to the conventional one shown in FIG.
Reference numeral 7a is a mirror memory that constitutes the first interlocking control system 1, and 7b is a mirror memory that constitutes the second interlocking control system 2. Reference numerals 8a and 8b are connection cables for connecting the mirror memories 7a and 7b to each other. Mirror memory 7a, 7b
Is a writable and readable memory board similar to a normal RAM when viewed from the control units 1a and 2a. The data written from the control unit 1a to the mirror memory 7a is
At the same time, it can be copied to the corresponding area of the mirror memory 7b via the connection cable 8a and read from the control unit 2a. Similarly, the data written from the control unit 2a to the mirror memory 7b is simultaneously copied to the corresponding area of the mirror memory 7a via the connection cable 8b.
It can be read from a. However, the corresponding area of the mirror memory 7b to which the data from the control unit 1a is copied, the area of the mirror memory 7b to which the control unit 2a writes the data, and the corresponding area of the mirror memory 7a to which the data from the control unit 2a is copied. Is arranged so as not to overlap the area of the mirror memory 7a where the control unit 1a writes data, and is used as an I / F between the first interlocking control system 1 and the second interlocking control system 2.

Regarding the operation of the first interlocking control system 1 which is the use system in the parallel dual system electronic interlocking device constructed as described above, the flowchart of FIG. 2 and the operation of the second interlocking control system which is the standby system Will be described with reference to the flowchart of FIG. First, in the first interlocking control system 1, after initialization (S1), display information is input to the internal RAM from the controlled device 6 via the display line 1d (S2). The input information is written in the mirror memory 7a and the mirror memory 7b, and the display information is passed to the second interlocking control system 2 (S3). Next, the first interlocking control system 1 performs control calculation according to the input information (S4) and calculates the CRC of the control output (S5). The CRC is the remainder when the control output data is multiplied by the highest-order term of the generator polynomial and divided by the generator polynomial. Control output data P (X), polynomial G (X) = X ¹⁶ + X ¹² + X ⁵ +1
Then, the CRC is obtained by the remainder of X ¹⁶ · P (X) / G (X). CRC is the most general method for checking the control output, and it is possible to detect even erroneous bits. By writing the control output CRC to the mirror memories 7a and 7b (S
6) The control output CRC of the used system is passed to the standby system. Finally, the control output is output to the control target device 6 via the control output line 1c (S7). Thereafter, the above S2 to S
The processing of 7 is repeated at the control cycle by the cycle timer 1e.

In the second interlocking control system 2, after initialization (T1), the input information written by the system in use is read from the mirror memory 7b and input to the internal RAM (T).
2). Next, similar to the system used, control calculation is performed according to the input information (T3) to calculate the control output CRC (T
4). Then, the control output CRC written by the used system is read from the mirror memory 7b (T5), and the value is compared with the control output CRC in the standby system calculated in T4 (T).
6). As a result of the comparison, if a mismatch is detected in both CRCs (when T6 is NG), the continuity of the control output cannot be maintained even if the standby system is switched. A system fault signal 5b is output to the switch 3 (T7). As a result, the standby system program is stopped (T8), and discontinuity of the control output due to switching to the standby system can be prevented. If the CRC match is confirmed at the above T6 (when T6 is OK), the above T2 to T6.
Processing is repeated at the control cycle by the cycle timer 2e synchronized with the cycle timer 1e. As described above, even if some abnormality occurs in the active system, if the control outputs of the active system and the standby system do not match, switching to the standby system is not performed. Discontinuity can be prevented.

Embodiment 2. In the first embodiment, system switching is performed if the control output of the active system and the control output of the standby system match, but due to differences in the hardware characteristics of the active system and the standby system, In some cases, the standby system may read the data after the timer is set and before the data for that cycle is written. In that case,
The standby system had a problem of reading the data of one cycle ago. In the second embodiment, the deviation of the calculation cycles of both is detected, and if the calculation cycles are different even if the control outputs match, the system switching is prohibited. The flow of processing of the use system according to the present embodiment will be described with reference to the flowchart of FIG. 4, and the flow of processing of the standby system will be described with reference to the flow chart of FIG. In the usage system, as in the case of the first embodiment, after initialization, display information is input from the control target device 6, and the mirror memory 7a and the mirror memory 7 are input.
The display information is passed to the second interlocking control system 2 by writing in b (S1 to S3). At the same time, the cycle counter is incremented, and the mirror memory 7 is set as the input counter value.
It is passed to the standby system by writing to a and 7b (U1). Then, in the first interlocking control system 1, the control calculation is performed according to the input information, the CRC of the control output is calculated, and the mirror memory 7
By writing to a and 7b, the control output CR of the used system
C is passed to the standby system (S4 to S6). At this time, the above U1
Then, the same counter value as that passed to the standby system is written in the mirror memories 7a and 7b as an output counter (U2).
Finally, the control output is output to the control target device 6 via the control output line 1c (S7).

On the other hand, in the standby system, after initialization, the input information is read from the mirror memory 7b (T1 to T).
2). At the same time, the input counter value written by the usage system is read from the mirror memory 7b (U3). Next, similar to the first embodiment, the control calculation is performed according to the input information,
The control output CRC is calculated and compared with the control output CRC of the used system read from the mirror memory 7b (T3 to T).
6). As a result of comparison, when a mismatch is detected in both CRCs (when T6 is NG), the system fault signal 5b is output,
The standby system program is stopped (T7 to T8). If both CRCs match (when T6 is OK), the output counter value written by the usage system is read from the mirror memory 7b (U4), and if it does not match the counter value read in U3 (NG in U5). In this case), it is determined that the cycle is shifted, a failure signal is output, and the program is stopped (T7 to T8). If the input counter read from the mirror memory 7b and the output counter match (O in U5
In the case of K), the processes of T2 to U5 are repeated in the control cycle by the cycle timer 2e synchronized with the cycle timer 1e of the system used. As described above, it is possible to detect a discrepancy between the outputs of both systems due to the deviation of the execution cycle.

Embodiment 3 In the first embodiment, the coincidence of the control outputs of the used system and the standby system is confirmed, but in the third embodiment, the coincidence of the input data of both systems is also confirmed. . The flow of processing of the use system according to this embodiment will be described with reference to the flowchart of FIG. 6, and the flow of processing of the standby system will be described with reference to the flow chart of FIG. In the usage system, as in the case of the first embodiment, after initialization, the display information is input from the controlled device 6 and written in the mirror memories 7a and 7b, thereby passing the display information to the second interlocking control system 2 ( S1 to S3).
Then, the control calculation is performed according to the input information, the CRC of the control output is calculated and written in the mirror memories 7a and 7b, and the control output CRC of the used system is passed to the standby system (S4 to S6). Then, in the above process, the controlled device 6
The CRC of the input information input from is calculated (V1), and the value is written to the mirror memories 7a and 7b, thereby passing the input information CRC of the used system to the standby system (V2). Finally, the control output is output to the control target device 6 via the control output line 1c (S7).

On the other hand, in the standby system, after initialization, as in the first embodiment, control calculation is performed according to the input information read from the mirror memory 7b, the control output CRC is calculated, and read from the mirror memory 7b. The control output CRC of the used system is compared (T1 to T6). As a result of the comparison,
When a mismatch is detected in both CRCs (when T6 is NG), the system failure signal 5b is output and the standby system program is stopped (T7 to T8). When both CRCs match (when OK in T6), the mirror memory 7b is processed in the above process.
The CRC of the input information in the standby system read from is calculated (V3), and the CRC of the input information written by the used system is read from the mirror memory 7b (V4). And
If the input information CRC of the standby system calculated in the process of V3 and the CRC of the input information of the used system read in the process of V4 are compared (V5) and they do not match (when V5 is NG), the failure signal 5b is output to stop the standby system program (T7 to T8). If both match (O at V5
In the case of K), the processes of T2 to V5 are repeated in the control cycle by the cycle timer 2e synchronized with the cycle timer 1e of the used system. As described above, not only the control output data of both the use system and the standby system but also the matching of the input data can be confirmed.

Embodiment 4 In some cases, due to differences in the hardware characteristics of the active system and the standby system, the standby system may read the data before the active system has finished writing data, and the written data matches the read data. There was a problem not to do it. In the present embodiment, a queue is formed in the mirror memory to protect data, writing to the mirror memory enqueues (registers), and reading from the mirror memory dequeues (reads) from the queue. Here is an example. The flow of processing of the use system according to the present embodiment will be described with reference to the flowchart of FIG. 8 and the flow of processing of the standby system will be described with reference to the flow chart of FIG. In the system used, after initialization,
Display information is input from the controlled device 6 and the mirror memory 7
The display information is passed to the second interlocking control system 2 by enqueuing to a and 7b (S1 to W1). Then, the control calculation is performed according to the input information, the CRC of the control output is calculated and enqueued in the mirror memories 7a and 7b, and the control output CRC of the used system is passed to the standby system (S4).
~ W2). Finally, the control output is output to the control target device 6 via the control output line 1c (S7).

On the other hand, in the standby system, initialization (T1)
After that, the input information is dequeued from the mirror memory 7b (W3), the control calculation is performed according to the input information, and the control output CRC is calculated (T3 to T4). Then, the control output CRC of the used system is dequeued from the mirror memory 7b (W4), and the control output CRC of the standby system calculated at T4 is calculated.
(T6). As a result of comparison, if a mismatch is detected in both CRCs (when T6 is NG), the system fault signal 5
b is output and the standby system program is stopped (T7-
T8). When both CRCs match (when T6 is OK), the processing of W3 to T6 is performed using the periodic timer 1e.
It is repeated with the control cycle by the cycle timer 2e synchronized with.
As described above, the input data written from the used system to the mirror memory and the input data read by the standby system surely match, and the mismatch of the output data due to the mismatch of the input data can be prevented.

Embodiment 5 As previously mentioned, the standby system sometimes read data while writing data from the active system, but the active system generates an interrupt when the data writing to the mirror memory is completed, and the standby In the system, both can be synchronized by reading the data when an interrupt occurs. FIG. 10 is a block diagram of an apparatus according to the present embodiment, and although the configuration is the same as that shown in FIG. 1, the mirror memories 7a and 7b have a function of mutually generating interrupt signals. . Further, 9a is an interrupt line from the mirror memory 7a to the control unit 1a, and 9b
Is an interrupt line from the mirror memory 7b to the controller 2a. The control unit 1a simultaneously accesses the interrupt generation area of the mirror memory 7b by writing in a specific area of the mirror memory 7a, and as a result, an interrupt is generated from the mirror memory 7b to the control unit 2a by the interrupt line 9b. An interrupt from the mirror memory 7a to the control unit 1a is also generated in the same procedure.

FIG. 11 shows the flow of the processing of the use system according to the present embodiment, and FIG. 12 shows the flow of the processing of the standby system.
It is shown in the flowchart. The overall processing flow is the same as S1 to S7 shown in FIG. 2 and T1 to T8 shown in FIG. 3, but in the use system, immediately after the mirror memory write processing of S3 and S6, respectively, the standby system is executed. An interrupt is generated (X1 and X2) to notify the end of writing. The standby system waits for an interrupt from the using system (X3,
The X4), T2, and T5 mirror memory reading is performed at the timing when an interrupt for notifying the end of writing from the usage system occurs. As described above, it becomes possible to synchronize the data exchange between the active system and the standby system.

Embodiment 6 FIG. It should be noted that data transfer between the active system and the standby system can be synchronized by polling and detecting the status update from the active system in the standby system. In this case, the system used is the mirror memories 7a and 7b.
By updating the above status, the operation timing is given to the standby system, and the standby system monitors the status update through the mirror memory 7b to synchronize the processing with the system in use. The flow of processing of the use system according to the present embodiment is shown in the flowchart of FIG. 13, and the flow of processing of the standby system is shown in the flow chart of FIG. The overall processing flow is S1 shown in FIG.
~ S7, the same as T1 to T8 shown in FIG. 3, but in the usage system, the status on the mirror memories 7a and 7b is updated (Y1, Y2) immediately after the mirror memory write processing of S3 and S6, respectively. Then, the writing end is notified. Further, the standby system waits for the status update on the mirror memory 7b (Y3, Y4), and the mirror memory reading of T2 and T5 is performed at the timing of accepting the status update for notifying the write completion from the using system. . As a result, similar to the fifth embodiment, the data transfer between the active system and the standby system can be synchronized.

Embodiment 7 It should be noted that the first to the first embodiments
Although the CRC is calculated as the check value for confirming the coincidence of the output data in 6 above, the checksum value may be calculated. The method of calculating the checksum value for checking the output data is generally the same as the CRC, but the checksum is obtained by simply adding the output data to be checked, and by its nature, it is multiplied by the calculation formula. As compared with a CRC including, the confirmation can be performed at a higher processing speed, and the continuity of the control output before and after the system switching can be maintained.

[0028]

Since the present invention is constructed as described above, it has the following effects.

The operating system and the standby system are always operated, the check values of the control output data of both systems are calculated and compared, and if they do not match, switching of the systems is prohibited. It is possible to prevent discontinuity of the control output of.

The CRC of the control output data is checked.
Since it is calculated and performed, the confirmation can be surely performed.

Since the control output data is checked by calculating the checksum, the check can be performed faster.

Further, when the data is passed from the used system to the standby system through the mirror memory, the counter value is added and the counter value is checked together with the control output data. Can also be detected.

Further, when the check value of the output data is passed from the used system to the standby system through the mirror memory, the check value of the input data which is the operation source of the output data is added, and the input data as well as the output data is added. Since it is checked, it will be possible to confirm more reliably.

Further, since the queue is formed in the mirror memory, it is possible to prevent the data written by the active system and the data read by the standby system from being inconsistent.

Further, since the write timing of the mirror memory is notified from the active system to the standby system by interruption, the data transfer between both systems can be synchronized.

Further, since the write timing of the mirror memory is notified from the active system to the standby system by updating the status, data transfer between both systems can be synchronized.

[Brief description of drawings]

FIG. 1 is a block diagram showing a main configuration of a parallel dual system electronic interlocking device according to an embodiment of the present invention.

FIG. 2 is a flowchart showing a processing flow of a usage system according to the first embodiment of the present invention.

FIG. 3 is a flowchart showing a processing flow of a standby system according to the first embodiment of the present invention.

FIG. 4 is a flowchart showing a processing flow of a usage system according to the second embodiment of the present invention.

FIG. 5 is a flowchart showing a processing flow of a standby system according to the second embodiment of the present invention.

FIG. 6 is a flowchart showing a processing flow of a usage system according to the third embodiment of the present invention.

FIG. 7 is a flowchart showing a processing flow of a standby system according to the third embodiment of the present invention.

FIG. 8 is a flowchart showing a processing flow of a usage system according to the fourth embodiment of the present invention.

FIG. 9 is a flowchart showing a processing flow of a standby system according to the fourth embodiment of the present invention.

FIG. 10 is a block diagram showing a main configuration of a parallel dual system electronic interlocking device according to a fifth embodiment of the present invention.

FIG. 11 is a flowchart showing a processing flow of a usage system according to the fifth embodiment of the present invention.

FIG. 12 is a flowchart showing a processing flow of a standby system according to the fifth embodiment of the present invention.

FIG. 13 is a flowchart showing a flow of processing of a usage system in the sixth embodiment of the present invention.

FIG. 14 is a flowchart showing a processing flow of a standby system according to the sixth embodiment of the present invention.

FIG. 15 is a block diagram showing the main configuration of a conventional parallel dual system electronic interlocking device.

[Explanation of symbols]

1 1st interlocking control system, 2nd 2nd interlocking control system, 3 system switch, 7a, 7b mirror memory, 9a, 9b interrupt line.

Claims (8)

[Claims] 1. A dual system comprising a use system used for normal interlocking control and a standby system provided in case of failure of the use system, both systems are operated at all times, and a standby system is provided when the use system fails. In a parallel dual system electronic interlocking device that performs switching, the input data input by the above-mentioned use system and used for control calculation is transferred to the above-mentioned standby system via a mirror memory, and the above-mentioned input data transferred in the above-mentioned standby system is transferred. Means for performing control calculation using the means, means for calculating check values of respective output data in the use system and the standby system, means for comparing check values of output data of both systems in the standby system, and the comparison result When the two do not match, a means for outputting failure information as a failure of the standby system is provided,
A parallel dual system electronic interlocking device, wherein switching of the system is prohibited when the failure information is output. 2. The check value is CRC (= Cyclic Redunda
The parallel dual system electronic interlocking device according to claim 1, wherein the parallel dual system electronic interlocking device is calculated as an ncy code (cyclic redundancy code). 3. The parallel dual system electronic interlocking device according to claim 1, wherein the check value is calculated as a checksum. 4. A means for adding a counter value that is incremented for each transfer cycle when the input data is transferred from the use system to the standby system, and a means for adding the counter value to the check value of the output data and comparing the check values. The parallel dual system electronic interlocking device according to any one of claims 1 to 3, characterized in that. 5. A means for adding the check value of the input data when the check value of the output data is transferred from the use system to the standby system, and in the standby system, in addition to the comparison of the check values of the output data of both systems, 5. The parallel dual system electronic interlocking device according to claim 1, further comprising means for comparing check values of input data of both systems. 6. When transferring data from the active system to the standby system, a queue is provided on the mirror memory, enqueues (registers in the queue) in the active system, and dequeues (registers from the queue in the standby system. 6. The parallel double system electronic interlocking device according to claim 1, wherein the parallel double system electronic interlocking device. 7. When the data is transferred from the active system to the standby system, an interrupt is generated from the active system to the standby system after writing the data, and the interrupt generation is set as a data read timing in the standby system. The parallel dual system electronic interlocking device according to any one of claims 1 to 5. 8. When data is transferred from the active system to the standby system, the active system updates the write status after writing the data, and the standby system reads the data by monitoring the write status at regular intervals. The parallel dual system electronic interlocking device according to any one of claims 1 to 5, wherein timing is set.