JP5197844B2 - Safety control system and safety control method - Google Patents

Abstract

A safety control system is provided with a controller (1), a device under control (10), a first safety layer processing section (2) and a second safety layer processing section (3) that perform the predetermined processing of the control data output from the controller (1) so that such resultant data is available as transmission data, a first transmission layer processing section (4) to multiplex the transmission data for delivery to a transmission path (6), a second transmission layer processing section (7) to separate the multiplexed data received through the transmission path (6), and a third safety layer processing section (8) and a fourth safety layer processing section (9) that perform the validation check processing of the separated data, thereafter transmitting the control data for the separated data to a device under control (10) when the separated data is judged to be valid. The second transmission layer processing section (7) includes an error detection section (12) to send an alarm signal in case the quality of the transmission path (6) deteriorates below a predetermined threshold, and the third safety layer processing section (8) and the fourth safety layer processing section (9) stop transmission of the control data to the device under control upon reception of the alarm signal.

Description

  The present invention relates to a safety control system and a safety control method applied to a railway system, FA (Factory Automation), and the like.

  As an example of the prior art of a safety control system that performs control while preventing malfunction and operation due to a machine failure or software bug, for example, there is a safety bus system described in Non-Patent Document 1 below. The safety bus system includes a control device, a first safety layer, a second safety layer, a first transmission layer, a second transmission layer, a third safety layer, a fourth safety layer, and a controlled device. The control device transmits data for controlling the controlled device. The first transmission layer and the second transmission layer are processing units that perform processing for transmission. The first safety layer, the second safety layer, the third safety layer, and the fourth safety layer. Is a processing unit that performs error detection processing (safety code processing) to perform safety communication.

  The first safety layer and the second safety layer are redundant systems, and the data for controlling the controlled device transmitted from the control device is compared with each other to detect a predetermined error. Is processed as a safety message and output to the first transmission layer. The multiplexing unit of the first transmission layer multiplexes the output from the first safety layer and the output from the second safety layer and transmits the multiplexed signal to the second transmission layer. The packet separator of the second transmission layer separates the multiplexed data and outputs it to the third safety layer and the fourth safety layer, respectively. For example, the outputs from the first safety layer are output separately to the third safety layer, and the outputs from the second safety layer are output to the fourth safety layer.

  The third safety layer and the fourth safety layer are redundant with each other, and a predetermined process (sequence number detection and CRC ( (Cyclic Redundancy Check) detection, etc.) and outputs data to the controlled device when it is determined that the signal has been received normally based on the processing result. The third safety layer and the fourth safety layer transmit an acknowledgment signal (ACK signal) to the first safety layer and the second safety layer when the data can be normally received.

  On the other hand, when normal data cannot be received due to a transmission path failure or transmission path quality degradation, the third safety layer and the fourth safety layer stop the control, and the first safety layer and the second safety layer Send an alarm to the safety layer. For example, in the case of transmission line quality deterioration, it is determined that the above processing has not been performed normally. Further, the third safety layer and the fourth safety layer use, for example, a periodic timer such as a CPU watch dog timer to determine that an abnormality occurs when data does not arrive due to a transmission path failure or the like. If the next data cannot be received even after a predetermined time has elapsed after receiving the first safety layer and the second safety layer, an alarm is transmitted to the first safety layer and the second safety layer.

Translated by Junichi Tanaka, "Safety Bus System for Automation", NPO Safety Engineering Laboratory, September 2003

  However, in the conventional safety bus system described above, the third safety layer and the fourth safety layer are subjected to data coincidence detection, sequence number detection and CRC detection, monitoring by a periodic timer, etc., to detect an abnormality. . Therefore, there is a problem that it takes time to detect an abnormality.

  In the above-described conventional safety bus system, the third safety layer and the fourth safety layer disconnect (stop) the controlled device when an abnormality is detected. There was a problem of stopping. If an abnormality occurs and the detection of the abnormality is delayed, the countermeasure is also delayed and the service stop time is delayed.

  The present invention has been made in view of the above, and an object of the present invention is to obtain a safety control system and a safety control method capable of reducing the time until an abnormality is detected and reducing the service stop time.

In order to solve the above-described problems and achieve the object, the present invention provides a control device, a controlled device controlled by the control device, and control data output from the control device for predetermined normality confirmation. The transmission-side safety layer processing means for performing transmission processing of the transmission data, transmission-side transmission processing means for multiplexing the transmission data and sending it to the transmission line as multiplexed data, and the multiplexed data received from the transmission line Receiving-side transmission processing means that separates the transmission data and outputs the separated data, and performs a predetermined normality confirmation process on the separated data, and determines that the control data extracted from the separated data is determined to be normal. Receiving safety layer processing means for transmitting to the controlled device, wherein the receiving side transmission processing means is configured to transmit the transmission signal based on a signal received via the transmission path. An error detecting means for obtaining a quality of a road, and transmitting an alarm signal for notifying an abnormality to the receiving-side safety layer processing means when the quality is deteriorated below a predetermined threshold, the receiving-side safety layer processing; The means comprises stop means for stopping transmission of control data to the controlled device when the alarm signal is received, and the transmission-side transmission processing means measures a noise level of a signal to which noise of its own system is added. And a quality estimating means for notifying the measured noise level, a replicating means for generating a duplicate of the multiplexed data, a continuous transmission count based on the noise level, and the continuous transmission count and time for performing the continuous transmission. A continuous transmission control means for notifying the duplication means of the interval; a multiplexing means for further multiplexing the duplicate output from the duplication means and the multiplexed data to be multiplexed data to be sent to the transmission line; The quality estimation means includes an accelerometer means for measuring acceleration generated in the own system, and an acceleration signal indicating an acceleration / deceleration period in which acceleration or deceleration occurs based on the measurement result of the accelerometer means. An acceleration detection means for outputting; and a noise level detection means for measuring the noise level during a period in which the acceleration signal is outputted and notifying the measured noise level, wherein the duplicating means generates a minute replication, and wherein also be output from the replica said multiplexing means on the basis of said time interval.

  In the safety control system and the safety control method according to the present invention, the second transmission layer includes an error detection unit, monitors the error rate of the transmission line, and when the error rate is worse than a predetermined error rate, Since the alarm signal is transmitted to the safety layer and the fourth safety layer, the time until the abnormality is detected can be shortened, and the service stop time can be reduced.

FIG. 1 is a diagram illustrating a configuration example of a first embodiment of a safety control system according to the present invention. FIG. 2 is a sequence diagram illustrating an example of processing performed when a failure occurs in the conventional example. FIG. 3 is a diagram illustrating a configuration example of the safety control system according to the second embodiment. FIG. 4 is a diagram illustrating a configuration example of the safety control system according to the third embodiment. FIG. 5 is a diagram illustrating a configuration example of the safety control system according to the fourth embodiment. FIG. 6 is a diagram illustrating an example of a variation pattern of the acceleration amount. FIG. 7 is a diagram illustrating a configuration example of the quality estimation unit. FIG. 8 is a diagram illustrating a configuration example of the acceleration detection unit. FIG. 9 is a diagram illustrating a configuration example of the noise level detection unit.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Control apparatus 2 1st safety layer processing part 3 2nd safety layer processing part 4, 4a, 4b, 4c 1st transmission layer processing part 5, 19 Packet multiplexing part 6, 20 Transmission path 7, 7a, 7b 1st 2 transmission layer processing unit 8 third safety layer processing unit 9 fourth safety layer processing unit 10 controlled device 11 packet separation unit 12, 12a error detection unit 13 first error correction coding unit 14 second error correction Code unit 15 First error correction decoding unit 16 Second error correction decoding unit 17, 17a Continuous transmission number control unit 18 Copy unit 21 Quality estimation unit 22 Accelerometer 23 Acceleration detection unit 24 Noise level detection unit 25 Delay unit 26 Potential difference Amplifying unit 27 First voltage comparing unit 28 Second voltage comparing unit 29 Logic synthesizing unit 30 Detection unit 31 Coding unit

  Embodiments of a safety control system and a safety control method according to the present invention will be described below in detail with reference to the drawings. Note that the present invention is not limited to the embodiments.

Embodiment 1 FIG.
FIG. 1 is a diagram illustrating a configuration example of a first embodiment of a safety control system according to the present invention. As shown in FIG. 1, the safety control system of the present embodiment includes a control device 1, a first safety layer processing unit 2, a second safety layer processing unit 3, a first transmission layer processing unit 4, and a transmission line. 6, a second transmission layer processing unit 7, a third safety layer processing unit 8, a fourth safety layer processing unit 9, and a controlled device 10. The first transmission layer processing unit 4 includes a packet multiplexing unit 5, and the second transmission layer processing unit 7 includes a packet separation unit 11 and an error detection unit 12.

  The safety control system of the present embodiment is a second transmission layer of the safety bus system shown in “(Safety Bus System for Automation”, NPO Safety Engineering Laboratory, page 38) (hereinafter referred to as a conventional example) (see FIG. 1, an error detector 12 is added to the second transmission layer processor 7). The control device 1 includes a first safety layer processing unit 2 and a second safety layer processing unit 3, a first transmission layer processing unit 4, a transmission path 6, Control data for controlling the controlled device 10 via the transmission layer processing unit 7 and the third safety layer processing unit 8 and the fourth safety layer processing unit 9 which are safety layer processing means on the receiving side. Send. The first safety layer processing unit 2, the second safety layer processing unit 3, the third safety layer processing unit 8, and the fourth safety layer processing unit 9 perform safety layer processing. The safety layer is a layer that performs data normality confirmation processing and the like for performing control to prevent malfunctions due to control data errors.

  In the present embodiment, as in the above-described conventional example, the first safety layer processing unit 2 and the second safety layer processing unit 3 constitute a redundant system, and the control device 1 includes the first safety layer processing unit 2. The same control data is transmitted to the layer processing unit 2 and the second safety layer processing unit 3. Then, the first safety layer processing unit 2 and the second safety layer processing unit 3 are respectively connected to the control data inputted to itself and the other safety layer processing unit (second safety layer processing unit 3, first safety layer processing unit 3 After collating the control data input to the layer processing unit 2), the control data input to itself is output to the packet multiplexing unit 5 of the first transmission layer processing unit 4. The packet multiplexing unit 5 multiplexes the control data input from the first safety layer processing unit 2 and the second safety layer processing unit 3 and transmits the multiplexed data to the transmission path 6.

  The packet separation unit 11 of the second transmission layer processing unit 7 and the error detection unit 12 of the transmission line 6 receive the multiplexed data from the transmission line 6. Then, the packet separation unit 11 separates the multiplexed data, and transmits the separated data to the third safety layer processing unit 8 and the fourth safety layer processing unit 9. At this time, for example, the control data output from the first safety layer processing unit 2 is output to the third safety layer processing unit 8, and the control data output from the second safety layer processing unit 3 is the fourth safety data. Separation and output are performed so as to be output to the safety layer processing unit 9.

  The error detection unit 12 performs transmission line quality monitoring of the transmission line 6 based on the multiplexed data. Specifically, an error rate is obtained based on the multiplexed data, and when the error rate is worse than a preset error rate, an alarm signal is sent to the third safety layer processing unit 8 and the fourth safety layer processing unit 9. Output to. The error detection method at this time may be the same as or different from the method performed by the third safety layer processing unit 8 and the fourth safety layer processing unit 9. Further, the error rate may be obtained based on other data passing through the transmission path 6 other than the multiplexed data. In the case of using a different method, for example, the packet multiplexing unit 5 adds an error detection code used by the error detection unit 12 for error detection.

  The third safety layer processing unit 8 and the fourth safety layer processing unit 9 constitute a redundant system as in the above-described conventional example, and detect data coincidence, sequence number detection, and CRC for the input data. When processing such as detection is performed and the normality of the input data is confirmed, the control data included in the data is extracted and transmitted to the controlled device 10. In the conventional example, when an error depending on the transmission line quality occurs, the third safety layer processing unit 8 and the fourth safety layer processing unit 9 perform processing such as data match detection, sequence number detection, and CRC detection. After that, an error is detected. In the present embodiment, it is possible to detect an error depending on the transmission path quality before performing the processing of the packet separation unit 11 and the processing of the third safety layer processing unit 8 or the fourth safety layer processing unit 9. Therefore, the alarm signal can be transmitted promptly as compared with the conventional example.

  Further, when a failure occurs in the processing circuit of the third safety layer processing unit 8 or the fourth safety layer processing unit 9 and processing such as the coincidence detection, sequence number detection, and CRC detection cannot be performed, The abnormality is detected by the watch dock timer of the CPU in which the third safety layer processing unit 8 and the fourth safety layer processing unit 9 operate.

  FIG. 2 is a sequence diagram illustrating an example of processing performed when a failure occurs in the conventional example. As shown in FIG. 2, at time t0, control data is transmitted as a first safety message from the first safety layer processing unit 2 and the second safety layer processing unit 3, and the first transmission layer processing unit 4 and The third safety layer processing unit 8 and the fourth safety layer processing unit 9 arrive at the time t1 via the second transmission layer processing unit 7 (step S11). Here, the response timer T0 is a time interval for transmitting data from the first safety layer processing unit 2 and the second safety layer processing unit 3. The third safety layer processing unit 8 and the fourth safety layer processing unit 9 perform the above-described processing, and transmit the first safety message confirmation (ACK signal) when it is determined that the data is normal. (Step S12).

  The first safety layer processing unit 2 and the second safety layer processing unit 3 transmit control data as a second safety message at time t2 (= t1 + T0) (step S13). The periodic timer T1 is a watch dock timer of a CPU in which the third safety layer processing unit 8 and the fourth safety layer processing unit 9 are operating. Here, it is assumed that a failure occurs in the transmission path 6 and the second safety message does not arrive at the third safety layer processing unit 8 and the fourth safety layer processing unit 9 (step S14). In this case, the watch dock timer of the CPU in which the third safety layer processing unit 8 and the fourth safety layer processing unit 9 are operated is the first safety layer processing unit 2 and the second safety layer processing unit 2 even if T1 has elapsed from t1. Since the data does not arrive from the safety layer processing unit 2 of 2, it is determined that there is an abnormality (defect detection: step S 15), and an alarm signal is transmitted to the third safety layer processing unit 8 and the fourth safety layer processing unit 9. The notification is notified to the first safety layer processing unit 2 and the second safety layer processing unit 3 (step S16). And the 3rd safety layer processing part 8 and the 4th safety layer processing part 9 will disconnect controlled device 10, if an alarm signal is received.

  On the other hand, in the present embodiment, a transmission path failure can be detected by the error detection unit 12 of the second transmission layer processing unit 7 receiving data and performing error detection. Therefore, for example, when the time at which the error detection unit 12 of the second transmission layer processing unit 7 determines that the error rate of the second safety message exceeds a predetermined error rate is time t3, A defect can be detected earlier than the conventional example by the time loss TL, which is the difference between (t0 + T1) and time t3.

  In addition, the third safety layer processing unit 8 and the fourth safety layer processing unit 9 disconnect the controlled device 10 when the control data cannot be received correctly. Therefore, the service of the safety control system is stopped until it returns to normal after being disconnected. If the alarm signal can be transmitted early, the countermeasure can be implemented earlier, and as a result, the service stop period can be shortened.

  In the present embodiment, the first safety layer processing unit 2 and the second safety layer processing unit 3, and the third safety layer processing unit 8 and the fourth safety layer processing unit 9 constitute a redundant system, respectively. Although the same control data is processed, the present invention is not limited to this, and the first safety layer processing unit 2 and the second safety layer processing unit 3 may transmit different data. If the first transmission layer processing unit 4 performs multiplexing and the second transmission layer processing unit 7 performs packet separation, the first safety layer processing unit 2 and the second safety layer processing unit 3 Even when data different from each other is transmitted, the error detection unit 12 of the second transmission layer processing unit 7 may be added similarly to the present embodiment.

  As described above, in the present embodiment, the second transmission layer processing unit 7 includes the error detection unit 12, monitors the error rate of the transmission path 6, and when the error rate is worse than a predetermined error rate, An alarm signal is transmitted to the third safety layer processing unit 8 and the fourth safety layer processing unit 9. Therefore, it is possible to shorten the time until an abnormality is detected as compared with the conventional case. In addition, since the time until an abnormality is detected can be shortened, the service stop period can be shortened.

Embodiment 2. FIG.
FIG. 3 is a diagram illustrating a configuration example of the safety control system according to the second embodiment of the present invention. As shown in FIG. 3, the safety control system according to the present embodiment includes a first transmission layer processing unit 4 and a second transmission layer processing unit 7 of the safety control system according to the first embodiment, respectively. This embodiment is the same as the first embodiment except that the processing unit 4a and the second transmission layer processing unit 7a are replaced. The first transmission layer processing unit 4a of the present embodiment adds a first error correction coding unit 13 and a second error correction coding unit 14 to the first transmission layer processing unit 4 of the first embodiment. Other than that, the second transmission layer processing unit 4 is the same as the first transmission layer processing unit 4 of the first embodiment. Further, the second transmission layer processing unit 7a of the present embodiment adds a first error correction decoding unit 15 and a second error correction decoding unit 16 to the second transmission layer processing unit 7 of the first embodiment. Except for this, it is the same as the second transmission layer processing unit 7 of the first embodiment. Components having the same functions as those in the first embodiment are denoted by the same reference numerals and description thereof is omitted.

  In the present embodiment, control data is transmitted from the control device 1 to the first safety processing unit layer 2 and the second safety layer processing unit 3 as in the first embodiment. In the present embodiment, the control data output from the first safety layer processing unit 2 is input to the first error correction encoding unit 13, and the first error correction encoding unit 13 receives the input control. A predetermined encoding process is performed on the data, and the control data after the encoding process is output to the packet multiplexing unit 5. Similarly, the control data output from the second safety layer processing unit 3 is input to the second error correction encoding unit 14, and the second error correction encoding unit 14 adds a predetermined value to the input control data. After performing the encoding process, the data is output to the packet multiplexing unit 5.

  The packet multiplexing unit 5 multiplexes the output from the first error correction code unit 13 and the output from the second error correction code unit 14, and outputs multiplexed data to the transmission path 6. The second transmission layer processing unit 7a receives the multiplexed data from the transmission path 6, and the packet separation unit 11 separates the multiplexed data. Then, the separated data is input to the first error correction decoding unit 15 and the second error correction decoding unit 16, respectively. The first error correction decoding unit 15 performs predetermined error correction decoding processing on the input separated data, and then sends the data to the third safety layer processing unit 8. The second error correction decoding unit 16 performs a predetermined error correction decoding process on the input separated data, and then sends the data to the fourth safety layer processing unit 9. As described above, in the second transmission layer processing unit 7a of the present embodiment, the first error correction decoding unit 15 and the second error correction decoding unit 16 perform error correction decoding. However, if the error correction capability is within the range, no error occurs in the data input to the third safety layer processing unit 8 and the fourth safety layer processing unit 9.

  In the present embodiment, as in the first embodiment, when the third safety layer processing unit 8 and the fourth safety layer processing unit 9 determine that the input data is not normal, the controlled device 10 Disconnect. However, as described above, even if an error occurs in the transmission line 6 as long as the error correction capability of the first error correction decoding unit 15 and the second error correction decoding unit 16 is within the range, Control can be continued without disconnecting.

  Similarly to the first embodiment, the error detection unit 12 monitors the transmission line quality of the transmission line 6, and when the error rate is worse than a predetermined error rate, the third safety layer processing unit 8 , An alarm signal is transmitted to the fourth safety layer processing unit 9.

  In this embodiment, since an error correction technique is applied, an error occurs in the transmission path 6 within the range of the error correction capability of the first error correction decoding unit 15 and the second error correction decoding unit 16. Control continues even if it occurs, but since the transmission path quality itself has deteriorated, the error detection unit 12 transmits and notifies an alarm signal.

  Considering from the service operation side, the transmission line quality is clearly deteriorated, so measures such as transmission line switching and transmission line repair should be implemented promptly. The service will be stopped. In this embodiment, since the service can be continued as described above, the above measures can be taken at a timing that minimizes the trouble to the service in consideration of operation.

  As described above, in the present embodiment, the first error correction code unit 13 and the second error correction code unit 14 of the first transmission layer processing unit 4a are respectively connected to the first safety layer processing unit 2 and the second safety layer processing unit 2. 2, the error correction coding process is performed on the output of the safety layer processing unit 3, and the first error correction decoding unit 15 and the second error correction decoding unit 16 of the second transmission layer processing unit 7 a perform the error correction decoding process. As long as the error correction capability is within the range, the control can be continued even if an error occurs in the transmission line 6. Further, as in the first embodiment, the error detection unit 12 transmits an alarm signal when the error rate of the transmission line 6 deteriorates below a predetermined value, so that an abnormality can be detected quickly. Furthermore, it is possible to take measures to improve the quality of the transmission line 6 at a timing that minimizes the trouble to the service in consideration of operation.

Embodiment 3 FIG.
FIG. 4 is a diagram illustrating a configuration example of a third embodiment of the safety control system according to the present invention. As shown in FIG. 4, the safety control system according to the present embodiment includes a first transmission layer processing unit 4 and a second transmission layer processing unit 7 of the safety control system according to the first embodiment, respectively. It is the same as Embodiment 1 except that the transmission line 20 is added instead of the processing unit 4b and the second transmission layer processing unit 7b. The first transmission layer processing unit 4b according to the present embodiment is different from the first transmission layer processing unit 4 according to the first embodiment except that a continuous transmission number control unit 17, a copy unit 18, and a packet multiplexing unit 19 are added. This is the same as the first transmission layer processing unit 4 of the first embodiment. The second transmission layer processing unit 7b of the present embodiment is the same as that of the first embodiment except that the error detection unit 12 of the second transmission layer processing unit 7 of the first embodiment is replaced with an error detection unit 12a. This is the same as the second transmission layer processing unit 7. Components having the same functions as those in the first embodiment are denoted by the same reference numerals and description thereof is omitted.

  As in the first embodiment, the control device 1 transmits the same control data to the first safety layer processing unit 2 and the second safety layer processing unit 3. Further, the packet multiplexing unit 5 multiplexes the output of the first safety layer processing unit 2 and the output of the second safety layer processing unit 3 as in the first embodiment. Here, in the present embodiment, the packet multiplexing unit 5 outputs the multiplexed data to the copy unit 18 and the packet multiplexing unit 19, respectively. The packet multiplexing unit 19 multiplexes the data output from the copy unit 18 described later and the multiplexed data output from the packet multiplexing unit 5, and sends the multiplexed data to the transmission path 6.

  The second transmission layer processing unit 7 b receives the multiplexed data from the transmission line 6, the error detection unit 12 a monitors the transmission line quality of the transmission line 6, and sends the monitoring result to the first transmission via the transmission line 20. The data is transmitted to the layer processing unit 4b. As a monitoring result, although it depends on the system configuration, an error rate is obtained as a monitoring result, a signal coded for each error rate is determined and a coded signal is transmitted, a code error detection result is transmitted as it is, There are methods. Here, the following description will be given by taking as an example the case of transmitting data coded for each error rate.

  The first transmission layer processing unit 4b receives the monitoring result via the transmission path 20, and the continuous transmission number control unit 17 determines the continuous transmission number based on the received monitoring result. In general, when the error rate is poor and the transmission path quality is poor, it is determined to increase the number of continuous transmissions. The copy unit 18 copies the data output from the packet multiplexing unit 5 for the number of continuous transmissions based on the continuous transmission number determined by the continuous transmission number control unit 17 and copies the data copied at a preset timing to the packet multiplexing unit. 19 are sequentially output.

  In this way, the data copied for the number of times of continuous transmission is input to the packet separation unit 11 of the second transmission layer processing unit 7b, and is subjected to packet separation. Therefore, since the packet separation unit 11 receives the same data for a larger number of continuous transmissions when the transmission path quality is poor, the probability that the packet separation unit 11 can receive normally is higher than when there is no continuous transmission. Therefore, the third safety layer processing unit 8 and the fourth safety layer processing unit 9 have a high probability that data coincidence detection, sequence number detection, and CRC detection can be normally performed, and can control the controlled device 10 stably. . That is, even if an error has been detected in the processing of the third safety layer processing unit 8 and the fourth safety layer processing unit 9 due to transmission path quality deterioration so far, the controlled device 10 is disconnected as described above. Since the controlled device 10 can be prevented from being disconnected by continuously sending a predetermined number of times, the service quality can be improved without stopping the service.

  Note that, in the safety control system of the present embodiment, the first error correction coding unit 13, the second error correction coding unit 14, the first error correction decoding unit 15, the second error correction unit, as in the second embodiment. An error correction decoding unit 16 may be added to perform both prevention of disconnection of the controlled device 10 due to continuous transmission and prevention of disconnection of the control device 9 due to error correction.

  As described above, in the present embodiment, the continuous transmission number control unit 17 of the first transmission layer processing unit 4b is based on the monitoring result of the quality of the transmission path 6 received from the second transmission layer processing unit 7b. The number of continuous transmissions is determined, and the copy unit 18 copies the control data for the number of continuous transmissions and transmits the same control data for the number of continuous transmissions. Therefore, it is possible to quickly detect the deterioration of the quality of the transmission path 6, and even when the quality of the transmission path 6 is reduced, the third safety layer processing unit 8 and the fourth safety layer processing unit 9 are operating normally. The possibility that the control data can be received is increased, the controlled device 10 can be prevented from being disconnected, and the service can be stably performed.

Embodiment 4 FIG.
FIG. 5 is a diagram illustrating a configuration example of a fourth embodiment of the safety control system according to the present invention. As shown in FIG. 5, the safety control system of the present embodiment is the same as that of the embodiment except that the first transmission layer processing unit 4b of the safety control system of the third embodiment is replaced with the first transmission layer processing unit 4c. It is the same as that of the safety control system of the form 3. Further, the first transmission layer processing unit 4c replaces the continuous transmission number control unit 17 of the third embodiment with the continuous transmission number control unit 17a, and replaces the first transmission layer processing unit 4b of the third embodiment with a quality estimation unit. Except for adding 21, it is the same as the first transmission layer processing unit 4 b of the first embodiment. Components having the same functions as those in the third embodiment are denoted by the same reference numerals and description thereof is omitted.

  As in the first embodiment, the control device 1 transmits the same control data to the first safety layer processing unit 2 and the second safety layer processing unit 3. Further, the packet multiplexing unit 5 multiplexes the output of the first safety layer processing unit 2 and the output of the second safety layer processing unit 3 as in the first embodiment. Here, in the present embodiment, the packet multiplexing unit 5 outputs the multiplexed data to the copy unit 18 and the packet multiplexing unit 19, respectively. The packet multiplexing unit 19 multiplexes the data output from the copy unit 18 described later and the multiplexed data output from the packet multiplexing unit 5, and sends the multiplexed data to the transmission path 6.

  The quality estimator 21 is a means for detecting the timing and noise level at which noise is superimposed on the communication board or the transmission line by the operation of a motor or the like. In the case of a moving safety control system used in a railway system or the like, noise may be superimposed on a communication board or a transmission path due to operation of a motor or the like. FIG. 6 is a diagram illustrating an example of a variation pattern of the acceleration amount. The upper part of FIG. 6 shows an example of a speed profile generated by the operation of a motor or the like. In FIG. 6, from time t11 to time t12, the vehicle accelerates in the traveling direction and increases in speed in the traveling direction. From time t12 to time t13, the vehicle travels at a constant speed without acceleration. Furthermore, from time t13 to time t14, the vehicle is accelerating in the direction opposite to the traveling direction, that is, the speed in the traveling direction is slowing down. In the case of the speed profile as shown in the upper diagram of FIG. 6, as shown in the middle diagram of FIG. 6, power supply noise is generated during acceleration (in both the traveling direction and the reverse direction). For example, the fluctuation pattern of the speed as shown in FIG. 6 is obtained, the timing of acceleration and attenuation is detected based on the fluctuation pattern, and the amount of noise superimposed on the communication board or transmission path is detected and detected. The quality information indicating the noise amount is sent to the continuous transmission number control unit 17a.

  FIG. 7 is a diagram illustrating a configuration example of the quality estimation unit 21. As shown in FIG. 7, the quality estimation unit 21 includes an accelerometer 22, an acceleration detection unit 23, and a noise level detection unit 24. The accelerometer 22 is a device that converts acceleration amount into voltage or current. For example, the accelerometer 22 outputs a positive potential when accelerated in the traveling direction, and outputs a negative potential when accelerated in the direction opposite to the traveling direction. The lower diagram of FIG. 6 shows an example of the result of the acceleration meter 22 converting the acceleration amount into voltage or current, that is, an acceleration detection result.

  FIG. 8 is a diagram illustrating a configuration example of the acceleration detection unit 23. As shown in FIG. 8, the acceleration detection unit 23 includes a delay unit 25, a potential difference amplification unit 26, a first voltage comparison unit 27, a second voltage comparison unit 28, and a logic synthesis unit 30. The accelerometer 22 detects a physical variation as shown in the upper diagram of FIG. 6 and inputs it to the potential difference amplification unit 26 and the delay unit 25. The delay unit 25 delays the input signal by an arbitrary time. The potential difference amplifying unit 26 detects a potential difference between the variation signal output from the accelerometer 22 and the delayed signal output from the delay unit 25, and amplifies the detected potential difference with an arbitrary gain. As the potential difference amplifier 26, an operational amplifier or the like is generally applied.

  Here, when Tdelay is set to a relatively small value (0 <Tdelay <(t12−t11)) with the delay amount delayed by the delay unit 25 as Tdelay, in the example of FIG. 6, the time t11 and the time t12 are set. Between the fluctuation signal detected by the accelerometer 22 and the delayed signal output from the delay unit 25, a potential difference corresponding to the slope (magnitude) of the speed (fluctuation) occurs. The potential difference at this time is assumed to be ΔV1.

  On the other hand, in the example of FIG. 6, since the voltage does not change between time t12 and time t13, there is almost no potential difference between the fluctuation signal detected by the accelerometer 22 and the delayed signal output from the delay unit 25. It will not come out. The potential difference at this time is assumed to be ΔV2.

  In the example of FIG. 6, between time t13 and time t14, similarly to time t11 to time t12, the speed is changed between the fluctuation signal detected by the accelerometer 22 and the delayed signal output from the delay unit 25. A potential difference corresponding to the inclination (size) occurs. The potential difference at this time is assumed to be ΔV3. Since the direction of acceleration between time t11 and time t12 and between time t13 and time t14 is opposite, the potential difference ΔV1 and potential difference ΔV3 have different signs, for example, specifically, potential difference ΔV1> 0 and potential difference ΔV3 <0. It becomes.

The first voltage comparison unit 27 outputs a significant signal when the signal output from the potential difference amplification unit 26 is higher than a predetermined first reference voltage. For example, if the first reference voltage Vth1 satisfies the condition shown in the following equation (1), a significant signal is output from time t11 to time t12.
First reference voltage setting condition: ΔV2 <Vth1 <ΔV1 (1)

The second voltage comparison unit 28 outputs a significant signal when the signal output from the potential difference amplification unit 26 is lower than a predetermined second reference voltage. For example, if the second reference voltage Vth2 satisfies the condition shown in Expression (2), a significant signal is output from time t13 to time t14.
Second reference voltage setting condition: ΔV3 <Vth2 <ΔV2 (2)

  The logic synthesis unit 28 synthesizes the significant signal output from the first voltage comparison unit 27 and the significant signal output from the second voltage comparison unit 28. In the example of FIG. 6, the lower diagram is the synthesis result of the logic synthesis unit 28, that is, the signal of the acceleration detection result (here, for example, the signal is “H (High)”, “L (Low)”). 2 levels, and the “H (High)” level is significant).

  The noise level detector 24 detects the noise level added by acceleration and outputs a code corresponding to the noise level. FIG. 9 is a diagram illustrating a configuration example of the noise level detection unit 24. The noise level detection unit 24 includes a detection unit 30 and a coding unit 31. The detection unit 30 receives an acceleration detection result signal output from the acceleration detection unit 23 and a signal to which noise such as a power supply line is added. When the acceleration detection result signal is significant, the detection unit 30 detects the noise level of the signal to which noise is added. Then, the encoding unit 31 encodes and outputs the detected noise level.

  The continuous transmission number control unit 17 a sets the continuous transmission number of data output from the first packet multiplexing unit 5 based on the code output from the noise level detection unit 24 of the quality estimation unit 21. In general, the code and the number of continuous transmissions are associated in advance so that the number of continuous transmissions increases as the amount of noise corresponding to the code output from the noise level detection unit 24 increases, and the number of continuous transmissions is determined based on the correspondence. Set.

  Similarly to the third embodiment, the error detection means 12a of the second transmission layer processing unit 7b transmits a code indicating the occurrence of a predetermined error rate. When receiving the code indicating the error rate occurrence from the error detection unit 12a of the second transmission layer processing unit 7b, the continuous transmission number control unit 17a is based on the code output from the noise level detection unit 24 described above. Data is continuously transmitted by adding the number of continuous transmissions to the determined number of continuous transmissions by the number determined based on the error rate. The operations of the present embodiment other than those described above are the same as the operations of the third embodiment.

  In the present embodiment, when acceleration is detected, the noise level detection unit 24 detects the noise level. However, the present invention is not limited to this, and the noise level detection unit 24 always detects the noise level to detect noise. When the level exceeds a predetermined value, the encoding unit 31 may encode the noise level and output it.

  In addition, in this Embodiment, it is set as the structure which added the quality estimation part 21 to the safety control system of Embodiment 3, but it is not restricted to this, The continuous frequency control part 17a is notified from the error detection part 12a. You may make it determine the frequency | count of continuous transmission based on the output from the quality estimation part 21, without considering an error rate.

  In addition, in the safety control system of the present embodiment, the first error correction coding unit 13, the second error correction coding unit 14, the first error correction decoding unit 15, the second error correction code, as in the second embodiment. An error correction decoding unit 16 may be added to prevent the controlled device 10 from being disconnected by both continuous transmission by noise detection and error correction.

  As described above, in the present embodiment, the first transmission layer processing unit 4c includes the quality estimation unit 21, and the quality estimation unit 21 detects acceleration and detects noise in the accelerated period. The number of continuous transmissions of control data transmitted from the first transmission layer processing unit 4c is determined based on the amount of noise. Therefore, as in the first embodiment, an abnormality in the transmission path 6 can be detected quickly, and the probability of normal reception is increased by performing continuous transmission even when errors increase when noise occurs. There are many cases where communication is possible. Therefore, the controlled device 10 can be controlled more stably, and service stoppage can be prevented.

  As described above, the safety control system and the safety control method according to the present invention are useful for a safety control system that performs control while preventing malfunctions and erroneous operations due to machine failures and software bugs. Suitable for safety control system used to provide.

Claims (7)

A control device, a controlled device controlled by the control device, and a transmission-side safety layer processing means that performs transmission processing for predetermined normality confirmation on control data output from the control device to obtain transmission data Transmitting side transmission processing means for multiplexing the transmission data and sending it to the transmission line as multiplexed data; receiving side transmission processing means for separating the multiplexed data received from the transmission path into transmission data and outputting it as separated data; A safety layer processing unit that performs a predetermined normality confirmation process on the separated data and transmits control data extracted from the separated data to the controlled device when it is determined to be normal. A control system,
The receiving side transmission processing means includes:
Based on a signal received via the transmission path, the quality of the transmission path is obtained, and when the quality deteriorates below a predetermined threshold, an alarm signal for notifying an abnormality is sent to the receiving-side safety layer processing means. Error detection means to transmit,
With
The receiving safety layer processing means includes:
Stop means for stopping transmission of control data to the controlled device when receiving the alarm signal,
With
The transmission side transmission processing means includes:
Quality estimation means for measuring the noise level of the signal to which the noise of its own system is added and notifying the measured noise level;
A replicating means for generating a replica of the multiple data;
Continuous transmission control means for determining the number of continuous transmissions based on the noise level, and notifying the duplication means of the number of continuous transmissions and a time interval for performing continuous transmission;
Multiplexing means for further multiplexing the duplicate output from the duplicating means and the multiplexed data and sending it to the transmission line;
With
The quality estimation means includes
Accelerometer means for measuring acceleration generated in the own system;
An acceleration detecting means for outputting an acceleration signal indicating an acceleration / deceleration period in which acceleration or deceleration occurs based on the measurement result of the accelerometer means;
Noise level detecting means for measuring the noise level during a period in which the acceleration signal is output and notifying the measured noise level;
With
The replication unit, the safety control system, wherein generating a replica of the successive sending number of times, and wherein also be output from the replica said multiplexing means on the basis of said time interval. The transmission side transmission processing means includes:
Error correction coding means for performing error correction coding processing on the control data;
With
The control data after the error correction coding process is multiplexed to form the multiplexed data,
The receiving side transmission processing means includes:
Error correction decoding means for performing error correction decoding processing on the separated data;
Further comprising
The safety control system according to claim 1, wherein the reception-side safety layer processing means performs the normality confirmation processing on the separated data after the error correction decoding processing. The error detection means includes
Notifying the transmission side transmission processing means of the quality,
The continuous transmission control means, the safety control system according to claim 1, characterized in that said continuous transmissions times Mel determined based on further the notified from the error detecting unit quality. The acceleration detecting means includes
Delay means for generating a delay signal obtained by delaying the measurement result of the accelerometer means by a predetermined delay time;
Amplifying means for generating an amplified signal obtained by amplifying the difference between the measurement result of the accelerometer means and the delayed signal;
First comparison means for outputting a first significant signal when the amplified signal is greater than a predetermined upper threshold;
Second comparison means for outputting a second significant signal when the amplified signal is smaller than a predetermined lower threshold;
The first significant signal output from the first comparison unit and the second significant signal output from the second comparison unit are logically synthesized, and the synthesized signal is output as the acceleration signal. Acceleration / deceleration period logic synthesis means;
The safety control system according to claim 1, 2, or 3 . The noise level detection means includes
Detection means for detecting the noise level of the signal to which noise is added during the period in which the acceleration signal is output;
Encoding means for encoding the noise level;
With
The safety control system according to claim 1, 2 or 3 , wherein the continuous transmission control means obtains the number of continuous transmissions based on a coded noise level. The noise level detection means includes
Detection means for detecting the noise level of the signal to which noise is added during the period in which the acceleration signal is output;
Encoding means for encoding the noise level;
With
The safety control system according to claim 4 , wherein the continuous transmission control unit obtains the number of continuous transmissions based on a coded noise level. A control device, a controlled device controlled by the control device, and a transmission-side safety layer processing means that performs transmission processing for predetermined normality confirmation on control data output from the control device to obtain transmission data Transmitting side transmission processing means for multiplexing the transmission data and sending it to the transmission line as multiplexed data; receiving side transmission processing means for separating the multiplexed data received from the transmission path into transmission data and outputting it as separated data; A safety layer processing unit that performs a predetermined normality confirmation process on the separated data and transmits control data extracted from the separated data to the controlled device when it is determined to be normal. A safety control method in a control system,
The reception-side transmission processing means obtains the quality of the transmission line based on a signal received via the transmission line, and an alarm signal for notifying abnormality when the quality deteriorates below a predetermined threshold value. An error detection step for transmitting to the receiving safety layer processing means;
A stop step of stopping transmission of control data to the controlled device when the receiving safety layer processing means receives the alarm signal;
The transmission side transmission processing means measures the noise level of the signal to which the noise of its own system is added, and notifies the measured noise level;
A replication step in which the transmission-side transmission processing means generates a copy of the multiplexed data;
The transmission side transmission processing means obtains the number of continuous transmissions based on the noise level, and outputs a continuous transmission number and a time interval for performing the continuous transmission to the duplication step;
A multiplexing step in which the transmission-side transmission processing means further multiplexes the duplicate output from the duplication step and the multiplexed data and sends the multiplexed data to the transmission path;
Including
The quality estimation step includes
An acceleration measurement step for measuring acceleration generated in the own system;
Based on the measurement result of the accelerometer step, an acceleration detection step of outputting an acceleration signal indicating that the acceleration or deceleration is in an acceleration / deceleration period; and
A noise level detecting step of measuring the noise level during a period in which the acceleration signal is output and notifying the measured noise level;
Including
In the duplication step, a duplicate for the number of times of continuous transmission is generated, and the duplication is output to the multiplexing step based on the time interval .

Images