JPH11134209A - Fault tolerant controler - Google Patents

Abstract

PROBLEM TO BE SOLVED: To permit a slave system control part which is usually in a standby state to succeed the processing of a main system control part at abnormal time and to execute it. SOLUTION: The main system control part 15 which sequentially controls a control object at every control mode in accordance with a previously decided sequence, a main system counter 14 counting a clock in parallel to control by the main system control part 15 and a slave system counter 16 counting the individual clock synchronized with the clock of the main system counter 14 are provided. The slave system control part 17 started when abnormality occurs in the main system control part 15 is caused to succeed the control mode of the main system control part 15 based on the count value of the slave system counter 16 and to control the control object.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a fault-tolerant control device that allows an operation of a main control unit to be passed to a sub-control unit when an abnormality occurs in a main control unit in attitude control of an artificial satellite.

[0002]

2. Description of the Related Art In a conventional information processing system, when an abnormality occurs in a part of the system, the processing operation of the system is stopped or the contents executed by the system are executed again. Continue, or stop the system or determine the abnormal block in the system, stop the processing by the block,
It prevents the entire system from going down.

In such a conventional information processing system,
If at least some functions of the system are stopped, and if data processing can be reduced in the event of a failure,
Although it is possible to operate the system as it is, it cannot be applied to uses in which suspension of some functions is not allowed, such as a control device. Therefore, in order to realize the continuation of the operation after the occurrence of the failure, it is necessary to guarantee the continuation of the operation and the continuation of the processing operation by the system.

[0004] On the other hand, in an information processing system having a control device in which operation stop and processing operation stop are not allowed, an abnormality is detected by providing multiple redundancy for operating many systems simultaneously. In this case, fault-tolerant control has been put to practical use in which the operation of the system of the normal system is taken over instead of the system of the abnormal system.

[0005]

However, in such a conventional fault-tolerant control system, it is necessary to keep the control units of a plurality of systems operating at all times in order to continue the operation. It takes a lot of resources, and there is a problem that it is difficult to apply it to a system in which restrictions on such resources are large, such as an electronic circuit of an artificial satellite.

[0006] The present invention solves the above-mentioned problems, and is not a multiple simultaneous operation system as performed in a conventional full-scale system, but a main system control unit which is normally operating. A fault-tolerant control device capable of reliably realizing the continuity of the processing operation is obtained by using a simple standby redundant system which is normally in a standby state and inherits processing from the main control unit when the main control unit is abnormal. The purpose is to:

[0007]

In order to achieve the above object, a fault tolerant control apparatus according to the first aspect of the present invention includes: a main system control unit for sequentially controlling a control target in each control mode according to a predetermined sequence; A main system counter that counts a clock in parallel with the control of the main system control unit and a sub system counter that counts a unique clock synchronized with the clock of the main system counter are provided, and The slave control unit started at the time of occurrence causes the control mode of the master control unit to be inherited based on the count value of the slave counter at the time of the start, thereby executing the control of the control target. is there.

Further, a fault tolerant control device according to a second aspect of the present invention, wherein a clock for operating the master counter and the slave counter is a timing signal generated externally and from which the control state can be estimated. It is.

The fault tolerant control device according to the third aspect of the present invention causes the master counter and the slave counter to independently count up a count value at each start time of each control mode by each master controller. It is like that.

[0010]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS One embodiment of the present invention will be described below with reference to the drawings. FIG. 1 is a block diagram showing a fault-tolerant control apparatus according to the present invention. In FIG. 1, reference numeral 11 denotes a fault-tolerant control apparatus.
And a main system control unit 15 that divides the system into two systems of a sub system unit 13 and sequentially controls a control target for each control mode according to a predetermined sequence, and counts a clock in parallel with the control by the main system control unit 15. Main system counter 14
And a slave counter 16 that counts its own clock synchronized with the clock of the master counter 14, and is activated when an abnormality occurs in the master controller 15. Based on the above, there is provided a slave control unit 17 that executes control of a control target while inheriting the control mode of the master control unit 15.

The master counter 14 and the slave counter 16, the master controller 15 and the slave controller 1
7 are constituted by the same elements. Further, the master counter 14 and the slave counter 16 operate with independent clocks. Therefore, the slave counter 16 independently performs a counting operation even when the slave controller 17 is in the standby state.

Next, the operation will be described with reference to FIGS. FIG. 2 is a timing chart showing operation timings of the main control unit 15 and the main counter 14, and the sub control unit 17 and the sub counter 16, and FIG. 3 is a flowchart showing the operation flow. First, in the normal state, as shown in FIG.
The control of the control object is sequentially performed in accordance with a predetermined sequence for each of the control mode 1, the control mode 2, the control mode 3, and so on (step S1). In particular,
The control target such as the control logic, the sensor, and the actuator to be used is switched according to the state of the control target, and if there is no abnormality in the main system control unit 15 (step S2), the optimal control is continuously continued (step S2). Step S3).

On the other hand, in parallel with the control by the master controller 15, the master counter 14 and the slave counter 16 operate with independent clocks, and the counter value is changed in each control mode as time passes. At the start,
Count value 1, count value 2, count value 3, respectively
... and change. The slave counter 16 operates in synchronization with the master counter 14.

If an abnormality occurs when the control operation of the main controller 15 proceeds to the control mode 3 and it becomes necessary to start the standby system (slave system) (step S2), The system control unit 17 starts the activation at the time of the abnormality (step S4) and reads the count value of the slave system counter 16 (step S5).

In this example, as shown in FIG. 2, since the count value at the time of occurrence of an abnormality is 3, the slave control unit 17 determines that the master control unit 15 has advanced to the control mode 3, and
Control mode is restarted and control mode 3, control mode 4,
..., the control operation is continued (step S6). Here, it is checked whether or not there is an abnormality in the slave control unit 17 (step S7). If there is no abnormality, the mode control by the slave control unit 17 is continued (step S7).
8) If there is an abnormality, the control is terminated by, for example, stopping the slave control unit 17 (step S9).

Normally, in a case such as an artificial satellite in which the control target and the conditions can be sufficiently known in advance, the control mode to be started is determined based on the elapsed time from the start of the control by analyzing the control target and the like in advance. It is quite possible to estimate. Thus, the slave control unit 17 can be started in an appropriate mode as if the state of the master control unit 15 was monitored, even though the slave control unit 17 was not operating.

The criterion for activating the slave control unit 17 is the count value of the slave counter 16 that operates independently of the master counter 14.
Regardless of the degree of the abnormality of 5, the count value of the slave counter 16 is considered to be normal, and the appropriateness of the operation is guaranteed.

In the above embodiment, the case where the master counter 14 and the slave counter 16 operate using independent clocks has been described. As long as the control state can be estimated while independently using the control unit 14 and the slave counter 16, a timing signal or the like generated outside each of the control units 15 and 17 and defining the operation of each unit can also be used. is there. In this case, the timing signal is not necessarily required to be output at regular intervals, and any signal can be used as long as the operation of the slave counter 16 can estimate the control operation.

[0019]

As described above, according to the present invention, when an abnormality occurs in the main control unit, the subordinate counter reads the count value, and the standby control unit, which has been on standby, sets the control state of the main control unit. The slave control unit can take over the control operation performed by the master control unit, and can execute it without using a full-scale multiplex system. Alternatively, it is possible to obtain an effect that it can be widely used in information processing systems such as artificial satellites having restrictions on costs.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a fault-tolerant control device according to an embodiment of the present invention.

FIG. 2 is a timing chart showing operation timings of the fault-tolerant control device shown in FIG.

FIG. 3 is a flowchart showing a flow of operation of the fault tolerant control device shown in FIG. 1;

[Explanation of symbols]

 14 Main system counter 15 Main system control unit 16 Sub system counter 17 Sub system control unit

Claims (3)

[Claims] A main control unit for sequentially controlling a control target in each control mode according to a predetermined sequence; a main system counter for counting clocks in parallel with control by the main control unit; A slave counter that counts its own clock synchronized with the clock of the counter; and a controller that is started when an abnormality occurs in the master controller, and controls the master controller based on the count value of the slave counter at the time of startup. A fault-tolerant control device comprising: a slave control unit that executes control of a control target while inheriting a mode. 2. The fault tolerant control according to claim 1, wherein the clock for operating the master counter and the slave counter is a timing signal generated externally and from which the control state can be estimated. apparatus. 3. The system according to claim 1, wherein the master counter and the slave counter independently count up a count value at each start time of each control mode by each master controller. Fault-tolerant control device.