JP3208060B2 - Parallel dual electronic interlocking device - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a parallel dual-system electronic interlocking device in which an interlocking control system is formed as a double system and can be switched to a standby system when a failure occurs in a used system.

[0002]

2. Description of the Related Art In a conventional parallel dual-system electronic interlocking device, it is assumed that the same input is performed in parallel to both systems, and that the operation results of the used system and the standby system are the same by synchronizing both systems. Came. FIG. 15 is a block diagram showing a main configuration of a conventional device disclosed in, for example, Japanese Patent Application Laid-Open No. 3-292257. In the figure, 1 is a first interlocking control system, 1a is a control unit mounted on the first interlocking control system 1, has a CPU, and executes a program that functions as an interlocking device by the CPU. Reference numeral 1b denotes an external I / F for connecting the control unit 1a to the control target device 6, 1c denotes a control output line for transmitting a control output to the control target device 6, 1d
Is a display line for receiving information from the device 6 to be controlled. Reference numeral 1e denotes a cycle timer for setting a program execution cycle of each control unit of the first interlocking control system 1 and the second interlocking control system 2. Reference numeral 2 denotes a second interlocking control system,
A control unit 2a, an external I / F 2b, a control output line 2c, a display line 2d, and a periodic timer 2e having the same functions as the interlocking control system 1 exist or are connected. 3
Is a system switch, and depending on the state of the system switch 3, only one of the external I / Fs of the first interlock control system 1 and the second interlock control system 2 is operated, and the output of the other system is output. Cut it. 4
“a” connects the system switch 3 and the control unit 1 a, and is a system state signal indicating a system switching state, and 4 b is a system failure signal indicating a failure state of the first interlocking control system 1. Similarly, 5a is a system status signal, and 5b is a system failure signal of the second interlocking control system 2.

In such a conventional parallel dual-system electronic interlocking device, when the first interlocking control system 1 is a use system and the second interlocking control system 2 is a standby system, information from the controlled device 6 is Are transmitted in parallel to the two interlocking control systems 1 and 2 through the display lines 1d and 2d. Based on this information, the control units 1a and 2a perform data processing in synchronization with each other. The instruction information is sent to the controlled device 6 through the output lines 1c and 2c. However, normally, the output of the second interlocking control system 2 which is a standby system is cut off, so that the output of the first interlocking control system 1 functions. Like the first interlocking control system 1, the second interlocking control system 2 receives information from the controlled device 6 and operates equivalently to prepare abnormally.

A first interlocking control system 1 and a second interlocking control system 2
When the used system is operating normally, the period is set to be correct and the standby system cycle timer 2e is set in accordance with the timer of the used system to synchronize the two systems. ing. Next, the procedure of system switching from the used system to the standby system will be described. In each of the interlocking control systems 1 and 2, the control units 1a and 1b constantly judge an abnormality, and when an abnormality is detected, outputs the system failure signals 4b and 5b of the system that has detected the abnormality. When detecting the system failure signal 4b from the first interlocking control system 1, the system switch 3 cuts off the control output of the using system and switches the second interlocking control system 2, that is, the standby system, to the using system. Thereby, the second interlocking control system 2 functions.

[0005]

In the conventional parallel dual-system electronic interlocking device as described above, the active system and the standby system are operated in parallel on the assumption that the input data from the device to be controlled is the same information. Performs control calculations by inputting and outputs the results as control, but there is no confirmation as to whether the contents of each control output are the same, so there is a difference between the contents of both control outputs In some cases, system switching occurred, and continuity of control output was not maintained before and after system switching. If the control output becomes discontinuous, there is a problem that various problems are caused to the control target device.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-described problems, and an object of the present invention is to maintain continuity of control output before and after system switching and to control the operation of controlled equipment at the time of system switching. An object of the present invention is to provide a parallel dual electronic interlocking device capable of preventing trouble.

[0007]

Means for Solving the Problems Input data input by the use system and used for the control operation is transferred to the standby system via the mirror memory, and the standby system performs the control operation using the received input data. Means for performing, means for calculating check values of respective output data in the use system and the standby system, and means for comparing check values of output data of both systems in the standby system, and when the comparison results do not match. Means for outputting failure information as a failure of the standby system is provided.

The check value is calculated as a CRC.

The check value is calculated as a checksum.

In addition, when input data is transferred from the use system to the standby system, there is provided a means for adding a counter value which is incremented every transfer cycle, and a means for adding the counter value to a check value of output data and comparing it. ing.

The means for adding the check value of the input data when the check value of the output data is transferred from the use system to the standby system, and the standby system includes, in addition to the comparison of the check values of the output data of both systems, A means for comparing check values of input data of both systems is provided.

In transferring data from the used system to the standby system, a queue is provided on the mirror memory, enqueued (registered in the queue) in the used system, and dequeued (registered in the queue) in the standby system. Read out).

When data is transferred from the used system to the standby system, an interrupt is generated from the used system to the standby system after writing the data, and the occurrence of the interrupt is used as a data read timing in the standby system. is there.

When data is transferred from the used system to the standby system, the used system updates the write status after writing the data, and the standby system monitors the write status at regular intervals to read the data. This is the timing.

[0015]

BEST MODE FOR CARRYING OUT THE INVENTION

Embodiment 1 FIG. FIG. 1 is a block diagram showing a main configuration in a case where control is performed using a parallel dual electronic interlocking device according to an embodiment of the present invention. In the figure, reference numerals 1 to 6 are the same as or equivalent to the conventional one shown in FIG.
Reference numeral 7a denotes a mirror memory constituting the first interlocking control system 1, and 7b denotes a mirror memory constituting the second interlocking control system 2. 8a and 8b are connection cables for connecting the mirror memories 7a and 7b to each other. Mirror memory 7a, 7b
Is a memory board that can be written and read in the same manner as a normal RAM when viewed from the control units 1a and 2a. Data written from the control unit 1a to the mirror memory 7a is
At the same time, the data is copied to the corresponding area of the mirror memory 7b via the connection cable 8a and can be read from the control unit 2a. Similarly, data written from the control unit 2a to the mirror memory 7b is simultaneously copied to the corresponding area of the mirror memory 7a via the connection cable 8b.
a. However, the corresponding area of the mirror memory 7b to which the data from the control unit 1a is copied, the area of the mirror memory 7b to which the control unit 2a writes the data, and the corresponding area of the mirror memory 7a to which the data from the control unit 2a is copied And the area of the mirror memory 7a to which the control unit 1a writes data is arranged so as not to overlap, and is used as an I / F between the first interlocking control system 1 and the second interlocking control system 2.

The operation of the first interlocking control system 1 used in the parallel dual electronic interlocking device thus configured is shown in the flowchart of FIG. 2, and the operation of the second interlocking control system as the standby system. Will be described with reference to the flowchart of FIG. First, in the first interlocking control system 1, after initialization (S1), display information is input from the controlled device 6 to the internal RAM via the display line 1d (S2). The input information is written to the mirror memories 7a and 7b, and the display information is passed to the second interlocking control system 2 (S3). Next, the first interlocking control system 1 performs a control calculation according to the input information (S4), and calculates a CRC of the control output (S5). The CRC is the remainder when the control output data multiplied by the highest order term of the generator polynomial is divided by the generator polynomial. Control output data P (X), polynomial G (X) = X ¹⁶ + X ¹² + X ⁵ +1
Then, the CRC is obtained by the remainder of X ¹⁶ · P (X) / G (X). The most common way to check the control output is to calculate a CRC, so that an erroneous bit can be detected, so that the check can be reliably performed. By writing the control output CRC into the mirror memories 7a and 7b, (S
6) The control output CRC of the used system is passed to the standby system. Finally, the control output is output to the control target device 6 via the control output line 1c (S7). Hereinafter, the above S2 to S
7 is repeated in a control cycle by the cycle timer 1e.

In the second interlocking control system 2, after the initialization (T1), the input information written by the use system is read from the mirror memory 7b and input to the internal RAM (T1).
2). Next, as in the case of the use system, a control operation is performed according to the input information (T3), and a control output CRC is calculated (T3).
4). Then, the control output CRC written by the use system is read from the mirror memory 7b (T5), and the value is compared with the control output CRC of the standby system calculated at T4 (T5).
6). As a result of the comparison, when a mismatch is detected between both CRCs (NG at T6), the continuity of the control output is not maintained even if the operation is switched to the standby system. The system failure signal 5b is output to the switch 3 (T7). As a result, the standby system program is stopped (T8), and discontinuity of control output due to switching to the standby system can be prevented. If a CRC match is confirmed in T6 (when T6 is OK), T2 to T6
Is repeated at the control cycle of the cycle timer 2e synchronized with the cycle timer 1e. As described above, even if some abnormality occurs in the used system, switching to the standby system is not performed if the control outputs of the used system and the standby system do not match. Discontinuity can be prevented.

Embodiment 2 FIG. In the first embodiment, system switching is performed if the control output of the used system and the control output of the standby system match, but the system is switched from the used system due to a difference in hardware characteristics between the used system and the standby system. After the timer is set and before the data of that cycle is written, the standby system may read the data, in which case,
There was a problem that the standby system would read data one cycle earlier. In the second embodiment, a shift in both calculation periods is detected, and if the calculation periods are shifted even if the control outputs match, system switching is prohibited. The flow of processing of the use system according to the present embodiment will be described with reference to the flowchart of FIG. 4 and the flow of processing of the standby system with reference to the flowchart of FIG. In the use system, as in the case of the first embodiment, after initialization, display information is input from the control target device 6, and the mirror memory 7a and the mirror memory 7 are used.
The display information is transferred to the second interlocking control system 2 by writing the information in the field b (S1 to S3). At the same time, the period counter is incremented and the mirror memory 7 is used as the input counter value.
The data is passed to the standby system by writing to a and 7b (U1). Subsequently, the first interlocking control system 1 performs a control operation in accordance with the input information, calculates a CRC of the control output, and calculates the CRC of the control output.
a, 7b, the control output CR of the used system is written.
C is passed to the standby system (S4 to S6). At this time, the U1
Then, the same counter value as the one passed to the standby system is written to the mirror memories 7a and 7b as an output counter (U2).
Finally, the control output is output to the control target device 6 via the control output line 1c (S7).

On the other hand, in the standby system, after initialization, input information is read from the mirror memory 7b (T1 to T1).
2). At the same time, the input counter value written by the used system is read from the mirror memory 7b (U3). Next, similarly to the first embodiment, a control operation is performed according to the input information,
The control output CRC is calculated and compared with the control output CRC of the use system read from the mirror memory 7b (T3 to T3).
6). As a result of the comparison, if a mismatch is detected between both CRCs (NG at T6), a system failure signal 5b is output, and
The standby system program is stopped (T7 to T8). If both CRCs match (OK at T6), the output counter value written by the use system is read from the mirror memory 7b (U4), and if it does not match the counter value read at U3 (NG at U5). ), It is determined that the periods are out of alignment, a failure signal is output, and the program is stopped (T7 to T8). When the input counter read from the mirror memory 7b matches the output counter (O5 in U5)
In the case of K), the processing of T2 to U5 is repeated at the control cycle of the cycle timer 2e synchronized with the cycle timer 1e of the used system. As described above, it is possible to detect a mismatch between the outputs of the two systems due to a shift in the execution cycle.

Embodiment 3 In the first embodiment, the coincidence of the control outputs of the active system and the standby system is confirmed. However, in the third embodiment, the coincidence of the input data of both systems is also confirmed. . The flow of processing of the use system according to the present embodiment will be described with reference to the flowchart of FIG. 6 and the flow of processing of the standby system with reference to the flowchart of FIG. In the use system, as in the first embodiment, after initialization, display information is input from the controlled device 6 and written into the mirror memories 7a and 7b to pass the display information to the second interlocking control system 2 ( S1 to S3).
Then, a control operation is performed according to the input information, a CRC of the control output is calculated and written to the mirror memories 7a and 7b, so that the control output CRC of the use system is passed to the standby system (S4 to S6). Subsequently, in the above processing, the control target device 6
Calculates the CRC of the input information inputted from (V1) and writes the value to the mirror memories 7a and 7b, thereby passing the input information CRC of the active system to the standby system (V2). Finally, the control output is output to the control target device 6 via the control output line 1c (S7).

On the other hand, in the standby system, after initialization, a control operation is performed according to the input information read from the mirror memory 7b, and a control output CRC is calculated and read from the mirror memory 7b, as in the first embodiment. A comparison is made with the control output CRC of the used system (T1 to T6). As a result of the comparison,
When a mismatch is detected between both CRCs (NG at T6), the system failure signal 5b is output and the standby system program is stopped (T7 to T8). If both CRCs match (OK at T6), the mirror memory 7b
Calculates the CRC of the input information in the standby system read from (v3), and reads the CRC of the input information written by the used system from the mirror memory 7b (v4). And
The input information CRC of the standby system calculated in the process of V3 is compared with the CRC of the input information of the active system read in the process of V4 (V5), and if they do not match (NG at V5), the failure signal 5b is output to stop the standby system program (T7 to T8). If both match (O at V5
In the case of K), the processing of T2 to V5 is repeated at the control cycle of the cycle timer 2e synchronized with the cycle timer 1e of the used system. As described above, not only the control output data of both the used system and the standby system but also the coincidence of the input data can be confirmed.

Embodiment 4 Due to the difference in hardware characteristics between the active system and the standby system, an event may occur such that the standby system reads before the data writing of the active system is completed, and the written data matches the data to be read. There was a problem of not doing. In the present embodiment, a queue is formed in the mirror memory to protect data, writing to the mirror memory is enqueued (registered) in the queue, and reading from the mirror memory is dequeued (read) from the queue. An example is shown below. The flow of processing of the use system according to the present embodiment will be described with reference to the flowchart of FIG. 8 and the flow of processing of the standby system with reference to the flowchart of FIG. In the system used, after initialization
Display information is input from the control target device 6 and the mirror memory 7 is input.
The display information is passed to the second interlocking control system 2 by enqueuing to the a and 7b (S1 to W1). Then, a control operation is performed according to the input information, a CRC of the control output is calculated and enqueued in the mirror memories 7a and 7b, so that the control output CRC of the use system is passed to the standby system (S4).
~ W2). Finally, the control output is output to the control target device 6 via the control output line 1c (S7).

On the other hand, in the standby system, initialization (T1)
Thereafter, the input information is dequeued from the mirror memory 7b (W3), a control operation is performed according to the input information, and a control output CRC is calculated (T3 to T4). Then, the control output CRC of the use system is dequeued from the mirror memory 7b (W4), and the control output CRC of the standby system calculated in T4 is calculated.
(T6). As a result of the comparison, if a mismatch is detected between both CRCs (NG at T6), the system failure signal 5
b to stop the standby program (T7-
T8). If both CRCs match (OK at T6), the processing of W3 to T6 is performed using the period timer 1e of the used system.
Is repeated at the control cycle of the cycle timer 2e synchronized with the control cycle.
As described above, the input data written in the mirror memory from the used system and the input data read by the standby system surely coincide with each other, thereby preventing the output data from being inconsistent due to the inconsistency in the input data.

Embodiment 5 As described above, the standby system sometimes reads data while data is being written from the active system.However, the active system generates an interrupt when data writing to the mirror memory is completed. In the system, by reading data when an interrupt occurs, both can be synchronized. FIG. 10 is a block diagram of the apparatus according to the present embodiment, which has the same configuration as that shown in FIG. 1, but the mirror memories 7a and 7b have a function of mutually generating an interrupt signal. . 9a is an interrupt line from the mirror memory 7a to the control unit 1a, 9b
Is an interrupt line from the mirror memory 7b to the control unit 2a. The control section 1a simultaneously accesses the interrupt generation area of the mirror memory 7b by writing to a specific area of the mirror memory 7a, and as a result, an interrupt is generated from the mirror memory 7b to the control section 2a by the interrupt line 9b. An interrupt from the mirror memory 7a to the control unit 1a is generated in the same procedure.

FIG. 11 is a flow chart showing the flow of processing in the use system according to the present embodiment, and FIG. 12 is a flow chart showing the flow of processing in the standby system.
Is shown in the flowchart of FIG. The entire processing flow is the same as S1 to S7 shown in FIG. 2 and T1 to T8 shown in FIG. 3, but in the used system, immediately after the mirror memory write processing in S3 and S6, An interrupt is generated (X1 and X2) to notify the end of writing. The standby system waits for an interrupt from the active system (X3,
X4), T2 and T5 mirror memory reading is performed at the timing when an interrupt for notifying the end of writing from the active system occurs. As described above, it is possible to synchronize the data transfer between the use system and the standby system.

Embodiment 6 FIG. The data exchange between the used system and the standby system can also be synchronized by polling and detecting the status update from the used system in the standby system. In this case, the used system is the mirror memory 7a, 7b
By updating the above status, the operation timing is given to the standby system, and the standby system monitors the status update through the mirror memory 7b and synchronizes the processing with the used system. FIG. 13 is a flowchart showing the flow of processing in the use system according to the present embodiment, and FIG. 14 is a flowchart showing the flow of processing in the standby system. The flow of the entire process is represented by S1 shown in FIG.
S7 to T7, the same as T1 to T8 shown in FIG. 3, except that the statuses on the mirror memories 7a and 7b are updated (Y1, Y2) immediately after the mirror memory write processing of S3 and S6 in the use system. Notifies the end of writing. The standby system waits for the status update on the mirror memory 7b (Y3, Y4), and the mirror memory reading of T2 and T5 is performed at the timing when the status update for notifying the end of writing from the active system is received. . As a result, as in the fifth embodiment, the data transfer between the use system and the standby system can be synchronized.

Embodiment 7 It should be noted that the first to the first embodiments
In the above description, the CRC is calculated as a check value for confirming the coincidence of the output data. However, a check sum value may be calculated. A method of calculating a checksum value for checking output data is also common as in the case of CRC, but a checksum is obtained by simply adding output data to be checked, and by its nature, is multiplied by a calculation formula. Can be confirmed at a higher processing speed than that of the CRC including, and the continuity of the control output before and after system switching can be maintained.

[0028]

Since the present invention is configured as described above, it has the following effects.

The used system and the standby system are always operated, the check values of the control output data of both systems are calculated and compared, and if they do not match, the system switching is prohibited. Can be prevented from being discontinuous.

Checking of the control output data is performed by CRC.
Since the calculation is performed, the confirmation can be surely performed.

Further, since the control output data is checked by calculating the checksum, the check can be performed more quickly.

When data is transferred from the use system to the standby system via the mirror memory, a counter value is added and the counter value is checked together with the control output data. Can also be detected.

When a check value of output data is passed from a use system to a standby system via a mirror memory, a check value of input data from which the output data is calculated is added. Since the check is performed, it is possible to confirm the information more reliably.

Further, since a queue is formed in the mirror memory, it is possible to prevent inconsistency between data written by the active system and data read by the standby system.

Since the write timing of the mirror memory is notified from the use system to the standby system by an interrupt, the data transfer between the two systems can be synchronized.

Further, the write timing of the mirror memory is notified from the used system to the standby system by updating the status, so that data transfer between the two systems can be synchronized.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a main configuration of a parallel dual electronic interlocking device according to an embodiment of the present invention.

FIG. 2 is a flowchart showing a flow of a process of a use system according to the first embodiment of the present invention.

FIG. 3 is a flowchart showing a flow of processing of a standby system according to the first embodiment of the present invention.

FIG. 4 is a flowchart showing a flow of a process of a use system according to the second embodiment of the present invention.

FIG. 5 is a flowchart showing a flow of processing of a standby system according to Embodiment 2 of the present invention.

FIG. 6 is a flowchart showing a flow of processing of a use system according to Embodiment 3 of the present invention.

FIG. 7 is a flowchart showing a flow of processing of a standby system according to Embodiment 3 of the present invention.

FIG. 8 is a flowchart showing a flow of processing of a use system according to Embodiment 4 of the present invention.

FIG. 9 is a flowchart showing a flow of processing of a standby system according to Embodiment 4 of the present invention.

FIG. 10 is a block diagram showing a main configuration of a parallel dual electronic interlocking device according to a fifth embodiment of the present invention.

FIG. 11 is a flowchart showing a flow of processing of a use system according to Embodiment 5 of the present invention.

FIG. 12 is a flowchart showing a flow of processing of a standby system according to Embodiment 5 of the present invention.

FIG. 13 is a flowchart showing a flow of processing of a use system according to Embodiment 6 of the present invention.

FIG. 14 is a flowchart showing a flow of processing of a standby system according to Embodiment 6 of the present invention.

FIG. 15 is a block diagram showing a main configuration of a conventional parallel dual electronic interlocking device.

[Explanation of symbols]

1 First interlock control system, 2 second interlock control system, 3 system switch, 7a, 7b mirror memory, 9a, 9b interrupt line.

Continuation of front page (56) References JP-A-6-329023 (JP, A) JP-A-2-196302 (JP, A) JP-A-5-63683 (JP, A) JP-A-2-114337 (JP) JP-A-62-187901 (JP, A) JP-A-4-125765 (JP, A) JP-A-1-154202 (JP, A) JP-A-4-49402 (JP, A) (58) Field surveyed (Int. Cl. ⁷ , DB name) G05B 9/03 B61L 19/06 G06F 11/18 310

Claims (8)

(57) [Claims] 1. A dual system comprising a use system used for normal interlocking control and a standby system provided in the event of a failure of the use system. In the parallel dual-system electronic interlocking device that performs switching, the input data used by the use system and used for control operation are transferred to the standby system via the mirror memory, and the input data passed in the standby system is transferred to the standby system. Means for performing a control operation using the same, means for calculating a check value of each output data in the use system and the standby system, and means for comparing check values of output data of both systems in the standby system, and the comparison result Means for outputting failure information as a failure of the standby system when the two do not match,
A parallel dual system electronic interlocking device, wherein system switching is prohibited when the failure information is output. 2. Check value is set to CRC (= Cyclic Redunda
2. The parallel dual electronic interlocking device according to claim 1, wherein the calculation is performed as ncy Code (cyclic redundancy code). 3. The device according to claim 1, wherein the check value is calculated as a checksum. And a means for adding a counter value to be incremented for each transfer cycle when input data is transferred from the use system to the standby system, and a means for adding the counter value to a check value of output data and comparing the added value. 4. The parallel dual electronic interlocking device according to claim 1, wherein: 5. A means for adding a check value of input data when a check value of output data is passed from a use system to a standby system. In the standby system, in addition to comparing the check values of output data of both systems, 5. The electronic device according to claim 1, further comprising means for comparing check values of input data of both systems. 6. When data is transferred from a used system to a standby system, a queue is provided on a mirror memory, enqueued (registered in the queue) in the used system, and dequeued (registered in the queue) in the standby system. 6. The parallel dual-system electronic interlocking device according to claim 1, wherein the reading is performed. 7. When data is transferred from a used system to a standby system, an interrupt from the used system to the standby system is generated after writing the data, and the occurrence of the interrupt is set as a data read timing in the standby system. The parallel dual electronic interlocking device according to any one of claims 1 to 5, wherein: 8. When data is transferred from the used system to the standby system, the used system updates the write status after writing the data, and the standby system monitors the write status at regular intervals to read the data. 6. The parallel dual electronic interlocking device according to claim 1, wherein timing is set.