KR20130080616A - Parallel controller using can communication - Google Patents

Abstract

PURPOSE: A parallel controller using controller area network (CAN) communication is provided to detect occurrence of malfunction and to separate a broken module from a communication network by the other watchdog circuit. CONSTITUTION: When an interrupt signal is not inputted due to failure of a control unit, a first watchdog circuit unit (130) outputs a LOW signal. When the output of the first watchdog circuit unit is the LOW signal and an identification (ID) number check signal is generated and a software counter is the same as its own ID, an ID check circuit unit outputs a HIGH signal. When the interrupt signal is not inputted due to malfunction, a second watchdog circuit unit (150) outputs a blockage signal for physically blocking the first watchdog circuit unit and the ID check circuit unit in a communication line.

Description

Parallel controller using CAN communication {Parallel controller using CAN communication}

The present invention relates to a parallel controller, and more particularly, using high-speed digital can communication for load sharing and redundancy, and having two watchdogs for determining a failure and separating a communication line for failure determination. The present invention relates to a parallel controller using can communication that can perform an efficient and high-speed load sharing by inputting a module for redundancy to share a load and subsequently determining a location of a failed module.

Due to the characteristics of informatization, all communication devices and computer systems must be guaranteed for 365 days of operation. Therefore, rather than operating all loads from one power source, it is necessary to operate several power sources in parallel to share the loads to increase control reliability. It is becoming.

In general parallel operation method, active current sharing method which performs load sharing by detecting reference current through output current information of modules connected in parallel according to control structure and voltage drop method using drop characteristic of output voltage (Voltage droop method)

In addition, the main matters in parallel operation are the distribution of load current of parallel connected modules. The representative control methods among parallel operation methods are master control method which is divided into master-slave module, voltage drop method using voltage drop of output voltage, and current distribution. It can be divided into external controller method using external controller, average current method using one shared bus, and maximum current method using power deviation.

Among them, the voltage drop method controls the load sharing depending on the drop characteristic of the output voltage, and drops the output voltage in proportion to the load current to be shared, without using a current information exchange line between power supplies connected in parallel. Each module will independently control the load sharing. Therefore, in the case of the constant voltage drop method, a poor distribution results in poor distribution, load regulation is lowered, and current distribution between parallel modules having different power ratings is difficult.

In addition, in the master control method, a master module is generally used for voltage control and other modules operate as a current mode. In this method, current mode control is easy because the voltage error is proportional to the load current. However, if the master module fails, redundancy cannot be performed because the entire parallel controller cannot be used.

The inventors share and control the load in parallel by using the master and slave modules, but can perform redundancy immediately when a failure occurs in the module regardless of the master or slave, and a parallel controller capable of performing high-speed digital control. As a result, it is possible to perform high speed digital control by sending and receiving communication data between modules using can communication, and one watchdog circuit detects a failure by using two watchdog circuits, The watchdog circuit separates the failed module from the communication network so that when the failure occurs, the redundancy module can be immediately inputted. In case of failure of the master module, the slave module can replace the master module. The technical construction was developed to complete the present invention.

Accordingly, an object of the present invention is to provide a parallel controller capable of performing high-speed digital control by sharing loads in parallel in a master and slave manner, and transmitting and receiving data using can communication between modules.

In addition, another object of the present invention is to provide a parallel controller that can maintain a control state without stopping the operation of the entire controller even if a failure occurs in the master module.

In addition, another object of the present invention is to provide a parallel controller that can effectively perform parallel control in the event of a failure by putting a load of the redundancy module immediately after the failure of the slave module to share the load and check the ID of the slave module after the failure. To provide.

The objects of the present invention are not limited to the above-mentioned objects, and other objects not mentioned can be clearly understood by those skilled in the art from the following description.

In order to achieve the above object, the present invention provides a parallel controller for performing parallel control by sharing load, and includes a plurality of control modules connected to each other via CAN communication (CAN: Controller Area Network). The control modules are composed of one master module, at least one slave module and at least one redundancy module, wherein each control module: sends an interrupt signal or A control unit for receiving and generating an ID check signal and executing a software counter when a failure occurs in the control modules; A can communication unit for transmitting or receiving the interrupt signal through can communication; A first watchdog circuit unit configured to output a 'LOW' signal when the interrupt signal is not input due to a failure of the controller; When the output of the first watchdog circuit unit is a 'LOW' signal and the ID check signal is generated, the ID check circuit unit outputs a 'HIGH' signal when the software counter is equal to its ID (ID: Identification number). (ID-check circuit); When the interrupt signal is not input due to a failure of the control unit, a block signal for physically blocking the first watchdog circuit unit and the ID check circuit unit may be output from a communication line, but a time constant greater than that of the first watchdog circuit unit. A second watchdog circuit unit having a; The output lines of the first watchdog circuit unit and the ID check circuit unit are connected to the output terminals of the first watchdog circuit unit and the ID check circuit unit, respectively, and when the cutoff signal is applied from the second watchdog circuit unit. A relay unit separated from the; The controllers of the respective control modules are connected to each other using CAN communication, the ID check circuits of the respective control modules are wired-OR to each other, and the first watchdog circuits of the respective control modules are negated logically. It provides a parallel controller characterized in that the connection (wired-NOR).

In a preferred embodiment, the slave module is composed of a plurality of slave modules, the master module monitors the output of the first watchdog circuit portion and is not specified when the output of the first watchdog circuit portion is 'LOW'. It is determined that a failure has occurred in any one of the slave modules, and generates the ID check signal.

In a preferred embodiment, if it is determined that a failure has occurred in one of the slave modules, the master module checks whether the output of the ID check circuit unit is 'HIGH' at every software count increase, and the ID signal is 'LOW'. Slave module with ID of count is detected and it is determined as a faulty module.

In a preferred embodiment, the ID of the master module is '1', the ID of the redundancy module is 'n', and the slave modules have any one of '2' to 'n-1'. The master module sends the interrupt signal every interrupt period to the slave modules and the redundancy module, the slave modules receive the interrupt signal from the master module, and receive the interrupt signal from the master module. If there is no ID, the ID is reduced to '1', and if the ID is reduced to '1', it operates as a master module.

In a preferred embodiment, the redundancy module operates as a slave module when the output of the first watchdog circuit is a 'LOW' signal for a predetermined period.

In a preferred embodiment, the redundancy module operates as a slave module after the master module determines that a failure has occurred in one slave module and before generating the ID check signal.

In a preferred embodiment, when the ID check signal is generated in the master module, the redundancy module outputs a 'HIGH' signal from the ID check circuit unit to the redundancy module if the software counter is equal to its ID. Inform the presence of

The present invention has the following excellent effects.

First, according to the parallel controller of the present invention, since the control modules transmit and receive communication data through can communication with each other, high-speed digital control can be performed.

In addition, according to the parallel controller of the present invention, by using two watchdog circuits, one watchdog circuit is used to detect a failure, and the other watchdog circuit is used to separate the failed module from the communication network. Redundancy can be performed immediately after occurrence, and detection of a failed control module can be performed after input of the redundancy module, so that even if a failure occurs, it can be recovered very quickly and effectively perform parallel control.

In addition, according to the parallel controller of the present invention, even if a failure occurs in the master module, since the slave module can immediately function as the master module, it is possible to maintain the control state without stopping the operation of the entire controller.

1 is a view showing a parallel controller according to an embodiment of the present invention;
2 is a view showing the configuration of each module constituting a parallel controller according to an embodiment of the present invention,
3 is a view showing a watchdog circuit provided in each module of a parallel controller according to an embodiment of the present invention;
4 is a view showing the waveform of each part of the watchdog circuit provided in each module of the parallel controller according to an embodiment of the present invention;
5 is a view showing an interrupt waveform of each module of a parallel controller according to an embodiment of the present invention;
6 is a view for explaining a method for detecting the ID of the failure module of the parallel controller according to an embodiment of the present invention;
7 is a waveform simulating the redundancy performance speed of the parallel controller according to an embodiment of the present invention.

Although the terms used in the present invention have been selected as general terms that are widely used at present, there are some terms selected arbitrarily by the applicant in a specific case. In this case, the meaning described or used in the detailed description part of the invention The meaning must be grasped.

Hereinafter, the technical structure of the present invention will be described in detail with reference to preferred embodiments shown in the accompanying drawings.

However, the present invention is not limited to the embodiments described herein but may be embodied in other forms. Like reference numerals designate like elements throughout the specification.

Referring to FIG. 1, the parallel controller 100 according to an embodiment of the present invention is for performing parallel control by sharing a load. For example, when a parallel load such as a parallel DC / DC converter system exists, It is a device that can maintain the reliability of the system without failure by preventing inequality caused by increasing load of each converter system.

In addition, the parallel controller 100 shares and controls the loads, respectively, and a plurality of control modules 100a connected to each other through a CAN communication (CAN) using a CAN communication line (C). , 100b, 100c).

In addition, the control modules 100a, 100b, and 100c are composed of one master module 100a, at least one slave module 100b, and at least one redundancy module 100c.

In addition, although FIG. 1 illustrates that the slave module 100b includes a plurality of slave modules and the redundancy module 100c includes one redundancy module, the slave module 100b and the redundancy module 100c are illustrated in FIG. Of course, the number of) can be changed according to the user's needs or the number of loads.

In addition, the control modules (100a, 100b, 100c) is a fault detection line (D) for detecting the occurrence of a failure in addition to the can communication line (C) and a fault ID detection line (I) for detecting a unique ID of the failed module. Is further connected.

In addition, the fault detection line (D) is one of the outputs output from the control module (100a, 100b, 100c) to the fault detection line (D), any one output is 'LOW' (= '0') When connected to the negative logic sum that becomes 'LOW' (wired-NOR), the fault ID detection line (I) is output from the respective control module (100a, 100b, 100c) to the fault ID detection line (I) When any one of the outputs is 'HIGH', it is wired-OR, which is 'HIGH' (= '1').

In addition, referring to FIG. 2, the control modules 100a, 100b, and 100c may include a control unit 110, a can communication unit 120, a first watchdog circuit unit 130, and an ID check circuit unit, respectively. 140, the second watchdog circuit 150 and the relay 160.

The controller 110 transmits or receives an interrupt signal for synchronizing with other control modules, in addition to a control signal for supplying power to a load.

In addition, the interrupt signal is transmitted by the control unit of the master module 100a and received by the control unit of the slave module 100b and the redundancy module 100c.

In addition, in the case of the slave module 100b or the redundancy module 100c, when a failure occurs in the master module 100a, the slave module 100b may serve as a master module. In this case, an interrupt signal may be transmitted.

In addition, the interrupt signal is transmitted and received by the can communication line (C).

5 illustrates a waveform of the interrupt signal. Waveform 'W1' is an interrupt signal generated and output by the master module 100a, and waveform 'W1' is an interrupt signal received by the slave module 100b. The waveform 'W3' is an interrupt signal received by the redundancy module 100c. As can be seen in Figure 5 it can be seen that the interrupt signal of each control module is synchronized with each other.

In addition, the controller 110 generates and outputs an ID check signal and executes a software counter when a failure occurs in the control modules 100a, 100b, and 100c.

In addition, the ID check signal is generated by the controller of the master module 100a, and the sleeve module 100b and the redundancy module 100c receive the ID check signal generated by the master module 100a. Receive.

The software counter is commonly performed in each module when the ID check signal is generated.

In addition, the software counter is incremented by '1' from '0' and the counter is stopped after the updated and failed slave module is detected.

The can communication unit 120 transmits or receives the interrupt signal through can communication and is also used as a transmission path for the control signal.

In addition, the can communication unit 120 connects the control unit 110 of each of the control modules (100a, 100b, 100c) in a can communication with each other.

When the interrupt signal is input from the controller 110, the first watchdog circuit 130 outputs a 'HIGH' signal. When the interrupt signal is not generated due to a failure of the controller 110, ' LOW 'signal is output.

In addition, the output of the first watchdog circuit unit 130 is input to the controller 110 to allow the controller 110 to recognize whether a failure occurs in another control module that is not specified.

In addition, the first watchdog circuit units 130 of the control modules 100a, 100b, and 100c are connected to each other by a negative logic sum (Wired-NOR).

That is, when 'LOW' is output from any one of the control modules 100a, 100b and 100c, the fault detection line D becomes 'LOW'.

In addition, the controller 110 recognizes that a failure occurs in another control module when the failure detection line D becomes 'LOW'.

In this case, the redundancy module 100c is input to share the load in place of the control module in which the failure occurs.

That is, redundancy can be performed even without specifying a slave module in which a failure occurs.

In addition, the redundancy module 100c is input before generating an ID check signal after determining that a failure module is generated in the master module 100a, and is based on a period in which the failure detection line D is 'LOW'. It can be determined whether or not.

For example, when the master module 100a detects a fault module occurrence of the fault detection line D, the master module 100a immediately determines the occurrence of a fault module, and the fault detection line D has a low state. The ID check signal is generated after two cycles of an interrupt signal, and the redundancy module 100c may cause the fault detection line D to be immediately turned on as long as the 'LOW' state is maintained for two cycles of the interrupt signal. .

In addition, referring to FIG. 7, communication is interrupted due to a failure of the control module at a time point 'P ₁ ', and the CAN communication waveform 'W8' gradually disappears, but only after two cycles (400 [μs]) of the interrupt signal. It can be seen that redundancy is performed to restore the CAN communication waveform to normal, and it can be confirmed that the time P _{2 at} which communication is stopped is substantially less than one period (200 [μs]) of the interrupt signal.

3 and 4, the first watchdog circuit unit 130 may output a toggle signal 113a when the interrupt signal is present, and the toggle signal. When the toggle signal charge / discharge circuit 132 and the toggle signal charge / discharge circuit 132 output the HIGH signal when the toggle signal 113a is not charged and discharged. The gate current 133a flows, and the gate current 133a includes a fault signal output circuit 133 for outputting a 'LOW' output, which is a fault signal, to the fault detection line D.

The ID check circuit unit 140 (ID-check circuit) is for detecting a control module in which a failure occurs. When the failure detection line is 'LOW' and the ID check signal is generated, the counter of the software counter is itself. If the ID is the same as 'HIGH' signal is output.

In addition, the ID check circuit 140 of the control modules 100a, 100b and 100c is connected to the fault ID detection line I, and the fault ID detection line I is connected to the control modules 100a and 100b. The ID check circuits 140 of 100c are connected to each other by a logical OR (wired-OR).

That is, when a counter equal to its own ID is counted in each module, the module having a failure cannot output a 'HIGH' signal to the failure ID detection line I, so that the master module 100a fails. It may be determined that a failure has occurred in the slave module having the same ID as the counter having the ID detection line I being 'LOW'.

6 is a waveform illustrating a process in which the master module 100a determines which slave module has a failure based on a state of the failure ID detection line I, and the parallel controller 100 has an ID. It is assumed that includes a three slave modules of '1' to '3', and the third slave module whose ID is '3' has failed.

In addition, the waveform 'W4' of FIG. 6 shows timing pulses W4-1, W4-2, W4-3, W4-4, and W4 in which the master module 100a checks the state of the fault ID detection line I. -5), waveform 'W5' is the state of the fault ID detection line I while the software count is counting, and waveform 'W6' is the fault ID detection line when the counter is '1'. The state of (I), the waveform 'W7' is the state of the fault ID detection line (I) when the counter is '2'.

First, when the state of the fault detection line D is 'LOW' before time 400 [μs], the ID check signal is generated, and when the counter becomes '1' at time 400 [μs], the ID is '1'. 'First slave module outputs a' HIGH 'signal during a sampling period (200 [μs]). At this time, the state of the fault ID detection line I is 'HIGH'.

Next, at a time 600 [μs], the counter becomes '2', and the second slave module whose ID is '2' outputs a 'HIGH' signal during the sampling period. In this case, the state of the fault ID detection line I is 'HIGH'.

Next, at a time 800 [μs], the counter becomes '3', and the third slave module whose ID is '3' fails to output the 'HIGH' signal. At this time, the state of the fault ID detection line I becomes 'LOW', and the timing pulse of the master module 100a indicates that a fault occurs in the slave module having the counter '3', that is, the ID '3'. To judge.

In addition, timing pulses 'W4-4' and 'W4-5' are used to determine whether checking of a fault ID is completed, and two pulses continuously change the state of the fault ID detection line I to 'LOW'. If it is determined, the failure ID check is completed. In the present invention, when the state of the fault ID detection line I is detected as 'LOW' for five sampling periods, the fault ID check is completed.

In addition, the redundancy module 100c also executes the software counter when the ID check signal is generated, and outputs a 'HIGH' signal to the fault ID detection line I when the counter is equal to its ID. By doing so, the master module 100a may notify that redundancy has been performed.

In addition, when the redundancy module 100c is provided in plural, the redundancy module that is not inputted may also output a 'HIGH' signal to the fault ID detection line I when the software counter is the same as its ID. In this case, it is to inform the master module 100a that there is an extra redundancy module.

When a failure occurs in the controller 110, the second watchdog circuit unit 150 connects the first watchdog circuit unit 130 and the ID check circuit unit 140 to the failure detection line D and the failure unit. A block signal for physically blocking the ID detection line I is output.

That is, the second watchdog circuit unit 150 operates after the operation of the first watchdog circuit unit 130 and the ID check circuit unit 140 ends.

In other words, the second watchdog circuit unit 150 has a larger time constant than the first watchdog circuit unit 130.

In addition, since the second watchdog circuit unit 150 has a circuit configuration substantially the same as that of the first watchdog circuit unit 130 and only a time constant is different, a detailed description thereof will be omitted.

The relay unit 160 is connected to an output terminal of the first watchdog circuit unit 130 and the ID check circuit unit 140 at a 'b' contact point, and a cutoff signal may be output from the second watchdog circuit unit 150. In this case, the first watchdog circuit unit 130 and the ID check circuit unit 140 are physically cut off from the failure detection line D and the failure ID detection line I to control a different control module. Separate from the communication line with the module.

On the other hand, when a failure occurs in the master module 100a, since the slave module 100b cannot receive an interrupt signal, the slave module 100b does not have an interrupt signal from the master module 100a. If the ID is reduced to '1' and its ID is reduced to '1', it operates as a master module and transmits an interrupt signal to other slave modules.

That is, even if a failure occurs in the master module 100a, the slave module may be replaced with the master module, thereby maintaining the control state of the parallel controller 100.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is clearly understood that the same is by way of illustration and example only and is not to be taken by way of limitation in the present invention. Various changes and modifications will be possible.

100: parallel controller 100a: master module
100b: slave module 100c: redundancy module
110: control unit 120: can communication unit
130: first watchdog circuit unit 140: ID check circuit unit
150: second watchdog circuit unit 160: relay unit

Claims (7)

As a parallel controller for performing parallel control by sharing load,
It includes a plurality of control modules connected to each other via CAN communication (CAN: Controller Area Network, measurement controller communication network),
The control modules are composed of one master module, at least one slave module, and at least one redundancy module.
Each control module:
A control unit for transmitting or receiving an interrupt signal, generating an ID check signal and executing a software counter when a failure occurs in the control modules;
A can communication unit for transmitting or receiving the interrupt signal through can communication;
A first watchdog circuit unit configured to output a 'LOW' signal when the interrupt signal is not input due to a failure of the controller;
When the output of the first watchdog circuit unit is a 'LOW' signal and the ID check signal is generated, the ID check circuit unit outputs a 'HIGH' signal when the software counter is equal to its ID (ID: Identification number). (ID-check circuit);
When the interrupt signal is not input due to a failure of the control unit, a block signal for physically blocking the first watchdog circuit unit and the ID check circuit unit may be output from a communication line, but a time constant greater than that of the first watchdog circuit unit. A second watchdog circuit unit having a;
The output lines of the first watchdog circuit unit and the ID check circuit unit are connected to the output terminals of the first watchdog circuit unit and the ID check circuit unit, respectively, and when the cutoff signal is applied from the second watchdog circuit unit. A relay unit separated from the;
The controllers of the respective control modules are connected to each other using CAN communication, the ID check circuits of the respective control modules are wired-OR to each other, and the first watchdog circuits of the respective control modules are negated logically. Parallel controller characterized in that the connection (wired-NOR).
The method of claim 1,
The slave module is composed of a plurality of slave modules,
The master module monitors an output of the first watchdog circuit unit. When the output of the first watchdog circuit unit is 'LOW', the master module determines that a failure has occurred in any unspecified slave module, and the ID check signal. Parallel controller, characterized in that for generating.
3. The method of claim 2,
If it is determined that a failure has occurred in any one of the slave modules, the master module checks whether the output of the ID check circuit unit is 'HIGH' every time the software count is increased, and the slave has an ID of a count whose ID signal is 'LOW'. Parallel controller characterized in that it detects the module to determine that the failure module.
The method according to claim 2 or 3,
The ID of the master module is '1', the ID of the redundancy module is 'n', the slave modules have any one of '2' to 'n-1',
The master module sends the interrupt signal to the slave modules and the redundancy module every interrupt period,
The slave modules receive the interrupt signal from the master module. When there is no reception of the interrupt signal from the master module, the slave module decreases its ID by '1', and when the reduced ID is '1', the master module. Parallel controller, characterized in that operating as.
4. The method according to any one of claims 2 to 3,
And the redundancy module operates as a slave module when the output of the first watchdog circuit is a 'LOW' signal for a predetermined period of time.
The method of claim 5, wherein
And the redundancy module operates as a slave module after the master module determines that one of the slave modules has failed and before generating the ID check signal.
The method according to claim 6,
When the ID check signal is generated in the master module, the redundancy module notifies the master module whether a redundancy module exists by outputting a 'HIGH' signal from the ID check circuit unit if the software counter is equal to its ID. Parallel controller characterized by.

Images