JPS6138500B2 - - Google Patents

Description

[Detailed description of the invention]

The present invention relates to a standby redundant self-diagnosis device in which a subcircuit operates to perform backup when a main circuit fails. In recent years, with the rapid development of electronic technology, electronic control systems have been incorporated into various devices. In this case, a standby redundant system is used in control systems that require high reliability to ensure safety, such as electrical equipment. This standby redundant system is activated to back up the control system when the main circuit fails, and FIG. 1 shows an example of a control circuit having a standby redundant system using a microcomputer. In FIG. 1, the main microcomputer 1 inputs various information and performs arithmetic processing, and outputs the output port Oa ₁ in response to the arithmetic results.
The driver transistor 2a is driven by sending a control signal A1 from the relay ₃ , and the output thereof is supplied to the excitation coil 4 via the normal cross contact 3a of the relay 3, thereby exciting the excitation coil 4 (not shown). The controlled object is driven and controlled.
In this case, the main microcomputer takes in the potential between the transistor 2a and the contact 3a of the relay 3 as the diagnostic signal B from the input port _Pa1 , and the logical relationship between the control signal _A1 and the diagnostic signal _B1 is determined in advance. If the conditions do not match, it is determined that the transistor 2a is abnormal and a failure signal _C1 is sent from the output port _Oa2 . When the failure signal _C1 is generated, the relay 3 is energized and its contacts 3a and 3b are switched to the opposite state as shown in the figure, so that the excitation coil 4 for control is connected to the transistor 2 of the main control system.
A is switched to the sub-control system transistor 2b. Furthermore, when a failure signal _C1 is generated from the main microcomputer 1, the sub-microcomputer 5, which is in a standby state and receives the same information as the main microcomputer 1, takes in this failure signal _C1 from the input port _Pb2. Start control action. The results of calculating various input information are supplied from the output port _Ob1 to the transistor _2b as a control signal A2. Therefore, by operating in response to the control signal _A2 , the transistor 2b supplies its output to the excitation coil 4 via the contact 3b to drive and control the controlled object, thereby controlling the sub-microcomputer 5. and transistor 2
A sub-control system constituted by the main microcomputer 1 and the transistor 2a backs up the main control system constituted by the main microcomputer 1 and the transistor 2a. Next, when the transistor 2b of the sub-control system fails for some reason, the sub-microcomputer 5 outputs the control signal sent from the output port Ob ₁ .
Detecting a discrepancy between A ₂ and the diagnostic signal B ₂ supplied to the input port Pb ₁ , a fault signal C ₂ is sent from the output port Ob ₂ .
Send out. When the failure signal _C2 is generated, the alarm device 6 is activated to notify that the sub-control system has also failed. However, the self-diagnosis of the standby redundant system configured in this way is performed only when a failure occurs, and by self-diagnosing the occurrence of a failure in the main control system and sending out a failure signal, the sub-control system This is effective when backing up the sub-control system, but the sub-control system cannot perform self-diagnosis until after the backup operation has started. Therefore, if, for example, transistor 2b has failed before the start of the backup operation, the start of the backup operation is simultaneously controlled down and a failure signal is sent.
_C2 is sent and the alarm device is activated, and the sub control system ends up having no backup function for the main control system. In other words, the above-mentioned standby redundant system is a circuit that is valid only on the assumption that the sub-control system is always normal in the standby state, but it is a circuit that can only be used on the assumption that the sub-control system is always normal in the standby state. It cannot be used at all for devices that require high performance. Therefore, an object of the present invention is to provide a self-diagnosis device for a standby redundant system that can self-diagnose a standby redundant system in a standby state. In order to achieve such an object, the present invention resets both the main microcomputer of the main control system and the sub-microcomputer constituting the standby redundant system when the power is turned on, and then resets the sub-microcomputer when the main microcomputer is reset. A reset signal generation circuit performs reset control of the standby redundant system self-diagnosis mode in which the standby redundant system self-diagnosis mode is reset off, and a failure signal sent from the sub-microcomputer in the standby redundant system self-diagnosis mode is judged to detect a failure of the standby redundant system. It is equipped with an alarm circuit for discrimination. DESCRIPTION OF THE PREFERRED EMBODIMENTS A standby redundant system self-diagnosis device according to the present invention will be described in detail below using embodiments shown in the drawings. FIG. 2 is a circuit diagram showing an embodiment of a self-diagnosis device for a standby redundant system according to the present invention, which is particularly applied when backing up two main control systems using one sub-control system. It is. In the figure, 10 is a first main microcomputer that constitutes the first main control system, and is an output port.
The driver 11 is operated by sending a control signal A ₁ from Oa ₁ , and the controlled object is driven and controlled by supplying power +V to the excitation coil 13 via the normal cross contact 12a of the relay 12. And, the first main microcomputer 10 is
The signal between the driver 11 and the contact 12a is used as a diagnostic signal.
By taking in from input port Pa ₁ as B ₁ , driver 1 detects a predetermined logical mismatch in comparison with control signal _A
1 detects an abnormality in the transistor or excitation coil 13 provided within the device. And this first
When the main microcomputer 10 detects the above-mentioned abnormality, it generates a failure signal C ₁ from the output port Oa ₂ , thereby activating the relay 12 and switching the contacts 12a and 12b to the opposite state from that shown in the figure. The excitation coil 13 is connected to. 15 is a second main microcomputer that constitutes the second main control system, and like the first main microcomputer 10, it has an output port.
The driver 16 is operated by sending the control signal _A3 from _Oc1 , and the controlled object is driven and controlled by supplying power +V to the excitation coil 18 via the normal cross contact 17a of the relay 17. This second main microcomputer 15
Also, by taking in the signal between the driver 16 and the excitation coil 18 as the diagnostic signal B ₃ from the input port Oc ₁ , it is possible to detect an abnormality in the transistor provided inside the driver 16 and the excitation coil 18 in the same way as in the case described above. To detect. Also, output port Oc ₂
The failure signal C ₃ output from the relay 17 drives the relay 17 and switches its contacts 17 a and 17 b in the opposite direction to that shown, thereby connecting the excitation coil 18 to the driver 19 . 20 is a sub-microcomputer constituting a sub-control system as a standby redundant system;
Second main microcomputer 10 or 15
The control signal A ₂ is configured to be sent out from the output port Ob ₁ when a fault signal C ₁ or C ₃ is supplied from the output port Ob 1 . 21 is the fault signal _C1 and inverter 2
23 is the control signal A ₂ and the OR gate 2 which receives the fault signal C ₃ as input;
An AND gate 25 searches for coincidence with the output of the OR gate ₂₁ supplied through the inverter 25 and operates the driver 14 by the output. Therefore, it is an AND gate that operates the driver 19. The sub-microcomputer 20 converts the potential between the driver 14 and the contact 12b and the potential between the driver 19 and the contact 17b into diagnostic signals B ₂ a, B ₂ b.
If the predetermined logic of the diagnostic signals B _{2 a and B 2 b} for the control signal A ₂ does not match when the fault signals C ₁ and C ₃ occur, the output port Ob ₂ is configured to send out a fault signal _C2 . Reference numeral 26 denotes an initial signal generating circuit composed of a capacitor 27 and a resistor 28 connected in series.
29 is the power supply +V from the initial signal generation circuit 26
When the initial signal IS is supplied when the sub microcomputer 20 and the first and second main microcomputers 10 and 15 are turned on, reset signals RS ₁ to _{RS 3} are sent to the sub microcomputer 20 and the first and second main microcomputers 10 and 15 in accordance with a predetermined standby redundant diagnostic mode. This is a reset signal generation circuit. In this case, the reset signal generating circuit 29 has four D-type flip-flop circuits 30a to 30d which sequentially input the set output Q as a D input, as shown in FIG.
Reset by IS. Further, this reset signal generating circuit 29 receives the clock pulse CP and the set output Q of the flip-flop circuit 30d, and inverts the output of the OR gate 31 and generates the output signal of each of the flip-flop circuits 30a to 30d.
The inverter 32 is supplied to the clock input terminal CLK of the circuit. Reference numeral 33 is an AND gate that determines the coincidence between the output of the OR gate 31 and the set output Q of the flip-flop circuit 30a and sends out a reset signal _RS1 . In addition, the flip-flop circuit 30
The set outputs Q of the circuits b and 30c are output as reset signals RS ₂ and RS ₃ , respectively. In FIG. 2, 34 indicates a failure signal C2 outputted from the sub-microcomputer ₂₀ and a reset signal outputted from the reset signal generation circuit 29.
This is an alarm circuit that detects an abnormality in the sub-control system as a standby redundant system and sends out an alarm signal AL by making judgments using RS ₂ and RS ₃ as inputs.
As shown in FIG. 4, this alarm circuit 34 includes a delay circuit 37 having an integral structure, which is composed of a resistor 35 and a capacitor 36, and which delays the failure signal _C2 , and a A flip-flop circuit ₃₉ takes the output of the delay circuit 37 as its D input and takes the reset signal RS ₃ as its clock input CLK, and flip-flop circuits 38, 39.
The set outputs of the alarm signals are input as inputs.
It is composed of an OR gate 40 that outputs AL. In the circuit constructed in this way, when a power switch (not shown) is turned on, the power +V rises as shown in FIG. 5a. Further, when the power supply +V rises, the initial signal generation circuit 26 is activated to generate the initial signal IS, and after the reset signal generation circuit 29 is reset, the reset signals KS ₁ to KS are generated according to a predetermined mode. ₃ is supplied to the sub-microcomputer 20 and the first and second main microcomputers 10 and 15, thereby setting the sub-microcomputer 20 forming a standby redundant system into a self-diagnosis mode. Below, before explaining the operation in the standby redundant system self-diagnosis mode, the operation of the reset signal generation circuit 29 will be explained. In FIG. 3, when the initial signal IS is supplied when the power supply +V is turned on, all flip-flop circuits 30a to 30d are reset. Next, when a clock oscillator (not shown) is activated as the power supply +V is turned on, a clock pulse CP shown in FIG. 5B is supplied to one input terminal of the OR gate 31. This clock pulse CP is supplied to the inverter 32 via the OR gate 31, so that it is inverted as shown in FIG.
is supplied to The flip-flop circuit 30a is
Since power +V is always supplied to the D input,
It is set at the rising edge of the clock pulse CP, and its set output Q rises as shown in FIG. 5d. When the set output Q of the flip-flop circuit 30a becomes "H", since the set output Q is used as the D input of the flip-flop circuit 30b, it is set at the next rising edge of the clock pulse CP shown in FIG. It rises as shown in Figure 5e. Similarly, since the flip-flop circuit 30c uses the set output Q of the flip-flop circuit 30b as the D input, it is set at the third rising edge of the clock pulse CP shown in FIG.
Stand up as shown. Since the flip-flop circuit 30d constituting the final stage uses the set output of the flip-flop circuit 30c as its D input, it is set at the rising edge of the clock pulse CP shown in FIG. 5b, and its set output Q is shown in FIG. 5g. stand up like that. Since the set output of the flip-flop circuit 30d is supplied to the other input terminal of the OR gate 31, the output of the OR gate 31 is set to "H" and the inverter 32 is
By keeping the outputs of the flip-flop circuits 30a to 30d fixed at "L", the set outputs Q of the flip-flop circuits 30a to 30d are kept all at "H". On the other hand, the AND gate 33 receives the output of the inverter 32 and the set output Q of the flip-flop 30a, and during the period from when the flip-flop circuit 30a is set to when the flip-flop circuit 30d is set, the output of the OR gate 31 is input to the AND gate 33. After the flip-flop circuit 30d is set, the pulse output shown in FIG. Therefore, by taking out the output of the AND gate 33 as the reset signal _RS1 , the set output of the flip-flop circuit 30b as the reset signal _RS2 , and the set output of the flip-flop circuit 30c as the reset signal _RS3 , the results shown in FIGS. , f, the reset signals RS ₁ to _{RS 3} are reset to the first to fourth signals shown in Table 1 every time the clock pulse CP is supplied.
mode and continues to hold this fourth mode.

[Table] In other words, the reset signal generation circuit 2 shown in FIG.
At step 9, when the initial signal IS is supplied, all reset signals RS ₁ to RS ₃ become "L" and the sub microcomputer 20 and the first and second microcomputers 10 and 15 are reset. Each time the clock pulse CP is supplied, the reset operation is sequentially canceled starting with the sub microcomputer 20 forming the standby redundant system. Next, the self-diagnosis operation of the standby redundant system when the power is turned on will be explained. As shown in FIG. 6a, when the power supply +V is turned on at time _t1 , the reset signals _RS1 to _RS3 sequentially undergo the changes shown in FIGS. 5b, c, and d as described above. And at time t ₁
In the first mode indicated by ~ _t2 , the reset signals _RS1 to _RS3 all become "L" as shown in Table 1, and the sub microcomputer 20 and the first and second main micro computer 1
0 and 15 are reset. During the reset period of the sub microcomputer 20 and the first and second main microcomputers 10 and 15, the failure signals C ₂ , C ₁ , and C ₃ are set to "H" as shown in FIG. 6 e, f, and g. This indicates that a failure has been detected. Next, at time _t2 , the reset signal _RS1 is inverted to "H" as shown in FIG. 6b, so that the reset for the sub microcomputer 20 is released. As a result, the sub microcomputer 20 receives the failure signal of the first and second main microcomputers 10 and 15 between time points _t2 and _t3 .
By inputting C ₁ and C ₃ , control signal A ₂ is sent out for backup operation. in this case,
If fault signals C ₁ and C ₃ are generated at the same time,
Since the fault signal C ₃ is supplied to the OR gate 21 via the inverter 22, the fault signal C ₁ has priority, so the output of the AND gate 23 becomes "H" and the driver 14 is activated. In this case, since the contacts 12a and _12b of the relay 12 are switched by the failure signal C1 sent from the first main microcomputer 10, the excitation coil 13 is driven by the output of the driver 14. That will happen. In this case, the potential between the driver 14 and the contact 12b is
By taking in the diagnostic signal B ₂ a, self-diagnosis of the driver 14 and the excitation coil 13 is performed in relation to the control signal A ₂ . If the self-diagnosis result is normal, the failure signal _C2 becomes "L" as shown in Figure 6g between time points _t3 and _t4 , and if there is an abnormality such as a disconnection or short, the As shown at time t ₃ to _{t 4} in FIG. Next, when the time point _t4 is reached, the reset signal _RS1 becomes "L" as shown in FIG. 6b and c, and
The reset signal _RS2 becomes "H" and only the first main microcomputer 10 is released from the reset state, and self-diagnosis of the driver 11 and excitation coil 13 is performed between time points _t4 and _t5 . and,
If the diagnosis result is normal, the fault signal _C1 is set to "L" as shown at time _t5 in FIG. 6e. When the time point _t6 is reached, the reset signal _RS1 becomes "H", so that only the second main microcomputer 15 is held in the reset state. As a result, only the failure signal _C3 becomes "H" as _shown at time _t6 in FIG. In this case, since the failure signal C ₁ is "H", the "L" output of the inverter 22 is supplied to the inverter 25 via the OR gate 21, and accordingly, the control signal A ₂ is The driver 19 will be driven only through the gate 24. Since the relay 17 has its contacts 17a and 17b switched by the fault signal _C3 ,
The excitation coil 18 is driven by the output of the driver 19, and the driver 19 and the contact 17b
The potential between them is supplied to the sub-microcomputer 20 as a diagnostic signal B ₂ b. If the diagnostic signal B ₂ b is normal in relation to the control signal A ₂ , the sub-microcomputer 20 detects the timing t ₇ at the time t 7 in FIG. 6g.
The failure signal _C2 at the "L" level is sent out as shown at ~ _t8 , and if the diagnosis result is abnormal, it momentarily becomes "L" as shown at time _t7 ~ _t8 in Figure 6i. The fault signal _C2 of "H" level is sent. When the time point _t8 is reached, the reset signal _RS1 becomes “L”
Since the reset signal _RS3 is inverted to "H", only the sub microcomputer 20 is reset. Second main microcomputer 15
performs a self-diagnosis between time t ₈ and t ₉ ,
If it is normal, the failure signal _C3 shown in FIG. 6f is set to "L" at time _t9 . When the time point _t10 is reached, the reset signal _RS1 becomes "H" as shown in FIG. 6b, and the reset of the sub-microcomputer 20 is released, thereby completing all self-diagnosis operations of the standby redundant system. All microcomputers become operational. In addition, in this self-diagnosis mode, operating current is supplied to the excitation coils 13 and 18, but since this diagnosis mode is a momentary operation, it takes a long time before the controlled object is driven and controlled. It's not enough and it doesn't cause any problem. Next, the fault signal C ₂ as a self-diagnosis result signal of the standby redundant system detected in this way is separated in the alarm circuit 34, so that the fault signal C 2 becomes the fault signal C ₂ at time t in FIG. 6h. ₃ to _t4 and the case shown between time points _t7 to _t8 in FIG. 6i are detected and an alarm signal AL is sent out. Hereinafter, this discrimination operation will be explained in detail using FIG. 4. First, when the initial signal IS is supplied when the power +V is turned on, the flip-flop circuits 38 and 39
is reset. In this state, when the fault signal C ₂ is supplied from the output port Ob ₂ of the sub-microcomputer 20, this fault signal C ₂ is delayed by a time Δt in the delay circuit 37, and then the flip-flop circuits 38, It is supplied to the D input terminal of 39. On the other hand, a reset signal RS ₂ is supplied to the clock input terminal CLK of the flip-flop circuit 38.
The clock input CLK of the flip-flop 39 is supplied with a reset signal _RS3 . Therefore,
Each flip-flop circuit 38, 39 has a reset function.
The determination is made based on the presence or absence of the failure signal C ₂ supplied via the delay circuit 37 when RS ₂ and RS ₃ are supplied. For example, as shown in FIG. 7a, when the fault signal _C2 in the normal state is delayed by Δt in the delay circuit 37 and then supplied to the flip-flop circuits 38 and 39, the reset signal C2 shown in FIG. 7b is generated. signal C ₂
At the time _t4 when the flip-flop circuit 38 rises, the D input signal of the flip-flop circuit 38 is delayed and becomes "L" as shown in FIG. 7a. Therefore, since the flip-flop circuit 38 is not set and its set output Q continues to be in the "L" state, the OR gate 4 is
From 0, the alarm signal AL is output as shown in Figure 7c.
is not sent. Next, as shown in FIG. 8a, at time t ₂ in FIG. 6h,
When the failure signal _C2 at the time of abnormality of the buffer 14 or the excitation coil 13, indicated by _t7 , is supplied to the D input of each flip-flop circuit 38, 39 via the delay circuit 37, the reset signal shown in FIG. 8b is generated.
At time _t4 when _RS2 rises, flip-flop circuit 38 is set. Therefore, or gate 4
0, the set output Q of the flip-flop circuit 38 is sent out as an alarm signal AL indicating that the standby redundant system is abnormal, as shown in FIG. 8c. Next _, as _shown in FIG.
At the time _t8 when the reset signal _RS3 shown in FIG. b switches to "H", it becomes "L" due to a delay. Therefore, the flip-flop circuit 39 is not set, and the alarm signal AL output from the OR gate 40 continues to be in the "L" state as shown in FIG. 9c. Next, if the driver 19 and exciting coil 18 are abnormal, a failure signal C ₂ shown in FIG.
is supplied via the delay circuit 37. in this case,
The fault signal C ₂ is the reset signal RS ₃ shown in FIG. 10b.
The flip-flop circuit 39 is set because it is at "H" at the time _t8 when it is inverted to "H". As a result, the flip-flop circuit 39
From the OR gate whose input is the set output Q of
"H" level alarm signal shown in Figure 10c
AL is sent to indicate that the standby redundant system is abnormal. Therefore, if the self-diagnosis operation of this standby redundant system is expressed using a flow card, it will be as shown in FIG. 11. Next, the first or second main microcomputer 10, 15 of the sub microcomputer 20
The backup operation will be explained. for example,
When the driver 11 is in an abnormal state such as a short circuit or short circuit for some reason, the first main microcomputer 10 converts the diagnostic signal B ₁ into the control signal A ₁
The occurrence of an abnormality is detected and a failure signal _C1 is sent by making a judgment based on the relationship between Fault signal C ₁
When the signal is sent out, the relay 12 is switched and the excitation coil 13 is connected to the backup system driver 14. Furthermore, when the failure signal _C1 is generated, the sub-microcomputer 20 operates and sends out the control signal _A2 . In this case, since the output of the OR gate 21 is "H" due to the failure signal _C1 , the AND gate 23 is selected and the control signal _A2 is supplied only to the driver 14. Therefore, the driver 14 is operated by the control signal _A2 , and the output of the driver 14 drives the excitation coil 13 to perform a control operation on the controlled object by backup. In addition,
This backup operation is also performed for the second main microcomputer 15 in the same way. When the first and second main microcomputers 10 and 15 simultaneously generate failure signals C ₁ and C ₃ , the circuit consisting of the OR gate 21 , inverters 22 and 25 and AND gates 23 and 24 is activated. Due to priority selection, the backup operation for the first main microcomputer 10 is performed first. Also,
In the above embodiment, a case has been described in which a standby redundant system using one sub-microcomputer 20 backs up two main control systems using the first and second main microcomputers 10 and 15. However, the number of main control systems can be set freely. As explained above, the self-diagnosis device for a standby redundant system according to the present invention resets the main control system and the sub control systems that make up the standby redundant system when the power is turned on, and then releases the reset only for the sub control. Therefore, by forcibly generating a failure signal from the main control system, the backup operation is performed for only a moment, and the standby redundant system performs self-diagnosis in this state. Therefore, a self-diagnosis of the standby redundant system is performed every time the power is turned on, and although the configuration is simple, it has the excellent effect of greatly improving reliability.

[Brief explanation of the drawing]

Fig. 1 is a circuit diagram showing an example of a control system having a standby redundant system, Fig. 2 is a circuit diagram showing an embodiment of a self-diagnosis device for a standby redundant system according to the present invention, and Fig. 3 is shown in Fig. 2. A circuit diagram showing a specific example of the reset signal generation circuit, FIG. 4 is a circuit diagram showing a specific example of the alarm circuit shown in FIG. 2, and FIGS. 5 to 10 explain the operation of the circuit shown in FIG. 2. FIG. 11 is a flowchart showing the self-diagnosis operation of the standby redundant system. 10, 15... First and second main microcomputer, 11, 14, 16, 19... Driver, 12, 17... Relay, 13, 18... Excitation coil, 20... Sub microcomputer, 2
6... Initial signal generation circuit, 29... Reset signal generation circuit, 34... Alarm circuit.

Claims (1)

[Claims] 1. A main control system that is controlled by a main microcomputer and performs self-diagnosis of the control system, and a sub-microcomputer that is operated by a fault signal supplied from the main microcomputer. a standby redundant system that performs backup and self-diagnosis; a reset signal generation circuit that resets the main control system and the standby redundant system when power is turned on and releases the reset of the standby redundant system first; A standby redundant system comprising an alarm circuit that sends out an alarm signal indicating an abnormality in the standby redundant system by inputting and determining a failure signal output from a sub-microcomputer of the system and a reset signal output from the reset signal generating circuit. System self-diagnosis device.