JPS61260348A - Dual system computation control system - Google Patents

Abstract

PURPOSE:To prevent wrong switching or deadlock form being caused in mode of trouble by selecting and outputting either of outputs of dual system computers through a system switching logical part according to the result of exclusive OR between independent switching command output values of respective systems from a computation controller. CONSTITUTION:The system switching logical part consists of an exclusive OR gate (EOR gate) 21, AND gates 22 and 23, and an inverter 24 and outputs 4a (Za) and 4b (Zb) of the respective systems are selected according to states of switching commands 7a (Sa) and 7b (Sb) from the systems, so that Za or Zb appears as a selected output 6 (Z). Namely, when a command for switching to one system is fixed through the operation of the EOR gate 21, the outputs are switched optionally by changing the switching command of one system from 0 to 1 or 1 to 0. In this case, the switching command Sa (or Sb) can be set so that even when the switching command from one system is fixed at 1 or 0 owing to trouble, the output of the normal system is selected, and control is never stopped.

Description

[Detailed Description of the Invention] [Field of Application of the Invention] The present invention relates to a dual system calculation control method, more specifically, a dual system calculation control system.
This invention relates to a system control method that switches between two calculation control devices to obtain the correct output.

[Background of the invention]

In general, in systems where objects are controlled by dual-system computers, the dual-system switching method automatically switches to a normal system when a failure occurs. When an abnormality occurs in the main system, there are two methods: one is to switch to the slave system, and the other is to monitor it with an external device and switch over.

The problem with the former is that there is a limit to its own ability to detect failures, and the latter requires extra external equipment.

Furthermore, both methods have a problem in that a large-scale device must be provided in the failure detection section in order to improve the failure detection ability.

One way to solve this problem is to mutually monitor other systems,
When an abnormality is detected in another system, there is a way to switch to the own system. However, with this method, when both are judged to be abnormal,
There are problems such as conflicting switching instructions and abnormal systems leaving switching instructions unattended.

[Purpose of the invention]

SUMMARY OF THE INVENTION In view of the above problems, it is an object of the present invention to provide a dual system switching system that does not cause erroneous switching or deadlock depending on the failure mode.

[Summary of the invention]

The present invention relates to a dual system switching method, in which each system monitors or diagnoses the other system, and based on the results, outputs a switching instruction from each system. It is defined by relationships and uses exclusive logic to achieve high availability without causing deadlock mode.

[Embodiments of the invention]

FIG. 1 shows an entire embodiment of the dual system calculation control method according to the present invention, in which 1a and 1b are the calculation control devices of each prefecture, 2 is the system switching logic, 3 is the controlled object, 4
a, 4b are control outputs from 1a, 1b to 2; 5 is a control output selected by the system switching logic; 6 is a state input of object 2; 7a.

7b is the switching command from each prefecture 1a and lb, 8 a e8b
is a transmission line through which each prefecture exchanges information with each other, and each prefecture inputs the output output to the controlled object to each, and each transfer command 7b outputs from the other system.
, 7a.

Figure 2 shows the inside of the system switching logic, including an exclusive OR gate (hereinafter referred to as FOR gate) 21, and an AND gate 22.2.
3. Consisting of an inverter 24, output 4a for each prefecture
(Za), 4b (Zb).

Depending on the state of switching commands 7a (Sa) and 7b (Sb) from each prefecture, one selected output, 6 (Z), appears as either Za or zb. Here, Za and Zb are simply represented by one line, but since it is clear that even if there are multiple output signals, it is sufficient to provide the corresponding number of gates 22 and 23, they are omitted here. It will be represented by one signal line.

Of course, the same applies to the input lines that take the signal back into each prefecture and the status input lines of the controlled objects.

FIG. 3 is a matrix representation of the operation of the circuit shown in FIG. 2, and shows how the outputs Za and Zb of each prefecture are selected depending on the states of the switching commands Sa and Sb. When the switching command for one system is fixed by the action of the EOR gate 21, it is possible to switch the switching command for the other system arbitrarily by changing the switching command from 0 to 1 or from 1 to 0.

In other words, the switching command Sa (or sb) should be set so that even if the switching command from one system is fixed at 1 or 0 due to a failure, the normal system will select the output it is outputting. becomes possible.

Control never stops.

The basic operation of system switching has been explained above, but the problem is how each prefecture issues the switching commands Sa and Sb.

Now, if each prefecture is normal and S a = S b =
Assume that it outputs 0. In this case, as shown in FIG. 3, zb, that is, the way the system 1b emerges is selected.

If a failure occurs in system 1b and control stops in this state, control device 1a inputs the selected output 2, recognizes that output Z is abnormal, and immediately switches from the own system. By changing the command Sa from O to 1, the output Z of the own system
Let a be output as Z to 5.

In this case, the state SX of the controlled object is input to both systems through the input line 6, and the output Za corresponding to the state is input.

zb is executed and output in parallel, and 1a can immediately output the necessary output Za.

On the other hand, if the system 1b is not completely out of order but outputs the wrong output zb, if it is the output device 1b, both lb and la are inputting the result Z, so it is incorrect. In this case,
For the system that you judged to be incorrect, that is, the system 1b, leave sb as is.

In the other system, that is, the system 1a, Sa is changed to 1 so that the output Za of the 1a system is added as the output Z to the target.

In another case, if there is an abnormality in the output feedback of 1b and the input is not correct, switching will not occur according to the above logic, but since a normal output is being output, there is no particular problem.

The above has shown cases in which system switching can be performed without problems when an abnormality occurs, but the above logic cannot handle all cases.

As an example, if both systems are operating normally, but an abnormality occurs in the output feedback input of the standby system, ie, the 1a system, the 1a system is assumed to have an output abnormality, and system switching is performed, but the current output is selected. The 1b system, which is currently in use, does not detect any abnormalities and continues to be in that state. In this case, the control right (the output of that system is selected) is transferred to the 1a system that has an abnormality in the input section, and the control right does not transfer thereafter. Although this situation does not lead to erroneous control, it is wasteful. This is not very desirable because it may cause a sudden switching, which may disturb the output 2 for a short time.

As a further inconvenient case, if an abnormality occurs in the input section for knowing the target state X or the processing section of the calculation control device, and a discrepancy occurs in the outputs of the two, especially if there is an abnormality in the standby system, Due to this discrepancy, an abnormal system
A switching command is issued to take control, which may result in erroneous control, and after switching, the normal system that was robbed of control detects a discrepancy in output again and regains control, resulting in hunting. A phenomenon occurs.

This situation occurs because both parties make decisions by observing only the final output Z.
This can be prevented by exchanging information between both systems.

In other words, if there is an abnormality in the feedback input of output Z, the error in the input section can be easily discovered and corrected by exchanging the input values in each system and comparing the output values Za and Zb that should have been output. It is also possible to easily determine which system is possible and which system has no abnormality, and the normal system can take control.

Furthermore, if there is an abnormality in the state input of the controlled object, a mismatch will similarly occur in the control outputs Za and Zb. In this case as well, rationality is determined by mutual information exchange, and a switching command is output so that the system that can make a more correct determination acquires the control right.

In the above, the system switching logic has been simply expressed as a logic symbol, but the implementation means thereof, such as semiconductors and relays, are not limited.

In addition, the other system switching commands 7a and 7 to each prefecture in Figure 1
The b input is used to determine whether the LA system or the LB system is currently selected.

In each prefecture, determination is made based on the truth table shown in Figure 3.

Further, the internal configuration of the calculation control device shown in FIG. 1 is already well known and does not require any special equipment, and the same applies to the transmission means for exchanging information.

〔Effect of the invention〕

According to the present invention, the system switching circuit operates with the exclusive OR of the switching commands from both systems, so that deadlock does not occur due to conflicting commands from both systems, and in addition to the switching logic, two There is no need for a device for diagnosing a heavy-duty calculation control device, and it becomes possible to construct a dual system that is economical and has a high operating rate.

[Brief explanation of drawings]

FIG. 1 is an overall configuration diagram of an embodiment of the dual system control device of the present invention, FIG. 2 is a logic diagram showing the configuration of the dual system switching logic of the present invention, and FIG. 3 is a system switching diagram of the dual system switching logic of the present invention. It is an explanatory diagram showing truth value correspondence of logic. la, lb...computation control device, 2...system switching logic,
3...Controlled object, 4a, 4b...Each system control output, 5
. . . Selected output command, 6 . . . Controlled object state input, 7a.

Claims (1)

[Scope of Claims] A single- and dual-system calculation control system comprising a pair of calculation control devices and a system switching logic section that selects an output of the calculation control device and outputs one of the outputs; A dual system calculation control method characterized in that a system switching logic unit selectively outputs one of the outputs of a dual system computer based on the result of an exclusive OR of switching command output values independent of each system. 2. In the dual system calculation control method described in item 1, the output selected by the switching logic section is independently input to each system calculation control device, and an abnormality in the output is detected. control method. 3. In the dual system calculation control method described in item 1, the calculation control device of each system mutually inputs the other switching command to determine the switching output value of each system.
Heavy system calculation control method. 4. In the dual system calculation control method described in item 1, each calculation control device is connected to each other by a transmission line, and based on the information, it is determined whether or not switching is necessary. method.