JPS5847058B2 - Multiple system switching control method - Google Patents

Description

[Detailed description of the invention] The present invention relates to a multiple system switching control system.

Control computers are rapidly progressing as advanced equipment used by Jiriura U, and in order to ensure even higher reliability, they have been made dual, duplex, and even 2-out-of-3.
etc. triplexing is being carried out.

As shown in FIG. 1, in the case of a dual system, there are generally a central processing unit 100, a central processing unit 200, and a switching control device 3 that synchronizes these programs and compares their outputs.
00, and a process input/output device 400 that is an interface with an external controlled object 500.

The switching control device 300 is generally large in size and requires a large amount of hardware from the central processing units 100 and 200, and in order to adopt such a configuration, the system must be of a certain size or larger to be cost-effective.

In particular, the application of small-scale digital computers (in which the central processing unit consists of one or two printed circuit boards) has become popular recently, but in such cases, the process is more important than the scale of the central processing unit. The scale of the input/output device is large,
Process input/output devices also have lower reliability than central processing units.

Therefore, in such a case, the central processing unit 100°200
There is little meaning in duplicating only the process input/output device 400, and it is necessary to duplicate the process input/output device 400 as well.

In such a duplex system, not only central processing units but also process input/output devices are duplexed.

In this conventional method, both systems are run constantly, the rationality of the input is checked by the central processing unit, and when an abnormality is detected, a failure judgment device is installed that outputs a digital output. It was determined whether the process input/output device was malfunctioning or not, and the output to the controlled object was switched.

However, this method does not check the rationality of switching relays, which are most required for reliability in standby redundant duplexing, and if a switching relay malfunctions or a contact failure occurs, it cannot be detected. It was not possible to switch to the standby side.

On the other hand, the rationality check method is also performed independently on the control side and the standby side, so even if a failure is detected by the rationality check on the control side, if the failure determination device is malfunctioning, the standby side The drawback was that it could not be switched.

An object of the present invention is to provide a reliable multi-system switching control system.

The gist of the present invention is to also check the changeover switch as a rationality check.

Hereinafter, the present invention will be described in detail with reference to the drawings. FIG. 2 is a diagram showing an embodiment of the present invention.

In the figure, the parts that are double system are central processing units 1, 2,
These are process input/output devices 3, 4, control command circuits 5, 6, and changeover switches 7.8.

A control drive circuit 9 that controls the controlled object system 10, a switching control circuit (hereinafter abbreviated as "switching circuit" in some cases) 12, and a detector 11 that detects the state quantity of the controlled object system 10 are: , it is not a double system.

In this configuration, it is assumed that when everything is normal, switch 7 is on and switch 8 is off.

The switch 7.8 is controlled by a switching control circuit 12.

In this state, the processing results of the central processing unit 1, which is the main system, are converted into analog signals via the process input/output device 3,
A controlled object system 10 is controlled via a control command circuit 5, a switch 7, and a control drive circuit 9.

The control state of the controlled object system 100 is detected by the detector 11, and the control command circuits 5, 6 and the process input/output device 3,
4 has received negative feedback.

On the other hand, since it is a dual system, the central processing unit 2, which is a standby system (slave system), also performs the same processing as the central processing unit 1.

Therefore, the processing results of the central processing unit 2 are input to the control command circuit 6 via the process input/output device 4, and the control command circuit 6 outputs control commands.

However, since the switch 8 is off, this control command is not input to the control drive circuit 9.

The control command output from each control command circuit 5, 60 is negatively fed back to the central processing unit 1, 2 via the process input/output device 3, 4.

Further, the output of the switch 7.8, ie, the input to the control drive circuit 9, is negatively fed back to the central processing units 1, 2 via the process input/output devices 3, 4.

Among the above-mentioned signals, all the signals that are negatively fed back to the central processing unit via the process input/output device serve as data for fault diagnosis within the central processing unit.

Note that the outputs of the central processing units 1 and 2 are represented by la and 2a, the analog signals converted into analog signals and output from the process input/output devices 3 and 4 are represented by 3a and 4a, and the control command circuits 5 and 6 The output of 5a.

6a, the input to the control drive circuit 9 is 9a, and the detection output of the detector 11 is 11a.

Among these signals, the signals input to the process input/output devices 3, 4 are AD converted in the input/output devices 3, 4 and sent to the central processing units 1, 2.

The AD output at this time is the signal 5a on the central processing unit 1 side.
signal 5aa for signal 9a, signal 9aa for signal 9a
, signal 11a is set as signal 11aa.

Furthermore, on the central processing unit 2 side, the signal 6a is
ab, signal 9ab for signal 9a, and signal 11ab for signal 11a.

Next, FIGS. 3a and 3b show processing flowcharts of the central processing units 1 and 2 after taking in the respective AD-converted signals.

Since the processing contents of the central processing units 1 and 2 are almost the same, the central processing unit 1 is described in FIG.

Figure a shows the flow of the overall operation check.

First, the signal 1a output from the processing device 1 and the detector 11
The deviation (■) from the signal 11aa obtained from this is determined.

This deviation {circle around (2)} means the difference between the original signal of the control command and the control result obtained therefrom.

Next, the deviation (2) between the deviation (2) and the signal 5aa corresponding to the output of the control command circuit 5 is determined.

The output of the control command circuit 5 is the deviation between the input 3a and the feedback signal 11a (because it is negative feedback control), and therefore the signal 5aa
corresponds to this deviation.

Ideally, the deviation ■ becomes zero when the entire system is normal.

Taking into account the error of the entire system, a small deviation reference value is given for this normality determination.

In the next flow, it is checked whether the deviation is within this deviation reference value.

If it is within the standard deviation value, it is considered normal and a similar check is performed on the data from the next sample.

If it is thick, it is output in black to the switching circuit 12, indicating that there is an abnormality.

The above flow is a check related to the overall operation.

Next, the abnormality check of the switches 7 and 8 will be explained with reference to figure b.

First, the deviation ■ between the signal 5aa and the signal 9aa is determined.

This deviation (■) corresponds to the input/output signal difference of the switch 7.

Next, it is checked whether the deviation ■ is within the deviation reference value.

If it is within the reference value, switch 7 is determined to be normal;
If this is the case, the switch 7 is determined to be abnormal, and an output is generated to the switching circuit 12 indicating that the switch I is abnormal.

This switch abnormality means an off state due to switch inoperation or switch destruction.

The above two checks can be collectively referred to as a rationality check.

These two checks are performed independently, and when it is determined that one of them is abnormal, the other checks are not performed and switch 7 is turned off and switch 8 is turned on (However, if it is determined that switch 7 is abnormal, In this case, the switch 7 remains off, so the switch 7 is not turned off).

The switching of this switch is performed by a switching control circuit 12.

On the other hand, on the side of the central processing unit 2, which is the slave system,
The same check is performed.

However, since the switch 8 on the user's side is turned off, the check in Figure b requires checking the switch 7.

That is, the operation check of the switch on the main side is also performed on the slave side, resulting in a double check.

The reason for this is to check the contents of the switch check on the main system side and to perform an internal check of the switching control circuit that operates based on the check results.

Furthermore, if an abnormality is determined as a result of the check in diagram a on the slave side, even if the main system fails, the switch is not changed and the system is brought down.

Next, an embodiment of the switching control circuit 12 is shown in FIG.

The central processing units 1 and 2 respectively generate overall operation check signals 1b and 2b associated with the aforementioned check results, and switch check signals 1c and 2c indicating the switch check results.

The switching control circuit 12 includes AND gates 120, 121, 12
2,123°126.127,128,129, OR gate 124.125,130,131 and switching circuit 1
Has 32.

The switching circuit 132 instructs the main system and the slave system, and controls the switching of the switches 7 and 8 accordingly.

Furthermore, it has various external display functions.

This display is mainly about abnormal contents. The main system and slave system instructions in the switching circuit 132 are signal 132a.

132b.

That is, when the central processing unit 1 is the main system and the central processing unit 2 is the slave system, the first main system command signal 132a is generated, and when the opposite is true, the second main system command signal 132b is generated.

When the former signal is generated, switch 7 is turned on.
When the switch 8 is off and the latter signal is being generated, the switch 7 is off and the switch 8 is off.

Now, the first main system instruction signal 132a is transmitted to the gates 120, 121 . Subordinate game) 128, 12
9 control signals.

In this state, abnormality signal 1b for overall operation check on the main system side
, or when the switch abnormality check signal 1c is generated, a main system abnormality signal 125a is generated through the gate 125 and sent to the switching circuit 132.

In the switching circuit 132, upon receiving the main abnormality signal 125a,
After taking the timing, switch between the main system and the slave system, that is, switch 7 is turned off, switch 8 is turned on, and the central processing unit 2
Make the side the main system.

Further, the first main system instruction signal 132a is also sent to the slave side to open the gates 128 and 129.

When the abnormal signal 2c is generated in this state, an output 129a is generated through the gate 129 and becomes a signal 125a.

This is a bank amplifier signal when the switch abnormality signal 1c is not generated from the main system side even though the gate 121 is out of order or the switch 7 is abnormal.

On the other hand, when the abnormality signal 2b is generated, a signal 128a indicating that the slave side is abnormal is generated through the gate 128 and sent to the switching circuit 132.

The switching circuit 132 stores that the slave side, that is, the central processing unit 2, is abnormal, and even if the main side, that is, the central processing unit 1 side, becomes abnormal later, switching between the main system and the slave system is not performed, and the system Let it go down.

Next, when the central processing unit 2 is the main system and the central processing unit 1 is the slave system, a second main system instruction signal 132b is generated.

At this time, switch 7 is off and switch 8 is on.

In such a state, the signals 122a, 12
3a and 131a occur.

Signal 123a is for bank up like signal 129a mentioned above.

The signal 131a is a main system abnormality signal, and switching between the main system and the slave system is performed.

Like the signal 128a, the signal 122a is stored in the switching circuit 132 as an abnormality on the slave side, that is, on the central processing unit 1 side, and subsequent switching control is locked.

FIG. 5 is a diagram showing a specific embodiment of the switching circuit 132.

The control circuit 1320 includes the signals 131a shown in FIG.
In addition to 125a, 128a, and 122a, an output 124a of the gate 124 and an output 130a of the gate 130 are input.

This is not particularly shown in Figure 4.

The control circuit 1320 receives the various signals as input and outputs the signal A.

Outputs B, C, D, E, and F.

Flip-flop (FF) 1321 is for setting the main system and slave system switching mode, and FF 1324 is for central processing unit 1.
FF1325 is for storing abnormalities on the central processing unit 2 side, and FF1326 is for storing abnormalities on the side of switch 7.
is for storing abnormalities, and switch 8 of FF 1327 is for storing abnormalities.

Signal A is generated at the time of start, or when the central processing unit 1 is a slave system and the signal 131a is received, and when there is no abnormality on the central processing unit 1 side, and when the switch 7 is not abnormal, and the FF 132
1, and the first main system instruction signal 132a and amplifier 1
322 to turn on switch 7 and turn off switch 8 to switch between the main system and the slave system.

Signal B is generated when the central processing unit 2 is a slave system and the signal 125a is received, when there is no abnormality on the central processing unit 2 side, and when the switch 8 is not abnormal, resets the FF 1321, and outputs the second main system instruction signal 132b and Drive the amplifier 1323, turn off switch 7, turn on switch 8, and turn on the main system.
Switch the slave system.

Signal C is generated when the central processing unit 1 side is abnormal and is sent to FF13.
24 to memorize that fact.

The stored contents are used for external display, fed back to the control circuit 1320 to control generation of signals A and B of the control circuit 1320, and generation of a system down signal 1320a to be described later.

The signal is generated when there is an abnormality on the central processing unit 2 side, and performs the same function as described above.

Signal E is a signal when switch 7 is abnormal, and FF1
326.

Signal F is a signal when switch 8 is abnormal, and FF13
26.

Both are used for external display and for feedback to the control circuit 1320.

The system down signal 1320a is generated when both the main system and the slave system go down due to switch abnormality, and has the role of bringing down the entire system.

This signal 1320a is generated using signals C, D, E, and F.

Since the logic of this use is clear from the above explanation, the explanation will be omitted.

According to the above embodiments, a reliable dual system was achieved.

A preferred example of the present invention is a dual system in electronic turbine cabana control.

A practical example of this is shown in FIG.

In the figure, process input/output devices 3 and 4 have DA converters 34 and 44.

These inputs a and l are the processing outputs of the central processing units 1 and 2, and correspond to the signals 1a and 2a in FIG.

Furthermore, AD converters 31, 33, 35° 41.43, 45
, abnormal signal output section 30, 32°40.42.

The valve opening degree control circuit 50°60 is the control command circuit 5 in FIG.
6, with resistances 51, 52, 54, 55, respectively.
61, 62, 64, 65 and operational amplifiers 53, 63.

Contacts (AX) 70 and (BX) 80 are switch 7 in Fig. 2.
．． It corresponds to 8.

The servo valve 60 corresponds to the control drive circuit 9 in FIG. 2, and performs cabana control of the turbine 95.

Position detector 110 corresponds to state detector 11 in FIG.

Abnormality detection relays 90, 91, 92, and 93, although not shown in the figure, control a switching control circuit of a relay set corresponding to the switching control circuit 12 in FIG. 4.

Contacts 70 and 8 are controlled by the output of the switching control circuit of this relay set.
00 ON and OFF are performed.

The correspondence between the signals in FIGS. 2 and 4 is as follows.

11a→f, 9a→d, 5a→c, 6a→x.

5 aa →k, 6 aa″t, 11 aa-
)gll 1 ab-)r, 9aa→e s 9 a
b″n Furthermore, b is an abnormal signal generated as a result of the overall operation check on the central processing unit 1 side, C is a check abnormal signal of the switch 7, m is a check abnormal signal on the central processing unit 2 side, and p is a check abnormal signal of the switch 8. It shows.

The operation of the above configuration can basically be performed according to FIGS. 2, 3, 4, and 5, and therefore the description thereof will be omitted.

In the case of one-relay type, backup control of contacts is particularly effective.

In each of the above embodiments, the switch or contact is provided on the input side of the control drive circuit, but it can also be provided on the output side.

At this time, the control drive circuit itself is also duplicated.

Further, the control command circuit can also be omitted.

This is a case where the process input/output device has that role in terms of gain.

It is also applicable to multiple systems.

According to the present invention, reliable switching control of multiple systems has become possible.

[Brief explanation of drawings]

Fig. 1 is a configuration diagram of a general dual system, Fig. 2 is an embodiment of the present invention, Figs. 3 a and b are its processing flowchart, and Fig. 4
5 and 5 are diagrams showing a more specific partial embodiment, respectively, and FIG. 6 is a diagram showing another embodiment of the present invention. 1.2...Central processing unit, 3,4...
Process input/output device, 5, 6... Control command circuit, 7, 8... Control drive circuit, 10...
Controlled object system, 12...Switching control circuit.

Claims (1)

[Claims] 1. A multiplexed central processing unit, multiplexed process input/output devices each corresponding to the central processing unit, and multiplexed control means operated by the output of the multiplexed process input/output device. , a multiplexed changeover switch provided on each output side of the control means, one of which is turned on, a controlled object system controlled by the output of the changeover switch, and a controlled object system of the controlled object system. A detecting means for detecting a state associated with the control and outputting a state signal is provided, and the multiplexed central processing unit, process input/output device, and control means at the stage before the changeover switch are always in a running state in parallel. At the same time, the input/output signals of the changeover switch and the status signal from the detection means are fed back to the central processing unit via the process input/output device, and each central processing unit operates based on the fed back signals. A multi-system switching control method that checks the overall operation and the operation of the switches, and controls the switching of the changeover switches according to the results.