JPS62221740A - Bus synchronization collating system for microcomputer - Google Patents

Abstract

PURPOSE:To avoid a system breakdown due to a temporary noise by resetting the stop output of a collation signal at every counting of discordance of data until the prescribed permission frequency of discordance is attained and then delivering again the collation signal. CONSTITUTION:When the discordance of data is produced on a bus between microcomputers 1 and 2 and the collation signal of a collation circuit 3 is stopped, no output of a waveform converting circuit 6 is delivered any more. Thus a NOT gate 8 has an output of '1'. A fail-safe counter 5 decreases the counted value of the preset discordance permission frequency by 1 with the input of a single clock pulse. At the same time, the counter 5 outputs a single reset pulse to reset the collating action of the circuit 3 via an OR gate 9. This action is repeated every time a clock pulse is received and no counting action is carried out any more when the discordance permission frequency is decreased down to 0. Thus no reset pulse is delivered as well. Thus the circuit 3 stops continuously the collation signal.

Description

DETAILED DESCRIPTION OF THE INVENTION Field of the Invention The present invention relates to a bus synchronization verification method for fail-safe microcomputers.

Ensuring safety is the first condition for conventional technology railway signal safety equipment, etc., and it is imperative that the equipment be configured so that it is always fixed on the safe side in case of any failure, that is, it must be fail-safe. It is a condition.

In recent years, with the development of microelectronics, smaller and more highly functional safety devices have been provided by introducing electronics, particularly microcomputers, in place of conventional mechanical or electrical devices. However, even in this case, it is essential to ensure fail-safety as in the past, and the microcomputer that is the key to the system must also ensure fail-safety.

Conventionally, in a system incorporating a microcomputer as described above, a method called a path synchronization verification method has been adopted as one of the methods for achieving fail-safety of the microcomputer. This system operates multiple microcomputers synchronously, verifies the data of each prefecture's bus 1- one by one for each machine cycle, and when normal, the collation circuit outputs an alternating current signal as a collation signal indicating normal operation. If even a single bit mismatch occurs, the output of the AC signal will be stopped, and the AC signal will not be output (unless reset).
11 will not be output, thereby ensuring fail-safe against abnormal operation of the microcomputer.

Problems to be Solved by the Invention According to the conventional bus synchronization verification method described above, the data of each prefecture is verified for each machine cycle of the microcomputer configured in a serial multiplex system, so that abnormal operations such as failures can be reliably prevented. The failsafe in this aspect is well established.

However, on the other hand, the noise resistance of the system is particularly sensitive to transient noise such as impulse noise, and there is a risk that the system may go down due to transient noise, so it is necessary to implement a noise filter. If electromagnetic shielding, etc., are not completely applied, problems will arise in system availability.

The present invention was invented based on the above-mentioned circumstances, and it is an object of the present invention to provide a path synchronization verification method that has excellent noise resistance against transient noise.

Means for Solving the Problems In order to solve the above-mentioned problems, the present invention operates microcomputers configured in a serial multiplex system synchronously, and constantly collates the data of each prefecture's path for each machine cycle. In a bus synchronous verification method configured to monitor data match/mismatch, to constantly output a verification signal indicating a normal operating state when data matches, and to stop the verification signal when data mismatch occurs. , prepare in advance the number of times the data matching is allowed for discrepancies, initialize the number of times the data matching is allowed when the system is activated by turning on the power, constantly monitor the presence or absence of the matching signal, and when the matching signal stops. , when the value of the fail-safe counter has not reached the initialized value, the counter value is incremented by 1 count and a system initialization signal is generated to perform verification (1). If you do something stupid and the candy on the counter reaches the initialized value, the counter value will no longer increment, the initialization signal will no longer be generated, and the verification signal will stop outputting. It is configured to be fixed in a certain state.

When a data mismatch occurs, the output stop of the verification signal is reset every time the data mismatch is counted until a predetermined allowable number of mismatches is reached, and the verification signal is output again. For this reason,
If the data returns to a matching state before reaching the allowable number of mismatches, at that point the verification signal returns to the continuous output state, and the system does not stop operating. Therefore, if the allowable number of discrepancies is set to an optimal value according to system specifications, external conditions, etc., the verification signal will not stop due to temporary noise such as impulsive noise, and the system will run out. Can defend against 1F.

Example Embodiments of the present invention will be described below with reference to the drawings.

The drawing shows an example of a bus synchronization verification circuit constructed by applying the bus synchronization verification method according to the present invention, and is an example of a serial dual system configuration using two microcomputers.

In the figure, 1 and 2 are A-system and B-system microcomputers (hereinafter abbreviated as microcomputers), respectively, and 3 is a check to see if all bits match the bust data of microcontroller 1.2 at each machine cycle. The verification circuit outputs an alternating current signal as a verification signal while they match, and stops the alternating current signal when a mismatch occurs.

The circuits indicated by symbols 1 to 3 are the same as the circuits based on the conventional bus synchronization verification method, and the bus synchronization verification method according to the present invention is the same as the circuit shown in the conventional bus synchronization verification circuit as described below. This is realized by adding circuit 4.

That is, the automatic reset circuit 4 presets the allowable number of data mismatches, a fail-safe counter 5 that counts the number of data mismatches, and a waveform conversion circuit that converts a verification signal consisting of an AC signal into a DC signal convenient for processing. 6. Consists of an AND gate 7 and a NOTOR gate 9 for constantly checking and extracting the presence or absence of a verification signal at clock intervals according to a clock pulse of a constant period, and an OR gate 9 for transmitting a reset signal.

In the circuit configured as described above, the system of the present invention is realized as follows.

When the power is turned on for system operation, an initial reset pulse is given to the verification circuit 3. The microcomputer 1.2 is initially reset, and the fail-safe counter 5 in the automatic reset circuit 4 is preset with a pre-prepared permissible number of data collation discrepancies.

During normal operation of microcontrollers 1 and 2 in synchronized operation, A
Since the data appearing on the B-system bus and the data appearing on the B-system path match, the verification circuit 3 outputs a verification signal (AC signal) indicating normal operation. While this verification signal is being output, the waveform conversion circuit 6. Since the “O” signal is applied to one input terminal of the AND gate 7 by the NOT gate 8, the clock pulses that arrive at a constant period and applied to the other input terminal of the AND gate 7 cannot be input to the fail-safe counter 5. Therefore, the fail-safe counter 5 never starts a counting operation.

Now, if a mismatch occurs between the data on paths L of the microcontrollers 1 and 2 due to some reason and the verification signal of the verification circuit 3 stops, the output of the waveform conversion circuit 6 disappears, so the NOT gate 8 outputs a state of "1". becomes. Therefore, when a clock pulse is input to the other input terminal of the AND gate 7.

The clock pulse is input to the failsafe counter 5. 1 clock pulse in failsafe counter 5
When the number of discrepancies is input, the failsafe counter decrements (subtracts) the preset allowable number of discrepancies by l counts, and outputs one reset pulse.
The verification operation of the verification circuit 3 is reset via the OR gate 9. By this reset, the verification circuit 3 restarts the verification operation of the data on the path.

-1- After a predetermined period of time has elapsed after outputting the reset pulse (at least the operating time until the post-reset verification circuit 3 completes the data verification confirmation operation and obtains the verification signal), When the next clock pulse arrives at the AND gate 7, if the verification circuit 3 is still in a state where the verification signal is stopped at this point, the clock pulse is input to the failsafe counter 5, and the number of allowed mismatches is increased by one more. While decrementing the count, one reset pulse is output, and the verification operation of the verification circuit 3 is reset again in the same manner as described above.

The above operation is repeated every time a clock pulse arrives, and when the allowable number of discrepancies in the fail-safe counter 5 is decremented to O, the fail-safe counter 5 continues counting even if a clock pulse is input from now on. Therefore, no reset pulse is output.

As a result, the verification circuit 3 stops supplying the verification signal when the permissible number of data verification mismatches has been reached, and the abnormal operation of the microcomputer is detected.

If the verification signal from the verification circuit 3 is output again during the counting operation of the fail-safe counter 5, the counting operation of the fail-safe counter is stopped at that point, and the abnormal operation of the microcomputer is temporarily stopped. It is determined that the incident was a temporary one. Therefore,
Impulsivity can be reduced by appropriately selecting the permissible number of mismatches in data matching preset in the fail-safe counter 5 and the repetition period of the clock pulse that determines the sampling time for data mismatches, depending on system specifications, external conditions, etc. It is possible to mask transient abnormal operations of the microcomputer due to noise, etc., and the system does not go down due to excessive reactions.

In addition, in the embodiment described in -, a case is shown in which an AC signal is used as a verification signal in order to make a fail-safe signal, but if fail-safe can be achieved by other methods, a DC signal is used as a verification signal. In this case, the waveform conversion circuit 6 in the drawings can be omitted. Also, Failsafe Kalanta 5
Although a decrement (subtraction) type counter is used, it is of course possible to use an increment (addition) type counter.

Effects of the Invention Since the present invention has the configuration 2 function as explained below, it is possible to avoid system failure due to temporary noise such as impulsive noise, and to reliably detect abnormal operation when it occurs. This has the excellent effect of further improving the fail-safe properties of a system using a microcomputer and also improving the operating rate of the system.

[Brief explanation of drawings]

The drawing is a diagram showing one embodiment of a bus synchronization verification circuit configured by adopting the bus synchronization verification method according to the present invention. l, 2: Microcomputer, 3: Verification circuit, 4: Automatic reset circuit, 5: Fail-safe counter, 6: Waveform conversion circuit, 7: AND gate, 8
: NOT gate.

Claims (1)

[Claims] Microcomputers configured as a series multiplex system are operated synchronously, and the data on the buses of each system are constantly compared for each machine cycle to monitor whether the data matches or does not match.When the data match, a verification signal indicating normal operation is sent out. Along with constant output,
In the bus synchronous verification method, which is configured to stop the verification signal when a data discrepancy occurs, a permissible number of discrepancies in data verification is prepared in advance, and when the system is started by powering on, the permissible number of discrepancies is set. Initialize and
The presence or absence of the verification signal is constantly monitored, and when the verification signal stops, the counter value is incremented by one count if the value of the fail-safe counter has not reached the initialized value. At the same time, the verification signal is pre-raised by generating a system initialization signal, and after the counter value reaches the initialized value, the counter value is no longer incremented and the initial value is A bus synchronous verification method for a microcomputer characterized in that the verification signal is no longer generated and the verification signal is fixed in an output stopped state.