JPS598004A - Fail-safe circuit - Google Patents

Abstract

PURPOSE:To prevent the miscontrol of a process with a system in which the process is controlled directly by a computer, by fixing automatically the output of the computer to the safety side of the system if a fault of a program is detected. CONSTITUTION:A processor is provided to a program itself to output a signal to the outside for detection of the fault of the program. A control computer 1 calculates the signal which controls a process within a CPU4 on the basis of a command signal 2 applied via an input module 3. Then the computer 1 delivers an arithmetic result 10 via an output module 6 in the form of a control signal 11. A monitor circuit 8 judges whether the program is normally executed by the state of a fault detecting signal 7 given from the CPU4. Then the result of this judgment is delivered to the module 6 as a computer output control signal 9. The module 6 judges the result 10 and blocks the output of the result 10 to set the state of computer output at the safety side of a system in case the program has a fault.

Description

DETAILED DESCRIPTION OF THE INVENTION The present invention relates to a 7 system that directly controls a process by a computer, and is provided with means for detecting a failure in a control program executed at a specific cycle. This invention relates to a fail-safe circuit that is fixed to a safe state.

As a means of detecting software failures such as infinite program loops and deadlocks, programs are arranged in one loop, and sets and resets are repeated alternately at the start of the loop or at the end of one loop. An alternating signal such as this is output to a monitoring circuit using a capacitor C and a resistor, and when the program is normal, the output of the monitoring circuit is repeatedly charged and discharged within a certain output range. Also, if the set signal or reset signal continues for a certain period or more due to a program abnormality, a fail-safe circuit can be considered, which is set so that the output range is exceeded by charging or leaving the output inactive. However, in this method, since the output of the monitoring circuit is an analog signal, the charging/discharging time constant must be set to be sufficiently larger than the program abnormality in order to prevent misdiagnosis, resulting in poor fault detection response. Another problem is that the output state of the monitoring circuit when a failure occurs varies depending on whether the alternating signal is set or reset.

In direct computer control, when a control program deviates from a normal execution state due to a hardware failure in the memory section, an object of the present invention is to send an output signal to the computer process instead of actually stopping the CPU operation. An object of the present invention is to provide a fail-safe circuit that automatically fixes to the safe side and prevents erroneous control of processes due to program runaway.

In order to maintain the fail-safe nature of a direct computer control system, the present invention provides the program itself with a process for externally outputting a signal to detect a failure in the program, and determines whether the program is being executed normally based on the state of the signal. The feature is that only when it is determined that the program calculation result is output as is, and in other cases, the calculation result is canceled and the state of the computer output is fixed to the safe side of the system. be.

Embodiments of the present invention will now be described in detail.

Figure 1 shows the configuration of a control computer equipped with the newly devised fail-safe circuit. The control computer 1, based on the command signal 2 given via the input module 3,
Calculates signals to control the process within the CPU 4,
The calculation result 10 is outputted to the process as a split skin signal 11 via the output module 6.

The memory 5 stores control programs, data, and the like. The failure detection signal 7 output from the CPU 4 to the monitoring circuit 8 is a pulse signal synchronized with the execution cycle of the control program, and the monitoring circuit 8 determines whether the program is being executed normally based on the state of the failure detection signal 7. is constantly determined, and the determination result is used as the computer output control signal 9,
Output to the output module 6. The output module 6 outputs the calculation result 1 from the CPU 4 from the state of the computer output control signal V.
0 is judged, and when the program is abnormal, the output of the calculation result lO is blocked and the computer output signal 11 is
It has the function of fixing so that it is on the safe side for the process.

As for the specific fail-safe circuit configuration, the failure detection signal 7 is set to "1" every time the control program is started.
An alternating signal is created in which "0" and "0" are alternately repeated, and the monitoring circuit 8 is connected to a capacitor as shown in FIG.
A generally conceivable method is to use an integrating circuit 14 consisting of C13 and resistor R12.

If the time constant C-R is adjusted so that the step response settling time (2) of the integrator circuit 14 is set to an appropriate value that is sufficiently longer than the program period T, the program will be activated periodically. While the failure detection signal 7 is an alternating signal with a period T as shown in FIG. However, the program deviates from the normal processing loop due to a hardware failure in the memory section, and the failure detection signal 70 is in the set or reset state as shown in Figures 4 and 5. If the above continues, the computer blade control signal 9 will be charged or not generated, and the output module 6 will receive the direct signal 9 of the computer output is within the range of the high threshold and low threshold, and if it is determined to be abnormal, the control signal 11 is sent to the pupil on the safe side of the process, for example, 0#. If a function is provided to fix it, failures and failures can be maintained. However, in this method, when a failure occurs, the computer cutting control signal 9 is set to the set state of the failure detection signal 7.
Since the analog mode can be used, failure determination processing becomes complicated, which is not desirable in terms of reliability. Furthermore, in order to prevent erroneous identification, it is necessary to make the settling time (2) of the integrating circuit 14 sufficiently long with respect to the program period T, so that after a soft failure occurs, the output module 6 outputs the computer control output signal 9. There is a problem in that the program is executed several times during the period required to fix the computer output 11 to the safe side, that is, during the dead time.

Therefore, the fail-safe circuit that we devised this time is
In order to solve the above-mentioned problems of analog fail-safe circuits, a one-shot multivibrator is applied to the monitoring circuit 8, which simplifies and increases the reliability of failure judgment processing and improves failure detection responsiveness. The aim is to As is well known, in the one-shot multi-pipe rake, the output signal becomes '1', that is, the set state, at the same time as the trigger pulse is input from the input terminal, and after the reset period tB determined by the own circuit constants has elapsed, the output signal is automatically activated. This is a logic element whose output is reset to "P0" automatically.

Therefore, if a trigger pulse signal is created during program processing as the failure detection signal 7 and outputted to the monitoring circuit 8, that is, a one-shot multifunction generator, the reset period can be extended to the trigger signal. By making the period t↓ of the pulse signal slightly longer, if the program is running normally and the failure detection signal 7 is a trigger pulse with a constant period t as shown in Figure 6, , the computer output signal 9 becomes logic acid '1'', and if a program failure occurs and the failure detection signal 7 remains at 1'' or 0'' as shown in FIGS. In other words, in order to determine whether the output module has a program failure, it is only necessary to determine whether the computer output control signal 9 is a logic acid of "0" or "1". , Since the judgment becomes very easy and the false judgment rate can be significantly reduced, the reliability of fail-safe judgment processing can be improved. ,
Since it is possible to make the period t of the trigger pulse (d-7) for failure detection into one shift, which is sufficiently short compared to the program cycle J41JT, it is possible to significantly improve the responsiveness of failure detection, that is, the detection resolution. .

According to the present invention, when a software failure such as an infinite program loop or deadlock occurs in a system where processes are directly controlled by a computer, the
The 5T feature automatically fixes the computer output to the safe side of the system without stopping the PU calculations, making it possible to maintain the fail-safe nature of the system. In particular, by using a one-shot multivibrator as a means for monitoring signals for failure detection, it is possible to increase the reliability of failure determination processing and to significantly improve detection resolution.

The structure of the fail-safe circuit invented this time is extremely simple and unique, so its industrial application is extremely important at a time when there is a growing need for the development of control systems that make full use of microcomputer technology.

[Brief explanation of the drawing]

FIG. 1 is an overall configuration diagram of a control computer equipped with the fail-safe circuit of the present invention, FIG. 2 is a time chart of an integrating circuit and its step response characteristics, and FIGS. 3 to 5 are fail-safe circuit diagrams. ] Time charts when an integrating circuit is used in the circuit, Figures 6 to 8 are time charts showing the relationship between the failure detection signal and the computer output signal when a one-shot multivibrator is used in the safe circuit. represents a chart. 1... Control computer, 3... Human power module, 4.
...CPU, 5...Memo 1c 6...Output module, 7...Failure detection signal, 8...Monitoring circuit, 9...
・Computer output control signal, 10... Calculation result, 11...
・Computer output signal. Fig. 1 Fig. 2 Fig. 9 No. 3 Sae No. 4 Senkabuto 5 Ro

Claims (1)

[Claims] 1. In a system where a process is directly controlled by a computer, means for creating a pulse signal synchronized with the execution cycle of a control program as a signal for detecting a software failure, and constantly monitoring the pulse signal. A fail-safe circuit is provided with means to automatically fix a computer output to a safe side of the system when an abnormality in the program is detected due to a change in the pulse signal. Z In the fail-safe circuit described in item 1, a signal that is set and reset at least once within the startup period of the control program is created as a detection signal, and a one-shot multivibrator is used as a means for monitoring the signal. This is a fail-safe circuit characterized by simplifying and increasing the reliability of detection processing and improving detection responsiveness.