JPS63208949A - Fail-safe system - Google Patents

Abstract

PURPOSE:To realize a simple and inexpensive constitution of a fail-safe system by detecting the presence of an abnormal signal level when the output terminal level is changed and therefore omitting the mutual monitor between microcomputers. CONSTITUTION:The data outputted from a bus 14 of a microcomputer is held in an output latch 22 by a write signal 26 and then outputted to a terminal B1 via an output buffer 21. The output of the latch 22 or the buffer 21 is selected by a selection signal 25 and read by the bus 14 via an input buffer 23 by a read signal 24. A CPU reads the signals of both the latch 23 and the buffer 21 as soon as the microcomputer outputs data to confirm the coincidence between the latch 22 and the buffer 21 and the output data. Then the CPU starts an abnormality process if no coincidence is obtained from said collation.

Description

DETAILED DESCRIPTION OF THE INVENTION [Field of Industrial Application] The present invention relates to a fail-safe system using a microcomputer.

[Conventional technology]

In recent years, various application systems using microcomputers have become increasingly sophisticated and have a wealth of functions, and there are extremely strong demands for reliability of the application systems.

For this reason, application systems are also equipped with several protection circuits and monitoring circuits, and there is an increasing demand for systems with redundant circuits.

A conventional example of the most basic duplex system will be explained with reference to FIG. The microcomputer 50 and the microcombi 1-51 are executing the same program synchronously and each outputs a signal. A microcomputer 52 constantly monitors the wired-OR signals output from the microcomputer 50 and the microcomputer 51. Each microcomputer 50゜5
1 is transmitted to the microcomputer 52 via a signal monitor line 54 and a signal monitor line 55, and the signal level of the signal monitor lines 54 and 55 is constantly compared with the output signal 560 level. There is. If there is an abnormality in the data output from the output terminal of the microcomputer 50 or the microcomputer 51, this is detected and the microcomputer 50 or 51 is disconnected from the output signal line 56 to recover. .

[Problem that the invention seeks to solve]

The conventional method described above requires a microcomputer to monitor the level of the output signal in addition to the microcomputer that controls the external equipment, resulting in high costs and problems with economic efficiency. This method has the disadvantage that the amount of software that must be used is doubled, which is more likely to cause bugs.Furthermore, the amount of wiring between microcomputers has increased, resulting in an increase in the board area and a decrease in reliability.

(Means for Solving the Problems) The fail-safe system of the present invention has an output terminal that outputs the level held in the output holding means, and reads the level held in the output holding means and the output terminal level, respectively. and an instruction for updating the level held in the output holding means and comparing the level held in the output holding means and the output terminal level a predetermined number of times using the reading means. Consisting of a plurality of microcomputers, when there is one microcomputer, a plurality of output terminals having the same function are wired-OR connected, and when there are multiple microcomputers, the output terminals of each microcomputer are wired-OR connected. The microcomputers are characterized in that they output while monitoring each other's output terminal levels.

[Effect]

By using a system using a microcomputer that has instructions that can detect output level abnormalities by comparing the level held in the output holding means and the level of the output terminal when updating the output terminal level, the output There is no need for a microcomputer to monitor the signal level, and a duplex system can be constructed at low cost.

〔Example〕

Next, embodiments of the present invention will be described with reference to the drawings.

FIG. 1 is a block diagram of an embodiment of the fail-safe system of the present invention. The output terminals of the microcomputer 30 and the microcomputer 31 are wired-OR connected, and an output signal 33 is used to control an external device. Since the output terminals of the microcomputers 30.degree. 31 can be monitored by each microcomputer 30.degree. 31, no microcomputer is required to monitor the output signal.

FIG. 2 is a block diagram of the microcomputer 30.31. The microcomputers 30 and 31 include a CPU 10 that performs arithmetic processing, and a ROM 11 that stores programs in advance. Instruction processing is executed using a RAM 12 in which data necessary for arithmetic processing is temporarily stored and a bus 14. The CPU 10 includes an arithmetic operation unit (hereinafter referred to as ALU) 100 and a temporary latch 101. C.P.L.J.
LO retrieves a command word from the ROM 11, interprets the command word, generates various control signals, and performs command processing. c.
When the pu i o outputs data to the boat 13, the data is written to the boat 13 via the bus 14, and the data is output from the output terminals 131, 132 and 133.13a.

FIG. 3 is a block diagram of the boat 13. The boat 13 has four output terminals 1.3+, 132, 133, and 134, but each output terminal has the same function, so the explanation will focus on the output terminal 131 here. Boat 13 is
Output latch 22 . captures data from bus 14 with write signal 26 . Output buffer 21. A selector 27 that outputs the level of the output terminal 131 when the select signal 25 is high level, and outputs the level of the output latch 22 when the select signal 25 is low level. It is composed of a buffer 23 that outputs the output of the selector 27 to the bus 14 when the read signal @24 is at a high level.

When the CPU 10 reads an instruction word for outputting data to the port 13, it performs the following processing.

■ Activate the write signal 26 and output latch 22
data is taken in from the bus 14.

(2) By setting the select signal 25 to high level and simultaneously setting the read signal 24 to high level, the level of the output terminal 131 is outputted to the bus 14 via the bus buffer 23.

■ The CPU 10 outputs the output terminal 131 to the bus 14.
The level of is stored in a temporary latch 101 used during calculation.

(2) By setting the select signal 25 to a low level and simultaneously setting the read signal 24 to a high level, the level of the output latch 22 is outputted to the bus 14 via the path buffer 23.

■ CPtJlo uses ALUloo to connect bus 14
The level of the output latch 22 output to the temporary latch 101 is compared with the level of the output terminal 131 stored in the temporary latch 101.

■ The procedure of ■■■■ is repeated a predetermined number of times in order to prevent a mismatch determination due to comparison in the true@transition state.

(2) If a mismatch is detected after a predetermined number of comparison operations, it is determined that the signal level is abnormal due to signal collision, element destruction, etc., the process branches to a predetermined address, and abnormality response processing is performed. If they match, it is assumed that the data has been output normally, and the next instruction is executed.

Next, the signal level abnormality detection operation in the fail-safe system of this embodiment will be described.

Microcomputer 30 and microcomputer 31
Since the output terminals of the two are connected to each other, abnormal signal levels are simultaneously detected and the system is shut down. Next, in order to find the cause of the signal level abnormality, first disconnect the output terminal of the microcomputer 30 from the output signal 33,
Both microcomputers 30 and 31 execute the instruction to output data to the boat 13. At that time, if no signal level abnormality occurs in the microcomputer 31 and an abnormality occurs in the microcomputer 30, the system is restored with the microcomputer 30 disconnected. On the other hand, if a signal level abnormality occurs in the microcomputer 31 and no abnormality occurs in the microcomputer 30, the microcomputer 30 is connected, and conversely, the microcomputer 31 is disconnected to restore the system. Furthermore, when both microcomputers 30 and 31 have abnormal signal levels, it is determined that the system is down, and all controls are stopped.

In the above-mentioned embodiment, an example using two microcomputers was shown, but if there is enough output terminal, it is possible to construct a 7-else-7 system with a one-chip configuration as shown in FIG. In this embodiment, a program is created so as to always output equal data to two output bins. When a signal level abnormality occurs, it is determined which output terminal is abnormal by disconnecting one of the output terminals from the output signal 41, and the system is restored with the abnormal output terminal disconnected.

Although this embodiment shows an example in which only two microcomputers are used, the present invention is very effective even if more microcomputers are used.

〔Effect of the invention〕

As explained above, the present invention uses a microcomputer equipped with an instruction to always detect whether there is an abnormality in the signal level when updating the output terminal level. It is possible to create an inexpensive duplex system with fewer connection wirings.

[Brief explanation of the drawing]

FIG. 1 is a diagram showing an embodiment of the 7-ailsafe system of the present invention, FIG. 2 is a block diagram of the microcomputer 30, 31, FIG. 3 is a detailed diagram of the boat 13 in FIG. 1, and FIG. FIG. 5 is a diagram showing another embodiment of the fail-safe system of the present invention, and FIG. 5 is a diagram showing a conventional fail-safe system. 10...CPLI, 11...ROM. 12...RAM, 13...Boat, 14
... Bus, 13+, 132, 133, 134 ... Output terminal, 2
1... Output buffer? , 22... output latch, 23...
...Bus buffer, 24...Read signal, 25...
Select signal, 26... Write signal, 27... Selector, 30.31.40... Microcomputer, 33.
41...Output signal.

Claims (1)

[Claims] an output terminal that outputs the level held in the output holding means;
means for respectively reading the level held in the output holding means and the output terminal level; and means for updating the level held in the output holding means, and updating the level held in the output holding means and the output terminal level. and a predetermined number of times using the reading means, and when there is one microcomputer, a plurality of output terminals having the same function are wired-OR connected, and the A fail-safe system characterized in that when there is a plurality of microcomputers, the output terminals of each microcomputer are wired-OR connected, and the microcomputers output while monitoring each other's output terminal levels.