WO2023157365A1

WO2023157365A1 - Functional safety device

Info

Publication number: WO2023157365A1
Application number: PCT/JP2022/035644
Authority: WO
Inventors: 茂倫高野; 純利川崎; 泰生山口
Original assignee: 三菱電機株式会社
Priority date: 2022-02-17
Filing date: 2022-09-26
Publication date: 2023-08-24

Abstract

The objective of the present invention is to provide a functional safety device that is able to detect an abnormality occurring in a circuit monitoring a power supply voltage before an abnormality in the power supply voltage occurs. This functional safety device (101) comprises a plurality of central processing devices (205, 206), a power supply generation unit (204), a plurality of voltage monitoring circuits (207, 208), a plurality of switches (209, 210), and a plurality of shutoff confirmation circuits (211, 212), wherein, when one central processing device among the plurality of central processing devices (205, 206) begins an operation confirmation for the voltage monitoring circuit corresponding to the other central processing device, said one central processing device outputs, to the voltage monitoring circuit corresponding to the other central processing device, a shutoff notification commanding a shutoff of the supply of the power supply voltage, and the other central processing device confirms whether the shutoff confirmation has been output, on the basis of the shutoff notification from the relevant voltage monitoring circuit.

Description

Functional safety device

This disclosure relates to functional safety devices.

In products that require compliance with functional safety, two series of processing units are provided to detect abnormalities in the power supply voltage, and the power supply voltage supplied to one processing unit is monitored by the other processing unit. is known to ensure safety.

For example, in Patent Document 1, two voltage monitoring circuits each including an AD converter monitor power supply voltages supplied to two MPUs, respectively, and when an abnormality in the power supply voltage is detected, a function is provided to notify the occurrence of the abnormality. A programmable logic controller is disclosed.

Japanese Patent Application Laid-Open No. 2019-71001

However, the controller described in Patent Document 1 does not have a function to check the operation of the voltage monitoring circuit, so if an abnormality occurs in the voltage monitoring circuit before an abnormality occurs in the power supply voltage, an abnormality in the voltage value is detected. I had a problem that I couldn't do it.

Therefore, an object of the present disclosure is to provide a functional safety device capable of detecting an abnormality that occurs in a circuit that monitors the power supply voltage before an abnormality occurs in the power supply voltage.

A functional safety device according to the present disclosure includes a plurality of central processing units that can communicate with each other, a power generation unit that generates a power supply voltage to be supplied to the plurality of central processing units, and corresponding to each of the central processing units. a plurality of voltage monitoring circuits provided to monitor whether the power supply voltage supplied to each central processing unit is overvoltage or undervoltage; a plurality of switches for cutting off supply of the power supply voltage to the plurality of central processing units when the power supply voltage supplied to the central processing units is overvoltage or undervoltage; a plurality of cutoff confirmation circuits for outputting to each of the central processing units a cutoff confirmation signal indicating that the supply of the power supply voltage to the plurality of central processing units has been cut off; When one of the central processing units among the processing units starts checking the operation of the voltage monitoring circuit corresponding to the other central processing unit, the other central processing unit transmits a cutoff notification signal instructing cutoff of the supply of the power supply voltage. The signal is output to the voltage monitoring circuit corresponding to the processing unit, and the other central processing unit confirms whether the shutdown confirmation signal is output from the voltage monitoring circuit based on the shutdown notification signal.

According to the present disclosure, for example, by checking the operation of the voltage monitoring circuit at the startup of the functional safety device and at regular intervals during operation, an abnormality occurring in the voltage monitoring circuit can be detected before an abnormality occurs in the power supply voltage. can be detected.

The objects, features, aspects, and advantages of this disclosure will become more apparent with the following detailed description and accompanying drawings.

1 is a block diagram schematically showing a configuration example of a functional safety device and its periphery according to Embodiment 1; FIG. 1 is a block diagram showing a configuration example of a functional safety device according to Embodiment 1; FIG. FIG. 7 is a block diagram showing a configuration example of a functional safety device according to Embodiment 2; FIG. 11 is a block diagram showing a configuration example of a functional safety device and its periphery according to Embodiment 3; FIG. 11 is a block diagram schematically showing a configuration example of a functional safety device and its periphery according to Embodiment 4;

<Embodiment 1>
<Schematic configuration of functional safety device and its surroundings>
Embodiment 1 will be described below with reference to the drawings. First, a configuration example of the functional safety device 101 and its periphery will be schematically described. FIG. 1 is a block diagram schematically showing a configuration example of a functional safety device 101 and its periphery according to Embodiment 1. As shown in FIG.

As shown in FIG. 1, the functional safety device 101 is communicatively connected to the detection unit 102 and the drive unit 113. The drive unit 113 is controlled according to commands output from the functional safety device 101 . The detection unit 102 detects the surrounding environment of the driving unit 113 .

Functional safety device 101 includes first input section 103, second input section 104, first arithmetic processing section 105, second arithmetic processing section 106, first voltage supply section 107, and second voltage supply section 108. , a first voltage monitoring unit 109 , a second voltage monitoring unit 110 , a first output unit 111 , and a second output unit 112 .

The detection unit 102 may be a product that detects that a user has entered a restricted area during operation on a production line in a factory. A signal for notifying that effect is transmitted to the functional safety device 101 .

The drive unit 113 may be a product that repeatedly moves a driven object on a factory production line, and drives according to the control command output by the functional safety device 101 .

The first input unit 103 and the second input unit 104 convert the signal received from the detection unit 102 into a format that can be input to the first arithmetic processing unit 105 and the second arithmetic processing unit 106 respectively, and 105 and the second arithmetic processing unit 106 .

A program created by the user is registered in advance in the first arithmetic processing unit 105 and the second arithmetic processing unit 106 . The first arithmetic processing unit 105 and the second arithmetic processing unit 106 use a program created by the user and the signals received from the first input unit 103 and the second input unit 104 so that the outputs correspond to the inputs. , and outputs the calculated control command to the first output unit 111 and the second output unit 112 .

In the functional safety device 101, two

arithmetic processing units

105 and 106 are provided in order to prevent the drive unit 113 from generating a control command that causes an erroneous operation. is guaranteed.

First voltage supply unit 107 and second voltage supply unit 108 are provided corresponding to first arithmetic processing unit 105 and second arithmetic processing unit 106, respectively. Generates the required power supply voltage.

The first voltage monitoring unit 109 and the second voltage monitoring unit 110 monitor whether the power supply voltages supplied to the first voltage supply unit 107 and the second voltage supply unit 108 are overvoltage or undervoltage, respectively. When the first voltage monitoring unit 109 and the second voltage monitoring unit 110 detect that the power supply voltages supplied from the first voltage supply unit 107 and the second voltage supply unit 108 are overvoltage or undervoltage, respectively, Safety is ensured by taking measures to prevent the power supply voltage from being supplied to the first arithmetic processing unit 105 and the second arithmetic processing unit 106 .

The first output unit 111 and the second output unit 112 convert the signals received from the first arithmetic processing unit 105 and the second arithmetic processing unit 106, respectively, into formats that can be input to the driving unit 113, and output the converted signals to the driving unit 113. .

In communication between each component, the components on the transmitting side and the receiving side conform to the functional safety standard IEC61508, so that the communication path between the transmitting side and the receiving side does not conform to IEC61508. A black channel may be employed.

When the functional safety device 101 is activated, the detection unit 102 detects the user's entry into the functional safety device 101 when the user enters the restricted area while repeatedly moving the driven object on the production line of the factory. Notify that you have entered a prohibited area. The functional safety device 101 can ensure the safety of the user by taking measures to safely stop the drive unit 113 .

An abnormality occurs in the first voltage supply unit 107 or the second voltage supply unit 108 that supplies the power supply voltage to the first arithmetic processing unit 105 and the second arithmetic processing unit 106 of the functional safety device 101, and the output is overvoltage or undervoltage. Then, the arithmetic processing unit to which the power supply voltage is supplied cannot perform correct arithmetic operations. Therefore, even though the detection unit 102 notifies the functional safety device 101 that the user has entered the restricted area, there is a possibility that the drive unit 113 cannot be stopped safely. The functional safety device 101 is designed to solve such problems, and will be described in detail below.

<Configuration of functional safety device>
FIG. 2 is a block diagram showing a configuration example of the functional safety device 101 according to Embodiment 1, and is a detailed diagram of the main part of the functional safety device 101 shown in FIG.

As shown in FIG. 2, the functional safety device 101 includes a power generation unit 204, a first central processing unit 205, a second central processing unit 206, a first voltage monitoring circuit 207, and a second voltage monitoring circuit 208. , a first switch 209 , a second switch 210 , a first cutoff confirmation circuit 211 , and a second cutoff confirmation circuit 212 .

Here, the relationship between the components in FIGS. 2 and 1 will be explained. The power generation unit 204 corresponds to the first voltage supply unit 107 and the second voltage supply unit 108 . The first central processing unit 205 corresponds to the first arithmetic processing unit 105 , and the second central processing unit 206 corresponds to the second arithmetic processing unit 106 . The first voltage monitoring circuit 207, the first switch 209, and the first disconnection confirmation circuit 211 correspond to the first voltage monitoring unit 109, and the second voltage monitoring circuit 208, the second switch 210, and the second disconnection confirmation circuit 212 correspond to the first voltage monitoring unit 109. corresponds to the second voltage monitoring unit 110 .

A power generation unit 204 converts a reference voltage 201 supplied to the functional safety device 101 into a voltage value to generate a supply voltage 203 as a power supply voltage to be supplied to the first central processing unit 205 and the second central processing unit 206. do. The generated supply voltage 203 is directly supplied to the first voltage monitoring circuit 207 and the second voltage monitoring circuit 208 as the monitoring voltage 202 . In addition, the supply voltage 203 is supplied to the first central processing unit 205 via the first switch 209 and the first cutoff confirmation circuit 211, and is also supplied to the first central processing unit 205 via the second switch 210 and the second cutoff confirmation circuit. It is supplied to the second central processing unit 206 .

When the first central processing unit 205 starts to check the operation of the second voltage monitoring circuit 208 as a circuit for monitoring the voltage value, the second voltage monitoring circuit 208 detects an overvoltage or a low voltage. A cutoff notification 1 that is a signal is output to the second voltage monitoring circuit 208 .

When the second central processing unit 206 starts to check the operation of the first voltage monitoring circuit 207 as a circuit for monitoring the voltage value, the second central processing unit 206 controls the first voltage monitoring circuit 207 to pseudo-detect an overvoltage or a low voltage. A cutoff notification 2 as a signal is output to the first voltage monitoring circuit 207 .

The first voltage monitoring circuit 207 determines whether the monitoring voltage 202 is overvoltage or undervoltage based on the difference between the reference voltage 201 supplied to the functional safety device 101 and the monitoring voltage 202 which is the supply voltage 203 supplied to the first central processing unit 205 . The first switch 209 cuts off the supply voltage 203 supplied to the first central processing unit 205 when it is determined that a voltage is generated and when the cutoff notification 2 is input from the second central processing unit 206. A shutoff command 1, which is a signal for switching, is output to the first switch 209 .

The second voltage monitoring circuit 208 determines whether the monitoring voltage 202 is overvoltage or undervoltage based on the difference between the reference voltage 201 supplied to the functional safety device 101 and the monitoring voltage 202 which is the supply voltage 203 supplied to the second central processing unit 206 . The second switch 210 cuts off the supply voltage 203 supplied to the second central processing unit 206 when it is determined that a voltage is generated and when the cutoff notification 1 is input from the first central processing unit 205. A shutoff command 2, which is a signal for switching, is output to the second switch 210 .

The first switch 209 cuts off the supply of the supply voltage 203 to the first central processing unit 205 and the second central processing unit 206 when the cutoff command 1 is input from the first voltage monitoring circuit 207 .

The second switch 210 cuts off the supply of the supply voltage 203 to the first central processing unit 205 and the second central processing unit 206 when the cutoff command 2 is input from the second voltage monitoring circuit 208 .

The first shutdown confirmation circuit 211 monitors the voltage supplied to the first central processing unit 205 and the second central processing unit 206 via the first switch 209 . When the first cutoff confirmation circuit 211 detects that the supply of the supply voltage 203 to the first central processing unit 205 and the second central processing unit 206 is cut off by the first switch 209, the first central processing unit 205 and the second central processing unit 206 It outputs to the first central processing unit 205 a cutoff confirmation 1, which is a signal indicating that the supply of the supply voltage 203 to the second central processing unit 206 has been cut off.

The second shutdown confirmation circuit 212 monitors the voltage supplied to the first central processing unit 205 and the second central processing unit 206 via the second switch 210 . When the second cutoff confirmation circuit 212 detects that the supply of the supply voltage 203 to the first central processing unit 205 and the second central processing unit 206 is cut off by the second switch 210, the first central processing unit 205 and the second central processing unit 206 It outputs to the second central processing unit 206 a cutoff confirmation 2, which is a signal indicating that the supply of the supply voltage 203 to the second central processing unit 206 has been cut off.

The first central processing unit 205 and the second central processing unit 206 are communicating with each other, and one central processing unit outputs a cutoff notification. The other central processing unit determines that the operation of the voltage monitoring circuit corresponding to the other central processing unit is normal by confirming that the interruption confirmation has been output.

<Functional safety device operation>
Next, the operation flow of the functional safety device 101 will be described. In the following description, when the states of the first voltage monitoring circuit 207 and the second voltage monitoring circuit 208 are any of the following three states, the functional safety device 101 detects that an overvoltage or undervoltage has occurred in the monitoring voltage 202. is detected to prevent the abnormal voltage from being continuously supplied to the first central processing unit 205 and the second central processing unit 206. FIG.

The first is when the first voltage monitoring circuit 207 and the second voltage monitoring circuit 208 operate normally. The second case is when the first voltage monitoring circuit 207 fails and only the second voltage monitoring circuit 208 operates normally. A third case is when the second voltage monitoring circuit 208 fails and only the first voltage monitoring circuit 207 operates normally.

First, the case where the first voltage monitoring circuit 207 and the second voltage monitoring circuit 208 operate normally will be described.

The supply voltage 203 supplied to the first central processing unit 205 and the second central processing unit 206 after voltage value conversion by the power generation unit 204 is used as the monitoring voltage 202 by the first voltage monitoring circuit 207 and the second voltage monitoring circuit 208 . and supplied to A first voltage monitoring circuit 207 and a second voltage monitoring circuit 208 determine whether overvoltage or undervoltage occurs in the monitoring voltage 202 from the difference between the reference voltage 201 and the monitoring voltage 202 supplied to the functional safety device 101 . to decide.

When the first voltage monitoring circuit 207 determines that the monitored voltage 202 is overvoltage or undervoltage, it outputs a cutoff command 1 to the first switch 209 . Further, when the second voltage monitoring circuit 208 determines that the monitored voltage 202 is overvoltage or undervoltage, it outputs a cutoff command 2 to the second switch 210 .

The first switch 209 cuts off the supply of the supply voltage 203 to the first central processing unit 205 and the second central processing unit 206 when the cutoff command 1 is input from the first voltage monitoring circuit 207 . Further, the second switch 210 cuts off the supply of the supply voltage 203 to the first central processing unit 205 and the second central processing unit 206 when the cutoff command 2 is input from the second voltage monitoring circuit 208 .

A first switch 209 and a second switch 210 cut off the supply of the supply voltage 203 to the first central processing unit 205 and the second central processing unit 206 so that the first central processing unit 205 and the second central processing unit 206 to avoid continuous supply of abnormal voltage to

Next, a case where the first voltage monitoring circuit 207 fails and only the second voltage monitoring circuit 208 operates normally will be described.

When the second voltage monitoring circuit 208 determines that the monitored voltage 202 is overvoltage or undervoltage, it outputs a cutoff command 2 to the second switch 210 . Since the first voltage monitoring circuit 207 has lost the function of determining overvoltage or low voltage due to the failure, it does not output the cutoff command 1 to the first switch 209 .

The second switch 210 cuts off the supply of the supply voltage 203 to the first central processing unit 205 and the second central processing unit 206 when the cutoff command 2 is input from the second voltage monitoring circuit 208 . On the other hand, the first switch 209 does not cut off the supply of the supply voltage 203 to the first central processing unit 205 and the second central processing unit 206 because the cutoff command 1 is not input from the first voltage monitoring circuit 207 .

Since the supply of the supply voltage 203 to the first central processing unit 205 and the second central processing unit 206 is cut off by the second switch 210, the second cutoff confirmation circuit 212 sends the cutoff confirmation 2 to the second central processing unit. 206. On the other hand, since the supply of the voltage 203 to the first central processing unit 205 and the second central processing unit 206 is not cut off by the first switch 209, the first cutoff confirmation circuit 211 sends the cutoff confirmation 1 to the first central processing unit. No output to processor 205 .

The first central processing unit 205 and the second central processing unit 206 are in mutual communication, and the second interruption confirmation circuit 212 sends an interruption confirmation 2 from the second central processing unit 206 to the first central processing unit 205. The fact that it has been input is transmitted, and the first shutdown confirmation circuit 211 transmits to the second central processing unit 206 from the first shutdown confirmation circuit 211 that shutdown confirmation 1 is not input.

Through mutual communication, the first central processing unit 205 and the second central processing unit 206 detect that the monitoring voltage 202 is overvoltage or undervoltage, and the second voltage monitoring circuit 208 is operating normally. The monitoring circuit 207 determines that it is not operating normally.

The first central processing unit 205 and the second central processing unit 206 avoid continuous supply of abnormal voltage to the first central processing unit 205 and the second central processing unit 206 by stopping their own operations.

Next, a case where the second voltage monitoring circuit 208 fails and only the first voltage monitoring circuit 207 operates normally will be described.

When the first voltage monitoring circuit 207 determines that the monitored voltage 202 is overvoltage or undervoltage, it outputs a cutoff command 1 to the first switch 209 . Since the second voltage monitoring circuit 208 has lost the function of determining overvoltage or undervoltage due to the failure, it does not output the cutoff command 2 to the second switch 210 .

The first switch 209 cuts off the supply of the supply voltage 203 to the first central processing unit 205 and the second central processing unit 206 when the cutoff command 1 is input from the first voltage monitoring circuit 207 . On the other hand, second switch 210 does not cut off supply of supply voltage 203 to first central processing unit 205 and second central processing unit 206 because cutoff command 2 is not input from second voltage monitoring circuit 208 .

Since the supply of the supply voltage 203 to the first central processing unit 205 and the second central processing unit 206 is cut off by the first switch 209, the first cutoff confirmation circuit 211 sends the cutoff confirmation 1 to the first central processing unit. Output to On the other hand, since the supply of the supply voltage 203 to the first central processing unit 205 and the second central processing unit 206 is not cut off by the second switch 210, the second cutoff confirmation circuit 212 sends the cutoff confirmation 2 to the second central processing unit. Do not output to processor.

The first central processing unit 205 and the second central processing unit 206 are in mutual communication, and the first interruption confirmation circuit 211 sends an interruption confirmation 1 from the first central processing unit 205 to the second central processing unit 206. The second central processing unit 206 transmits to the first central processing unit 205 that the interruption confirmation 2 is not input from the second interruption confirmation circuit 212 . Through mutual communication, the first central processing unit 205 and the second central processing unit 206 detect that the monitoring voltage 202 is overvoltage or undervoltage, and the first voltage monitoring circuit 207 is operating normally. The monitoring circuit 208 determines that it is not operating normally.

<Checking the operation of the voltage monitoring circuit>
Next, operation confirmation of the voltage monitoring circuit will be described. The functional safety device 101 checks the operation of the first voltage monitoring circuit 207 and the second voltage monitoring circuit 208 . In the following description, the flow of operation for confirming the operation of the first voltage monitoring circuit 207 and the second voltage monitoring circuit 208 is shown. The operation check of the first voltage monitoring circuit 207 and the second voltage monitoring circuit 208 is performed at regular intervals during the start-up of the functional safety device 101 and during operation.

First, the case of checking the operation of the first voltage monitoring circuit 207 will be described. Before starting the operation check, the second central processing unit 206 confirms that "the second central processing unit 206 has not output the shutdown notification 2 to the first voltage monitoring circuit 207", and the first central processing unit 205 confirms that "the first central processing unit 205 has not input shutdown confirmation 1 from the first shutdown confirmation circuit 211".

Confirm that the first voltage monitoring circuit 207 can output the cutoff command 1 to the first switch 209 when the first voltage monitoring circuit 207 detects that the monitored voltage 202 is overvoltage or undervoltage. Therefore, the second central processing unit 206 outputs cut-off notification 2 to the first voltage monitoring circuit 207 .

The first voltage monitoring circuit 207 outputs a shutdown command 1 to the first switch 209 when a shutdown notification 2 is input from the second central processing unit 206 .

The first switch 209 cuts off the supply of the supply voltage 203 to the first central processing unit 205 and the second central processing unit 206 when the cutoff command 1 is input from the first voltage monitoring circuit 207 . At this time, the supply voltage 203 is supplied to the first central processing unit 205 and the second central processing unit 206 via the second switch 210 and the second cutoff confirmation circuit 212 .

When the supply voltage 203 to the first central processing unit 205 and the second central processing unit 206 is cut off by the first switch 209, the first cutoff confirmation circuit 211 outputs cutoff confirmation 1 to the first central processing unit 205. do.

The first central processing unit 205 and the second central processing unit 206 are in communication with each other, and the second central processing unit 206 sends a shutdown notification 2 to the first voltage monitoring circuit 207 for the first central processing unit 205. The first central processing unit 205 transmits to the second central processing unit 206 that the interruption confirmation 1 has been input from the first interruption confirmation circuit 211 .

From the content of mutual communication between first central processing unit 205 and second central processing unit 206, first central processing unit 205 and second central processing unit 206 confirm the operation of first voltage monitoring circuit 207 normally. I judge.

Next, the case of checking the operation of the second voltage monitoring circuit 208 will be described. Before starting the operation check, the first central processing unit 205 confirms that "the first central processing unit 205 has not output the shutdown notification 1 to the second voltage monitoring circuit 208", and the second central processing unit 206 confirms that "the second central processing unit 206 has not input the shutdown confirmation 2 from the second shutdown confirmation circuit 212".

Confirm that the second voltage monitoring circuit 208 can output to the second switch 210 the shutdown command 2 that is output when the second voltage monitoring circuit 208 detects that the monitored voltage 202 is overvoltage or undervoltage. Therefore, the first central processing unit 205 outputs a cutoff notification 1 to the second voltage monitoring circuit 208 .

The second voltage monitoring circuit 208 outputs a shutdown command 2 to the second switch 210 when the shutdown notification 1 is input from the first central processing unit 205 .

The second switch 210 cuts off the supply of the supply voltage 203 to the first central processing unit 205 and the second central processing unit 206 when the cutoff command 2 is input from the second voltage monitoring circuit 208 . At this time, the supply voltage 203 is supplied to the first central processing unit 205 and the second central processing unit 206 via the first switch 209 and the first cutoff confirmation circuit 211 .

When the supply of the supply voltage 203 to the first central processing unit 205 and the second central processing unit 206 is cut off by the second switch 210, the second cut-off confirmation circuit 212 outputs cut-off confirmation 2 to the second central processing unit 206. do.

The first central processing unit 205 and the second central processing unit 206 are in communication with each other, and the first central processing unit 205 sends a shutdown notification 1 to the second voltage monitoring circuit 208 for the second central processing unit 206. The second central processing unit 206 transmits to the first central processing unit 205 that the interruption confirmation 2 has been input from the second interruption confirmation circuit 212 .

From the content of mutual communication between the first central processing unit 205 and the second central processing unit 206, the first central processing unit 205 and the second central processing unit 206 confirm the operation of the second voltage monitoring circuit 208 normally. I judge.

<effect>
As described above, the functional safety device 101 according to the first embodiment includes a plurality of central processing units that can communicate with each other, a power generation unit 204 that generates a power supply voltage to be supplied to the plurality of central processing units, and each central processing unit. a plurality of voltage monitoring circuits provided corresponding to each processing unit and monitoring whether the power supply voltage supplied to each central processing unit is overvoltage or undervoltage; When the power supply voltage supplied to the plurality of central processing units is overvoltage or undervoltage, a plurality of switches for cutting off the supply of the power supply voltage to the plurality of central processing units, and provided with a plurality of cutoff confirmation circuits for outputting to each central processing unit a cutoff confirmation signal indicating that supply of power supply voltage to the plurality of central processing units has been cut off, and among the plurality of central processing units, When one central processing unit starts to check the operation of the voltage monitoring circuit corresponding to the other central processing unit, it outputs a cutoff notification signal instructing to cut off the supply of the power supply voltage to the voltage monitoring circuit corresponding to the other central processing unit. Then, another central processing unit confirms whether or not a shutdown confirmation signal is output from the voltage monitoring circuit based on the shutdown notification signal.

Specifically, the plurality of central processing units includes a first central processing unit 205 and a second central processing unit 206, and the plurality of voltage monitoring circuits is a first voltage monitoring circuit corresponding to the first central processing unit 205. 207 and a second voltage monitoring circuit 208 corresponding to the second central processing unit 206, the plurality of switches corresponding to the first central processing unit 205 and the second central processing unit 206. and a second switch 210 that connects to the second switch 210. The plurality of disconnection confirmation circuits include a first disconnection confirmation circuit 211 corresponding to the first central processing unit 205 and a second disconnection confirmation circuit 212 corresponding to the second central processing unit 206. contains.

Therefore, for example, by checking the operation of the first voltage monitoring circuit 207 and the second voltage monitoring circuit 208 at the start-up of the functional safety device 101 and at regular intervals during operation, it is possible to prevent an abnormality from occurring in the power supply voltage. Abnormalities occurring in the first voltage monitoring circuit 207 and the second voltage monitoring circuit 208 can be detected.

<Embodiment 2>
Next, the functional safety device 101 according to Embodiment 2 will be described. FIG. 3 is a block diagram showing a configuration example of the functional safety device 101 according to Embodiment 2, and is a detailed diagram of the main part of the functional safety device 101 shown in FIG. In the second embodiment, the same components as those described in the first embodiment are denoted by the same reference numerals, and the description thereof is omitted.

<Configuration of functional safety device>
In the first embodiment, a configuration in which there are two central processing units is shown, but products that require even higher safety, such as those used in power plants, have three or more central processing units, If two or more of the three match, then the matching operation result is adopted. In the second embodiment, a configuration in which there are three central processing units and a flow of checking the operation of the voltage monitoring circuit will be described.

As shown in FIG. 3, the functional safety device 101 according to the second embodiment has a third central processing unit 307, a third voltage monitoring circuit 309, a third switch 311, and a third 3 cutoff confirmation circuit 313 is added.

<Checking the operation of the voltage monitoring circuit>
Next, the difference between the operation for confirming the operation of the first voltage monitoring circuit 207 in the second embodiment and the operation in the first embodiment will be described.

Before starting the operation check, the second central processing unit 206 confirms that "the second central processing unit 206 has not output the shutdown notification 2 to the first voltage monitoring circuit 207", and the third central processing unit 307 confirms that "the third central processing unit 307 has not output the shutdown notification 3 to the first voltage monitoring circuit 207", and the first central processing unit 205 confirms that "the first central processing unit 205 has 211 has not been entered.

Confirm that the first voltage monitoring circuit 207 can output the cutoff command 1 to the first switch 209 when the first voltage monitoring circuit 207 detects that the monitored voltage 202 is overvoltage or undervoltage. Therefore, the second central processing unit 206 outputs a cutoff notification 2 to the first voltage monitoring circuit 207 , and the third central processing unit 307 outputs a cutoff notification 3 to the first voltage monitoring circuit 207 .

The first voltage monitoring circuit 207 outputs a shutdown command 1 to the first switch 209 when a shutdown notification 2 is input from the second central processing unit 206 and a shutdown notification 3 is input from the third central processing unit 307 .

The first central processing unit 205, the second central processing unit 206, and the third central processing unit 307 are in mutual communication, and the second central processing unit 206 to the first central processing unit 205 receives a first voltage monitoring signal. The third central processing unit 307 notifies the first central processing unit 205 of the output of the cutoff notification 2 to the circuit 207, the output of the cutoff notification 3 to the first voltage monitoring circuit 207 is transmitted from the third central processing unit 307 to the first central processing unit 205, First central processing unit 205 transmits to second central processing unit 206 and third central processing unit 307 that interruption confirmation 1 has been input from first interruption confirmation circuit 211 .

From the content of mutual communication between the first central processing unit 205, the second central processing unit 206 and the third central processing unit 307, the first central processing unit 205, the second central processing unit 206 and the third central processing unit 307 It is determined that the operation check of the first voltage monitoring circuit 207 has been performed normally.

Next, the difference between the operation for checking the operation of the second voltage monitoring circuit in the second embodiment and the operation in the first embodiment will be described.

Before starting the operation check, the first central processing unit 205 confirms that “the first central processing unit 205 has not output the shutdown notification 1 to the second voltage monitoring circuit 208”, and the third central processing unit 307 confirms that "the third central processing unit 307 has not output the shutdown notification 3 to the second voltage monitoring circuit 208", and the second central processing unit 206 confirms that "the second central processing unit 206 has 212 has not been entered.

Confirm that the second voltage monitoring circuit 208 can output to the second switch 210 the shutdown command 2 that is output when the second voltage monitoring circuit 208 detects that the monitored voltage 202 is overvoltage or undervoltage. Therefore, the first central processing unit 205 outputs a shutdown notification 1 to the second voltage monitoring circuit 208 , and the third central processing unit 307 outputs a shutdown notification 3 to the second voltage monitoring circuit 208 .

The second voltage monitoring circuit 208 outputs a shutdown command 2 to the second switch 210 when a shutdown notification 1 is input from the first central processing unit 205 and a shutdown notification 3 is input from the third central processing unit 307 .

The first central processing unit 205, the second central processing unit 206, and the third central processing unit 307 are in mutual communication, and the first central processing unit 205 to the second central processing unit 206 receives a second voltage monitoring signal. The third central processing unit 307 transmits to the second central processing unit 206 that the cutoff notification 1 has been output to the circuit 208, the output of the cutoff notification 3 to the second voltage monitoring circuit 208 is transmitted, Second central processing unit 206 notifies first central processing unit 205 and third central processing unit 307 that shutdown confirmation 2 has been input from second shutdown confirmation circuit 212 .

From the content of mutual communication between the first central processing unit 205, the second central processing unit 206 and the third central processing unit 307, the first central processing unit 205, the second central processing unit 206 and the third central processing unit 307 It is determined that the operation confirmation of the second voltage monitoring circuit 208 has been performed normally.

Next, the case of checking the operation of the third voltage monitoring circuit 309 will be described. Since the third voltage monitoring circuit 309 is not included in the configuration of the first embodiment, the entire flow of checking the operation of the third voltage monitoring circuit 309 will be described.

Before starting the operation check, the first central processing unit 205 confirms that "the first central processing unit 205 has not output the shutdown notification 1 to the third voltage monitoring circuit 309", and the second central processing unit 206 confirms that "the second central processing unit 206 has not output the shutdown notification 2 to the third voltage monitoring circuit 309", and the third central processing unit 307 confirms that "the third central processing unit 307 has 313 has not been entered as shutdown confirmation 3”.

It is confirmed that the third voltage monitoring circuit 309 can output to the third switch 311 the shutdown command 3 that is output when the third voltage monitoring circuit 309 detects that the monitored voltage 202 is overvoltage or undervoltage. Therefore, the first central processing unit 205 outputs a shutdown notification 1 to the third voltage monitoring circuit 309 , and the second central processing unit 206 outputs a shutdown notification 2 to the third voltage monitoring circuit 309 .

The third voltage monitoring circuit 309 outputs a shutdown command 3 to the third switch 311 when a shutdown notification 1 is input from the first central processing unit 205 and a shutdown notification 2 is input from the second central processing unit 206 .

The third switch 311 cuts the supply voltage 203 supplied to the first central processing unit 205, the second central processing unit 206, and the third central processing unit 307 when the shutdown command 3 is input from the third voltage monitoring circuit 309. Cut off. At this time, the supply voltage 203 is supplied to the first central processing unit 205 , the second central processing unit 206 and the third central processing unit 307 via the first interruption confirmation circuit 211 and the second interruption confirmation circuit 212 .

When the supply voltage 203 supplied to the first central processing unit 205, the second central processing unit 206 and the third central processing unit 307 is cut off by the third switch 311, the third cut-off confirmation circuit 313 A shutdown confirmation 3 is output to 307 .

The first central processing unit 205, the second central processing unit 206, and the third central processing unit 307 are in mutual communication, and the third voltage monitoring unit 307 is sent from the first central processing unit 205 to the third central processing unit 307. The second central processing unit 206 transmits to the third central processing unit 307 that the cutoff notification 1 has been output to the circuit 309, the output of the cutoff notification 2 to the third voltage monitoring circuit 309 is transmitted, 3. The central processing unit 307 transmits to the first central processing unit 205 and the second central processing unit 206 that the interruption confirmation 3 has been input from the third interruption confirmation circuit 313 .

From the content of mutual communication between the first central processing unit 205, the second central processing unit 206 and the third central processing unit 307, the first central processing unit 205, the second central processing unit 206 and the third central processing unit 307 It is determined that the operation confirmation of the third voltage monitoring circuit 309 has been performed normally.

<effect>
As described above, in functional safety device 101 according to Embodiment 2, the plurality of central processing units include first central processing unit 205, second central processing unit 206, and third central processing unit 307, and a plurality of The voltage monitoring circuits include a first voltage monitoring circuit 207 corresponding to the first central processing unit 205, a second voltage monitoring circuit 208 corresponding to the second central processing unit 206, and a third voltage monitoring circuit 208 corresponding to the third central processing unit 307. a voltage monitoring circuit 309; the plurality of switches are a first switch 209 corresponding to the first central processing unit 205; a second switch 210 corresponding to the second central processing unit 206; and a corresponding third switch 311 , the plurality of disconnection confirmation circuits are a first disconnection confirmation circuit 211 corresponding to the first central processing unit 205 and a second disconnection confirmation circuit 212 corresponding to the second central processing unit 206 . , and a third cutoff confirmation circuit 313 corresponding to the third central processing unit 307. Among the first voltage monitoring circuit 207, the second voltage monitoring circuit 208, and the third voltage monitoring circuit 309, one voltage monitoring circuit is , and starts checking its own operation by receiving cut-off notifications output from two central processing units that do not support this.

Therefore, in addition to the effect of the first embodiment, since the operation check is started after two interruption notifications are input to the voltage monitoring circuit, when one central processing unit erroneously outputs the interruption notification, the voltage monitoring circuit It is possible to suppress unintended operation confirmation of the circuit.

<Embodiment 3>
Next, the functional safety device 101 according to Embodiment 3 will be described. FIG. 4 is a block diagram showing a configuration example of a functional safety device and its periphery according to Embodiment 3, and is a detailed view of the configuration shown in FIG. In addition, in Embodiment 3, the same components as those described in Embodiments 1 and 2 are denoted by the same reference numerals, and descriptions thereof are omitted.

<Configuration of functional safety device>
In the first embodiment, when it is detected that the supply voltage supplied to the central processing unit is overvoltage or undervoltage, the supply voltage supplied to the central processing unit is cut off so that the central processing unit I explained that it should be operated so that the abnormal voltage would not continue to be supplied. Further, in the first and second embodiments, the flow of checking the operation of each voltage monitoring circuit has been described.

In the third embodiment, in a configuration that employs a black channel for communication with an input unit or an output unit connected to the central processing unit, overvoltage or undervoltage occurs in the voltage supplied to the central processing unit. is detected, and when the operation check of each voltage monitoring circuit determines that there is an abnormality, the central processing unit cuts off the communication with the connection partner so that the connection partner recognizes the abnormality of the central processing unit. A flow of operations for safely stopping the driving unit will be described. Note that the operation when it is detected that the supply voltage supplied to the central processing unit is overvoltage or undervoltage is the case where the first voltage monitoring circuit 207 and the second voltage monitoring circuit 208 operate normally. only explained.

As shown in FIG. 4, the functional safety device 101 according to Embodiment 3 has a detection unit 102, a first input unit 103, a second input unit 104, and a first output unit in addition to the configuration shown in FIG. 111, a second output section 112, and a driving section 113 are added.

<Checking the operation of the voltage monitoring circuit>
Next, the operation when it is detected that the supply voltage 203 supplied to the central processing unit in the third embodiment is overvoltage or undervoltage, and the difference between the operation in the case of the first embodiment will be described. do.

A first switch 209 and a second switch 210 cut off the supply voltage 203 supplied to the first central processing unit 205 and the second central processing unit 206 so that the first central processing unit 205 and the second central processing unit 206 and the supply voltage 203 is no longer supplied between the first central processing unit 205 and the first input unit 103, between the second central processing unit 206 and the second input unit 104, between the first central processing unit 205 and the second input unit 104, 1 output unit 111 and communication between second central processing unit 206 and second output unit 112 are disconnected.

The drive unit 113 determines that an abnormality has occurred in the first central processing unit 205 and the second central processing unit 206 due to the disconnection of communication, and safely stops itself.

Next, the case where the operation check of the first voltage monitoring circuit 207 determines that there is an abnormality will be described. Since the flow when it is determined that the operation of the first voltage monitoring circuit 207 is abnormal is not described in the first embodiment, the entire flow of operation confirmation of the first voltage monitoring circuit 207 will be described.

Before starting the operation check, the second central processing unit 206 confirms that "the second central processing unit 206 has not output the shutdown notification 2 to the first voltage monitoring circuit 207", and the first central processing unit 205 confirms that "the first central processing unit 205 has not input shutdown confirmation 1 from the first shutdown confirmation circuit 211".

Since the first voltage monitoring circuit 207 is out of order, it does not output the shutdown command 1 to the first switch 209 even if the shutdown notification 2 is input from the second central processing unit 206 .

The first switch 209 does not cut off the supply voltage 203 supplied to the first central processing unit 205 and the second central processing unit 206 because the cutoff command 1 is not input from the first voltage monitoring circuit 207 .

Since the supply voltage 203 supplied to the first central processing unit 205 and the second central processing unit 206 is not cut off by the first switch 209, the first cut-off confirmation circuit 211 does not output the cut-off confirmation 1 to the first central processing unit 205. .

The first central processing unit 205 and the second central processing unit 206 are in communication with each other, and the second central processing unit 206 sends a shutdown notification 2 to the first voltage monitoring circuit 207 for the first central processing unit 205. It is transmitted to the second central processing unit 206 from the first central processing unit 205 to inform that the first interruption confirmation circuit 211 has not input the interruption confirmation 1 .

According to the content of mutual communication between the first central processing unit 205 and the second central processing unit 206, the first voltage monitoring circuit 207 of the first central processing unit 205 and the second central processing unit 206 is operating normally. judge not.

By stopping the operation of the first central processing unit 205 and the second central processing unit 206 themselves, a 104, between the first central processing unit 205 and the first output unit 111, and between the second central processing unit 206 and the second output unit 112 are disconnected.

Next, the case where the operation check of the second voltage monitoring circuit 208 determines that there is an abnormality will be described. Since the flow when the operation check of the second voltage monitoring circuit 208 determines that there is an abnormality is not described in the first embodiment, the entire operation check flow of the second voltage monitoring circuit 208 will be described.

Before starting the operation check, the first central processing unit 205 confirms that "the first central processing unit 205 has not output the shutdown notification 1 to the second voltage monitoring circuit 208", and the second central processing unit 206 confirms that "the second central processing unit 206 has not input the shutdown confirmation 2 from the second shutdown confirmation circuit 212".

Since the second voltage monitoring circuit 208 is out of order, it does not output the shutdown command 2 to the second switch 210 even if the shutdown notification 1 is input from the first central processing unit 205 .

The second switch 210 does not cut off the supply voltage 203 supplied to the first central processing unit 205 and the second central processing unit 206 because the cutoff command 2 is not input from the second voltage monitoring circuit 208 .

Since the supply voltage 203 supplied to the first central processing unit 205 and the second central processing unit 206 is not cut off by the second switch 210, the second cut-off confirmation circuit 212 does not output the cut-off confirmation 2 to the second central processing unit 206. .

The first central processing unit 205 and the second central processing unit 206 are in communication with each other, and the first central processing unit 205 sends a shutdown notification 1 to the second voltage monitoring circuit 208 for the second central processing unit 206. Second central processing unit 206 notifies first central processing unit 205 that second interruption confirmation circuit 212 has not input interruption confirmation 2 .

From the content of mutual communication between first central processing unit 205 and second central processing unit 206, first central processing unit 205 and second central processing unit 206 confirm that second voltage monitoring circuit 208 is operating normally. judge not.

The first central processing unit 205 and the second central processing unit 206 stop their activation by themselves so that between the first central processing unit 205 and the first input unit 103, the second central processing unit 206 and the second input unit 104, between the first central processing unit 205 and the first output unit 111, and between the second central processing unit 206 and the second output unit 112 are disconnected.

It should be noted that it is also possible to adopt the configuration of the third embodiment to the functional safety device 101 having three central processing units as in the case of the second embodiment.

<effect>
As described above, in the functional safety device 101 according to the third embodiment, the plurality of central processing units detect the driving unit 113 controlled according to the command output from the functional safety device 101 and the surrounding environment of the driving unit 113. When the power supply voltage is overvoltage or undervoltage, or when an abnormality occurs in the voltage monitoring circuit, the plurality of central processing units can communicate with the driving unit 113 and the detection unit 102 . 102 is disconnected.

Therefore, in addition to the effects of the first embodiment, it is possible to safely stop the operation of the drive unit 113 that can communicate with the central processing unit.

<Embodiment 4>
Embodiment 4 will be described below with reference to the drawings. FIG. 5 is a block diagram schematically showing a configuration example of the functional safety device 101 and its periphery according to the fourth embodiment. In Embodiment 4, the same components as those described in Embodiments 1 to 3 are denoted by the same reference numerals, and descriptions thereof are omitted.

<Schematic configuration of functional safety device and its surroundings>
As shown in FIG. 5 , the functional safety device 101 is communicably connected to the detection unit 102 , the driving unit 113 and the user interface unit 501 . The drive unit 113 is controlled according to commands output from the functional safety device 101 . The detection unit 102 detects the surrounding environment of the driving unit 113 . The user interface unit 501 enables a program created by the user of the functional safety device 101 to be registered in the functional safety device 101 and to notify the user of the functional safety device 101 of the operating state of the functional safety device 101. do.

The functional safety device 101 is configured by combining three devices: an input device 502, an arithmetic device 503, and an output device 504.

The input device 502 includes a first input section 103, a second input section 104, a first voltage supply section 505, a second voltage supply section 506, a first voltage monitoring section 507, and a second voltage monitoring section 508. It has

Arithmetic device 503 includes first arithmetic processing unit 105, second arithmetic processing unit 106, first voltage supply unit 107, second voltage supply unit 108, first voltage monitoring unit 109, and second voltage monitoring unit. 110.

The output device 504 includes a first output section 111, a second output section 112, a first voltage supply section 509, a second voltage supply section 510, a first voltage monitoring section 511, and a second voltage monitoring section 512. It has

The input device 502 and the arithmetic device 503 have one communication path, and the first input unit 103 of the input device 502 and the first arithmetic processing unit 105 of the arithmetic device 503 communicate.

The first input unit 103 converts the signal received from the detection unit 102 into a format that can be input to the first arithmetic processing unit 105 and outputs the signal to the first arithmetic processing unit 105 .

In the input device 502, two

input units

103 and 104 are provided in order to diagnose that the first input unit 103 is not performing incorrect input processing. Guaranteed.

The first voltage supply section 505 and the second voltage supply section 506 are provided corresponding to the first input section 103 and the second input section 104, respectively, and the first voltage supply section 505 and the second voltage supply section 506 are required. Generates a power supply voltage that

A first voltage monitoring unit 507 and a second voltage monitoring unit 508 monitor whether the power supply voltage supplied to the first voltage supply unit 505 and the second voltage supply unit 506 is overvoltage or undervoltage, respectively. When the first voltage monitoring unit 507 and the second voltage monitoring unit 508 detect that the power supply voltages supplied from the first voltage supply unit 505 and the second voltage supply unit 506 are overvoltage or undervoltage, respectively, Safety is ensured by taking measures to prevent the power supply voltage from being supplied to the 1st input section 103 and the 2nd input section 104 .

The arithmetic device 503 and the output device 504 have one communication path, and the first arithmetic processing unit 105 of the arithmetic device 503 and the first output unit 111 of the output device 504 communicate.

A program created by the user is registered in advance in the first arithmetic processing unit 105 . The first arithmetic processing unit 105 uses the program created by the user and the signal received from the first input unit 103 to calculate a control command for the driving unit 113 so as to produce an output corresponding to the input. It outputs the control command to the first output unit 111 .

In the arithmetic unit 503, two

arithmetic processing units

105 and 106 are provided in order to prevent the drive unit 113 from generating a control command that causes an erroneous operation. Guaranteed.

The first output unit 111 converts the signal received from the first arithmetic processing unit 105 into a format that can be input to the driving unit 113 and outputs the converted signal to the driving unit 113 .

In the output device 504, two

output units

111 and 112 are provided for diagnosing whether the first output unit 111 is not performing an erroneous output process. Guaranteed.

The first voltage supply section 509 and the second voltage supply section 510 are provided corresponding to the first output section 111 and the second output section 112, respectively, and the first voltage supply section 509 and the second voltage supply section 510 are required. Generates a power supply voltage that

A first voltage monitoring unit 511 and a second voltage monitoring unit 512 monitor whether the power supply voltage supplied to the first voltage supply unit 509 and the second voltage supply unit 510, respectively, is overvoltage or undervoltage. When the first voltage monitoring unit 511 and the second voltage monitoring unit 512 detect that the power supply voltages supplied from the first voltage supply unit 509 and the second voltage supply unit 510 are overvoltage or undervoltage, respectively, Safety is ensured by taking measures to prevent the power supply voltage from being supplied to the first output section 111 and the second output section 112 .

Whether the power supply voltage supplied to the first voltage supply unit 505 or the second voltage supply unit 506 that supplies the power supply voltage to the first input unit 103 and the second input unit 104 of the functional safety device 101 is overvoltage or undervoltage Although there is a mechanism for safely stopping the control of the drive unit 113 by the functional safety device 101 when an abnormality occurs in the first voltage monitoring unit 507 or the second voltage monitoring unit 508 that monitors the The user cannot identify whether the functional safety device 101 has stopped controlling the drive unit 113 because of the malfunction.

Similarly, if the power supply voltage supplied to the first voltage supply unit 509 or the second voltage supply unit 510 that supplies the power supply voltage to the first output unit 111 and the second output unit 112 of the functional safety device 101 is overvoltage or undervoltage. Although there is a mechanism for safely stopping the control of the driving unit 113 by the functional safety device 101 when an abnormality occurs in the first voltage monitoring unit 511 or the second voltage monitoring unit 512 that monitors whether the functional safety device The user cannot specify which function of 101 has become abnormal and the functional safety device 101 has stopped controlling the drive unit 113 . The functional safety device 101 is designed to solve such problems, and will be described in detail below.

<Configuration of functional safety device>
The configurations of the input device 502, the arithmetic device 503, and the output device 504, which constitute the functional safety device 101, will be described with reference to FIG.

As shown in FIG. 2, each of the input device 502, the arithmetic device 503, and the output device 504 includes a power generation unit 204, a first central processing unit 205, a second central processing unit 206, and a first voltage monitoring circuit. 207 , a second voltage monitoring circuit 208 , a first switch 209 , a second switch 210 , a first cutoff confirmation circuit 211 , and a second cutoff confirmation circuit 212 .

Here, the relationship between the components in FIGS. 2 and 5 will be explained. First, the relationship between the components of the input device 502 in FIGS. 2 and 5 will be described. The power generation section 204 corresponds to the first voltage supply section 505 and the second voltage supply section 506 . A first central processing unit 205 corresponds to the first input unit 103 and a second central processing unit 206 corresponds to the second input unit 104 . The first voltage monitoring circuit 207, the first switch 209, and the first disconnection confirmation circuit 211 correspond to the first voltage monitoring unit 507, and the second voltage monitoring circuit 208, the second switch 210, and the second disconnection confirmation circuit 212 correspond to the first voltage monitoring unit 507. corresponds to the second voltage monitoring unit 508 .

Next, the relationship between the components of the computing device 503 in FIGS. 2 and 5 will be described. The power generation unit 204 corresponds to the first voltage supply unit 107 and the second voltage supply unit 108 . The first central processing unit 205 corresponds to the first arithmetic processing unit 105 , and the second central processing unit 206 corresponds to the second arithmetic processing unit 106 . The first voltage monitoring circuit 207, the first switch 209, and the first disconnection confirmation circuit 211 correspond to the first voltage monitoring unit 109, and the second voltage monitoring circuit 208, the second switch 210, and the second disconnection confirmation circuit 212 correspond to the first voltage monitoring unit 109. corresponds to the second voltage monitoring unit 110 .

Finally, the relationship between the components of the output device 504 in FIGS. 2 and 5 will be described. The power generation unit 204 corresponds to the first voltage supply unit 509 and the second voltage supply unit 510 . The first central processing unit 205 corresponds to the first output unit 111 and the second central processing unit 206 corresponds to the second output unit 112 . The first voltage monitoring circuit 207, the first switch 209, and the first cutoff confirmation circuit 211 correspond to the first voltage monitoring unit 511, and the second voltage monitoring circuit 208, the second switch 210, and the second cutoff confirmation circuit 212 correspond to the first voltage monitoring unit 511. corresponds to the second voltage monitoring unit 512 .

Since each component in FIG. 2 operates as described in paragraphs 0028 to 0037, the description thereof is omitted here.

<Checking the operation of the voltage monitoring circuit>
Next, operation confirmation of the voltage monitoring circuit will be described. The input device 502 and the output device 504 of the functional safety device 101 confirm the operation of the first voltage monitoring circuit 207 and the second voltage monitoring circuit 208 . In the following description, the flow of operation for checking the operation when an abnormality occurs in the first voltage monitoring circuit 207 or the second voltage monitoring circuit 208 is shown. The operation check of the first voltage monitoring circuit 207 and the second voltage monitoring circuit 208 is performed at regular intervals during the start-up of the functional safety device 101 and during operation.

First, the flow of operation for confirming the operation of the input device 502 of the functional safety device 101 will be described.

First, the case where the operation check of the first voltage monitoring circuit 207 determines that there is an abnormality will be described. Before starting the operation check, the second central processing unit 206 confirms that "the second central processing unit 206 has not output the shutdown notification 2 to the first voltage monitoring circuit 207", and the first central processing unit 205 confirms that "the first central processing unit 205 has not input shutdown confirmation 1 from the first shutdown confirmation circuit 211".

Since the first switch 209 does not receive the cutoff command 1 from the first voltage monitoring circuit 207, two paths from the monitored voltage 202 to the supply voltage 203 supplied to the first central processing unit 205 and the second central processing unit 206 Among them, the path passing through the first switch 209 and the first cutoff confirmation circuit 211 is not cut off.

Of the two paths from the monitoring voltage 202 to the supply voltage 203 supplied to the first central processing unit 205 and the second central processing unit 206 by the first switch 209, the first switch 209 and the first cutoff confirmation circuit 211 are selected. Since the route through which it passes is not blocked, the first shutdown confirmation circuit 211 does not output shutdown confirmation 1 to the first central processing unit 205 .

The first central processing unit 205 of the input device 502 notifies the first central processing unit 205 of the arithmetic device 503 that the first voltage monitoring circuit 207 of the input device 502 is abnormal. The arithmetic device 503 notifies the user interface unit 501 that the first voltage monitoring circuit 207 of the input device 502 is abnormal. The user interface unit 501 notifies the user of the functional safety device 101 that an abnormality has occurred in the first voltage monitoring circuit 207 of the input device 502 of the functional safety device 101 based on the notification received from the arithmetic device 503 . .

At the same time, the first central processing unit 205 and the second central processing unit 206 of the input device 502 stop operating by themselves, so that the first input unit 103 of the input device 502 and the first arithmetic processing unit of the arithmetic unit 503 105 is disconnected. After that, the communication between the first arithmetic processing unit 105 of the arithmetic device 503 and the first output unit 111 of the output device 504 is disconnected, and further, the communication between the first output unit 111 of the output device 504 and the driving unit 113 is disconnected. Communication is lost.

The timing at which the first central processing unit 205 and the second central processing unit 206 of the input device 502 stop their operation is determined by the first central processing unit 205 of the input device 502 , after notifying the first voltage monitoring circuit 207 that an abnormality has occurred.

The drive unit 113 determines that an abnormality has occurred in the functional safety device 101 due to the disconnection of communication, and safely stops itself.

Next, the case where the operation check of the second voltage monitoring circuit 208 determines that there is an abnormality will be described. Before starting the operation check, the first central processing unit 205 confirms that "the first central processing unit 205 has not output the shutdown notification 1 to the second voltage monitoring circuit 208", and the second central processing unit 206 confirms that "the second central processing unit 206 has not input the shutdown confirmation 2 from the second shutdown confirmation circuit 212".

Since the second switch 210 does not receive the shutdown command 2 from the second voltage monitoring circuit 208, two paths from the monitored voltage 202 to the supply voltage 203 supplied to the first central processing unit 205 and the second central processing unit 206 Among them, the path passing through the second switch 210 and the second cutoff confirmation circuit 212 is not cut off.

Of the two paths from the monitoring voltage 202 to the supply voltage 203 supplied to the first central processing unit 205 and the second central processing unit 206 by the second switch 210, the second switch 210 and the second cutoff confirmation circuit 212 are selected. Since the path through which it passes is not cut off, the second cutoff confirmation circuit 212 does not output cutoff confirmation 2 to the second central processing unit 206 .

The first central processing unit 205 of the input device 502 notifies the first central processing unit 205 of the arithmetic device 503 that the second voltage monitoring circuit 208 of the input device 502 is abnormal. The arithmetic device 503 notifies the user interface unit 501 that the second voltage monitoring circuit 208 of the input device 502 is abnormal. The user interface unit 501 notifies the user of the functional safety device 101 that an abnormality has occurred in the second voltage monitoring circuit 208 of the input device 502 of the functional safety device 101 based on the notification received from the arithmetic device 503 . .

The timing at which the first central processing unit 205 and the second central processing unit 206 of the input device 502 stop their operation is determined by the first central processing unit 205 of the input device 502 , after notifying the second voltage monitoring circuit 208 that an abnormality has occurred.

Next, the flow of operation for checking the operation of the output device 504 of the functional safety device 101 will be described.

The first central processing unit 205 of the output device 504 notifies the first central processing unit 205 of the arithmetic device 503 that the first voltage monitoring circuit 207 of the output device 504 is abnormal. The arithmetic device 503 notifies the user interface unit 501 that the first voltage monitoring circuit 207 of the output device 504 is abnormal. Based on the notification received from the arithmetic device 503, the user interface unit 501 notifies the user of the functional safety device 101 that the first voltage monitoring circuit 207 of the output device 504 of the functional safety device 101 has failed. .

At the same time, the first central processing unit 205 and the second central processing unit 206 of the output device 504 stop their operations, so that the first output unit 111 of the output device 504 and the first arithmetic processing unit of the arithmetic unit 503 105 and communication between the first output unit 111 of the output device 504 and the drive unit 113 are disconnected.

The timing at which the first central processing unit 205 and the second central processing unit 206 of the output device 504 stop themselves is determined by the first central processing unit 205 of the output device 504 , after notifying the first voltage monitoring circuit 207 that an abnormality has occurred.

The first central processing unit 205 of the output device 504 notifies the first central processing unit 205 of the arithmetic device 503 that the second voltage monitoring circuit 208 of the output device 504 is abnormal. The arithmetic device 503 notifies the user interface unit 501 that the second voltage monitoring circuit 208 of the output device 504 is abnormal. Based on the notification received from the arithmetic unit 503, the user interface unit 501 notifies the user of the functional safety device 101 that the second voltage monitoring circuit 208 of the output device 504 of the functional safety device 101 has failed. .

The timing at which the first central processing unit 205 and the second central processing unit 206 of the output device 504 stop themselves is determined by the first central processing unit 205 of the output device 504 , after notifying the second voltage monitoring circuit 208 that an abnormality has occurred.

It should be noted that it is also possible to adopt the configuration of the fourth embodiment to the functional safety device 101 having three central processing units as in the case of the second embodiment.

Further, among the input device 502, the arithmetic device 503, and the output device 504, the device including the first voltage supply section, the second voltage supply section, the first voltage monitoring section, and the second voltage monitoring section is the input device Only the arithmetic device 502 and the arithmetic device 503, or only the arithmetic device 503 and the output device 504 may be used.

In the above description, the input device 502, the arithmetic device 503, and the output device 504 are all provided with a plurality of central processing units, a plurality of voltage monitoring circuits, a plurality of switches, and a plurality of interruption confirmation circuits. If at least one or more of the input device 502, the arithmetic device 503, and the output device 504 has a plurality of central processing units, a plurality of voltage monitoring circuits, a plurality of switches, and a plurality of interruption confirmation circuits good.

<effect>
As described above, in the functional safety device 101 according to the fourth embodiment, the plurality of central processing units detect the driving unit 113 controlled according to the command output from the functional safety device 101 and the surrounding environment of the driving unit 113. and a user interface unit 501 that notifies the user of the operating state of the functional safety device 101. The functional safety device 101 includes an input device 502 that receives a signal from the detection unit 102 and an input device 502 that receives a signal from the detection unit 102. The input device 502 is composed of an arithmetic device 503 that calculates a command for the driving unit 113 using the signal received from the device 502, and an output device 504 that outputs the command received from the arithmetic device 503 to the driving unit 113. 503 and the output device 504, at least one or more devices include a plurality of central processing units, a plurality of voltage monitoring circuits, a plurality of switches, and a plurality of shutdown confirmation circuits. At least one or more devices comprising a voltage monitoring circuit, a plurality of switches, and a plurality of cutoff confirmation circuits, when the power supply voltage is overvoltage or undervoltage, or when an abnormality occurs in the voltage monitoring circuit, The user is notified of the location where the abnormality has occurred via the user interface unit 501, and communication with the drive unit 113 and the detection unit 102 is cut off.

Therefore, since it becomes easy to identify the location where an abnormality has occurred in the functional safety device 101, it is possible for the user to shorten the time from detecting an abnormality in the functional safety device 101 to restoring the operation.

Although this disclosure has been described in detail, the above description is, in all aspects, illustrative and not restrictive. It is understood that innumerable variations not illustrated can be envisaged.

It should be noted that each embodiment can be freely combined, modified, or omitted as appropriate.

101 functional safety device, 102 detection unit, 113 drive unit, 204 power generation unit, 205 first central processing unit, 206 second central processing unit, 207 first voltage monitoring circuit, 208 second voltage monitoring circuit, 209 first switch , 210 second switch, 211 first shutdown confirmation circuit, 212 second shutdown confirmation circuit, 307 third central processing unit, 309 third voltage monitoring circuit, 311 third switch, 313 third shutdown confirmation circuit, 501 user interface unit , 502 input device, 503 arithmetic device, 504 output device.

Claims

a plurality of central processing units communicable with each other;
a power generator that generates a power supply voltage to be supplied to the plurality of central processing units;
a plurality of voltage monitoring circuits provided corresponding to each of the central processing units and respectively monitoring whether the power supply voltage supplied to each of the central processing units is overvoltage or undervoltage;
provided corresponding to each of the central processing units, and cuts off supply of the power supply voltage to the plurality of central processing units when the power supply voltage supplied to the plurality of central processing units is overvoltage or low voltage; a plurality of switches for
a plurality of cutoff confirmations provided corresponding to each of the central processing units, respectively, for outputting to each of the central processing units a cutoff confirmation signal indicating that the supply of the power supply voltage to the plurality of central processing units has been cut off; a circuit;
When one of the plurality of central processing units starts to check the operation of the voltage monitoring circuit corresponding to another central processing unit, it sends a cutoff notification signal instructing to cut off the supply of the power supply voltage. output to the voltage monitoring circuit corresponding to another central processing unit;
The functional safety device, wherein the other central processing unit confirms whether or not the disconnection confirmation signal is output from the voltage monitoring circuit based on the disconnection notification signal.
the plurality of central processing units includes a first central processing unit and a second central processing unit;
the plurality of voltage monitoring circuits includes a first voltage monitoring circuit corresponding to the first central processing unit and a second voltage monitoring circuit corresponding to the second central processing unit;
the plurality of switches includes a first switch corresponding to the first central processing unit and a second switch corresponding to the second central processing unit;
2. The functional safety according to claim 1, wherein the plurality of interruption confirmation circuits includes a first interruption confirmation circuit corresponding to the first central processing unit and a second interruption confirmation circuit corresponding to the second central processing unit. Device.
the plurality of central processing units includes a first central processing unit, a second central processing unit and a third central processing unit;
The plurality of voltage monitoring circuits includes a first voltage monitoring circuit corresponding to the first central processing unit, a second voltage monitoring circuit corresponding to the second central processing unit, and a second voltage monitoring circuit corresponding to the third central processing unit. 3 voltage monitoring circuit;
the plurality of switches includes a first switch corresponding to the first central processing unit, a second switch corresponding to the second central processing unit, and a third switch corresponding to the third central processing unit;
The plurality of shutdown confirmation circuits include a first shutdown confirmation circuit corresponding to the first central processing unit, a second shutdown confirmation circuit corresponding to the second central processing unit, and a third shutdown confirmation circuit corresponding to the third central processing unit. 3 including a cutoff confirmation circuit,
Of the first voltage monitoring circuit, the second voltage monitoring circuit, and the third voltage monitoring circuit, one of the voltage monitoring circuits receives the interruption output from the two central processing units that do not correspond to it. 2. The functional safety device according to claim 1, wherein said operation confirmation of itself is initiated by receiving a notification signal.
The plurality of central processing units are capable of communicating with a driving unit controlled according to a command output from the functional safety device and a detecting unit detecting a surrounding environment of the driving unit,
wherein the plurality of central processing units cut off communication with the drive unit and the detection unit when the power supply voltage is overvoltage or undervoltage, or when an abnormality occurs in the voltage monitoring circuit. A functional safety device according to any one of claims 1 to 3.
The plurality of central processing units include a drive unit controlled according to commands output from the functional safety device, a detection unit that detects the surrounding environment of the drive unit, and notifies the operating state of the functional safety device to the user. It is possible to communicate with the user interface part that
The functional safety device includes an input device that receives a signal from the detection unit, an arithmetic device that calculates the command for the driving unit using the signal received from the input device, and the command received from the arithmetic device. and an output device that outputs to the drive unit,
At least one or more of the input device, the arithmetic device, and the output device includes a plurality of the central processing units, a plurality of the voltage monitoring circuits, a plurality of the switches, and a plurality of the shutdown confirmation circuits. prepared,
At least one or more of the devices comprising a plurality of the central processing units, a plurality of the voltage monitoring circuits, a plurality of the switches, and a plurality of the cut-off confirmation circuits, when the power supply voltage is overvoltage or undervoltage, Alternatively, when an abnormality occurs in the voltage monitoring circuit, the user is notified of the location of the abnormality via the user interface unit, and communication with the drive unit and the detection unit is cut off. , a functional safety device according to claim 1.