Calculation device

Abstract

To provide an arithmetic device capable of achieving streamlining while accurately comparing a plurality of system processes.SOLUTION: An arithmetic device comprises a plurality of system circuits and a comparator. Each of the plurality of system circuits includes an input unit which receives input data, and a processing unit which performs signal processing for the input data from the input unit. The comparator compares whether processes of the processing units in respective system circuits match with each other. When a process of the processing unit in any of the system circuits is delayed, the comparator matches a process timing of the processing units of respective systems by delaying processes of the processing units of other systems.SELECTED DRAWING: Figure 4

Description

[Technical field]

[0001] The present invention relates to a computing device, and more particularly to a computing device used in a safety device, such as a railway safety device, for safely controlling on-site equipment. [Background technology]

[0002] In railway safety devices that control signal lights and points, failure of the device can lead to serious accidents. Therefore, it is essential for railway safety devices to have a fail-safe configuration that controls the entire device safely even if the device fails. Here, "fail-safe" means that the failure of a part or other component will not result in dangerous control that could lead to a serious accident. In order to prevent dangerous control, a circuit that reliably detects failures is added to ensure safe control.

[0003] A commonly used configuration for fail-safe is a multiplexed system in which the same processing is performed by multiple processors and the results of each processor are compared and collated. In this way, if an abnormality occurs in a circuit or component in one system, the failure can be detected by the difference with the other systems.

[0004] For example, Patent Document 1 describes an operation comparison device that performs the same process using a plurality of processors, compares and collates the process results of all the processors, and diagnoses the process as valid if the comparison and collation results are the same. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2004-234144 A Summary of the Invention [Problem to be solved by the invention]

[0006] Most typical microcontroller circuits have various interfaces, such as memory used as a work area for storing programs and performing calculations, and IO for data input and output, for example for communicating with the outside world.

[0007] However, when diagnosing these as in Patent Document 1, if there is inherent variation in the characteristics of electronic components, there is a possibility that the timing of processing may be off even during normal processing. In this case, it will be judged as an abnormality, and the system will stop, etc., resulting in poor processing efficiency.

[0008] In view of the above-mentioned problems, an object of the present invention is to provide a calculation device capable of improving efficiency while accurately comparing the processes of a plurality of systems. [Means for solving the problem]

[0009] In order to achieve the above object, a representative arithmetic device of the present invention comprises a plurality of circuits and a comparator, each of the plurality of circuits having an input unit that receives input data, a processing unit that performs signal processing on the input data from the input unit, and a memory, and the comparator compares whether the processing of the processing units in the circuits of the respective systems is consistent with each other, If the processing of the processing unit in any of the circuits in the system is delayed, the processing of the processing units in the other systems is delayed to align the processing timing of the processing units in each system. The comparator inputs a memory status signal including information on a busy state indicating an inaccessible state from the memory in each system circuit and a ready state indicating an accessible state, and when the busy state and ready state of the memory status signal differ for each circuit, the comparator sends a wait signal to stop the processing unit of the ready state, and when the states of the memory status signals all become ready, the comparator stops sending the wait signal. Effect of the Invention

[0010] According to the present invention, in a computing device, it is possible to accurately compare the processes of a plurality of systems while improving efficiency. Problems, configurations and effects other than those described above will become apparent from the following embodiments. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 is a block diagram showing an example of a hardware configuration according to a first embodiment of the present invention. [Diagram 2] FIG. 2 is a diagram for explaining an example of operation of the first embodiment of the present invention. [Diagram 3] FIG. 3 is a block diagram illustrating an example of a hardware configuration according to the second embodiment of the present invention. [Figure 4] FIG. 4 is a diagram for explaining an example of operation of the second embodiment of the present invention. [Diagram 5] FIG. 5 is a block diagram illustrating an example of a hardware configuration according to the third embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] BEST MODE FOR CARRYING OUT THE PRESENT DISCLOSURE The present invention can be used in a safety device or the like that safely controls on-site equipment, such as a railway safety device that controls signal lights, points, and the like.

[0013] Example 1 FIG. 1 is a block diagram showing an example of a hardware configuration according to a first embodiment of the present invention.

[0014] In Fig. 1, the same circuits and parts are configured as multiple systems, and when an abnormality occurs in a circuit or part in one system, the failure is detected by the difference with the other system. Fig. 1 shows a redundant configuration with two microcomputers 1 and 2. This is called a fail-safe CPU. The two microcomputers 1 and 2 operate at the same frequency, with the same program, and in the same steps, and a comparator 17 constantly monitors the operation of these two microcomputers. This allows the comparator 17 to detect whether an abnormality has occurred in one of the microcomputers. Fig. 1 is a block diagram showing the basic configuration of the fail-safe CPU of the first embodiment. It is composed of an A-system circuit 9, a B-system circuit 10, and a comparator 17.

[0015] The A-system circuit 9 includes the A-system microcomputer 1, the A-system IO5 which inputs and outputs the A-system data 15, and the A-system memory 3. The A-system microcomputer 1 is connected by an A-system microcomputer bus signal line 7, and the A-system memory 3 and the A-system IO5 are also connected to the A-system microcomputer bus signal line 7. The A-system memory 3 is configured to be able to output an A-system memory status signal 13 which reports its own status to the A-system microcomputer 1.

[0016] The A-system microcomputer 1 is a processing unit that performs signal processing on input data from the A-system IO 5. The A-system memory 3 temporarily stores information required for processing by the A-system microcomputer 1. These are composed of electronic components to achieve these functions.

[0017] The B system circuit 10 includes a B system microcomputer 2, a B system IO 6 which inputs and outputs B system data 16, and a B system memory 4. The B system microcomputer 2 is connected by a B system microcomputer bus signal line 8, and the B system memory 4 and the B system IO 6 are also connected to the B system microcomputer bus signal line 8. The B system memory 4 is configured to be able to output a B system memory status signal 14 which reports its own status to the B system microcomputer 2.

[0018] The B-system microcomputer 2 is a processing unit that performs signal processing on input data from the B-system IO 6. The B-system memory 4 temporarily stores information required for processing by the B-system microcomputer 2. These are composed of electronic components to achieve these functions.

[0019] The comparator 17 is connected to the A-system microcomputer bus signal line 7 and the B-system microcomputer bus signal line 8, respectively, and can obtain information. The comparator 17 compares information from these signal lines. This comparison is performed on the premise that the A-system circuit 9 and the B-system circuit 10 operate with the same frequency, the same program, and the same steps. The comparator 17 compares the states of the microcomputer bus signals from the respective microcomputer bus signal lines 7 and 8. Specifically, the microcomputer bus signals include address signals, data signals, and control signals. The comparator 17 compares the voltage levels of these signals in a certain time unit, and if it detects a difference in the state of even one line, it determines that one of them has failed and reports an abnormal operation as a comparison mismatch. With this configuration, the comparator 17 can accurately compare the A-system circuit 9 and the B-system circuit 10.

[0020] The A-system memory 3 outputs an A-system memory status signal 13 indicating the state of the A-system memory 3 itself when the A-system microcomputer 1 writes to or reads from the A-system memory 3. This indicates whether the A-system memory 3 is in a busy or ready state due to internal processing when the A-system microcomputer 1 writes to or reads from the A-system memory 3. When this A-system memory status signal 13 is in a busy state, it indicates that access is not possible, and when it is in a ready state, it indicates that access is possible. In other words, in order to make it accessible, you must wait until it becomes ready.

[0021] Similarly, the B system memory 4 outputs a status signal 14 indicating the state of the B system memory 4 itself when the B system microcomputer 2 writes to or reads from the B system memory 4. This indicates whether the B system memory 4 is in a busy state or a ready state due to internal processing when the B system microcomputer 2 writes to or reads from the B system memory 4. When this B system memory status signal 14 is in a busy state, it indicates that access is not possible, and when it is in a ready state, it indicates that access is possible. In other words, in order to make it accessible, you must wait until it becomes ready.

[0022] 2 is a diagram for explaining an example of the operation of the first embodiment of the present invention. Here, the process for each step of the microcomputers 1 and 2 will be explained.

[0023] In process A1 of the A system microcomputer 1, when writing or reading from the A system memory 3, a process A1 response is made if the A system memory 3 is in a ready state. As a result, the A system microcomputer 1 performs process A1 based on information from the A system memory 3. At the same time, in process B1 of the B system microcomputer 2, when writing or reading is made, a process B1 response is made if the B system memory 4 is in a ready state. As a result, the B system microcomputer 2 performs process B1 based on information from the B system memory 4.

[0024] In the comparator 17, if the timing of the process A1 of the A-system microcomputer 1 and the process B1 of the B-system microcomputer 2 are the same, they are deemed to match and the processes are determined to be valid. The same is true for the process A2 of the A-system microcomputer 1 and the process B2 of the B-system microcomputer 2.

[0025] On the other hand, in process B3 of the B system microcomputer 2, when writing or reading from the B system memory 4, the B system memory 4 is in a busy state. In this case, the B system memory status signal 14 indicates a busy state, and the B system microcomputer 2 waits for processing. Then, when the busy state ends and the B system microcomputer 2 enters a ready state, it responds with process B3. This slows down the processing by the time it waits in the busy state. On the other hand, when the A system memory 3 is not in a busy state, the A system microcomputer 1 finishes process A3 and moves on to process A4. Then, at the timing of process A4 of the A system microcomputer 1, process B3 of the B system microcomputer 2 is continuing, and the comparator 17 detects a mismatch.

[0026] When the comparator 17 detects a mismatch, it performs processing to stop both the A-system microcomputer 1 and the B-system microcomputer 2. For this reason, it is necessary to restart the system from then on before it can be used again.

[0027] In the first embodiment, accurate comparison can be performed by detecting a match or mismatch between the A-system microcomputer 1 and the B-system microcomputer 2 of two systems using the comparator 17. However, it is assumed that the mismatch in the process B3 of the B-system microcomputer 2 described above is not caused by a malfunction.

[0028] For example, the memory and IO used in a microcontroller circuit are electronic components made by the same manufacturer and are the same model, and even if they are not defective, there will be a certain degree of variation in their characteristics. The degree of variation is also affected by the manufacturing process and aging of each individual component. In such cases, it is not guaranteed that the microcontroller circuit will necessarily operate in the same way. This is especially true for signals input to the microcontroller. Specifically, input data and interrupt signals are the most typical examples, but other external status signals are also possible.

[0029] In such cases, the same signals for each system are input at different times due to component variations. In some cases, differences that cross clocks may occur even when there is no malfunction. When this happens, an anomaly is detected as a comparison mismatch even when there is no malfunction. Also, the length of time for individual component variations changes due to the manufacturing process and aging. Examples of solving such problems are shown in Examples 2 and 3.

[0030] Example 2 3 is a block diagram showing an example of a hardware configuration of a second embodiment of the present invention. In the second embodiment, differences from the first embodiment will be mainly described, the same parts are given the same reference numerals, and the same description of parts that are not particularly described will be omitted.

[0031] In the second embodiment, compared to the configuration of the first embodiment, status signals 13 and 14 of memories 3 and 4 are transmitted via a comparator 17, and wait signals 18 and 19 are transmitted to the microcomputers 1 and 2.

[0032] The A-system circuit 9' includes the A-system microcomputer 1, the A-system IO5 which inputs and outputs data, and the A-system memory 3. The A-system microcomputer 1 is connected by an A-system microcomputer bus signal line 7, and the A-system memory 3 and the A-system IO5 are also connected to the A-system microcomputer bus signal line 7. The A-system memory 3 is configured to be able to output an A-system memory status signal 13 which reports its own status to the A-system microcomputer 1 via a comparator 17.

[0033] The second embodiment is also a fail-safe CPU, and in addition to the A-system circuit 9', there is another B-system circuit 10' of the same configuration. The B-system circuit 10' includes a B-system microcomputer 2, a B-system memory 4, and a B-system IO6 that inputs and outputs data. The B-system microcomputer 2 is connected by a B-system microcomputer bus signal line 8, and the B-system memory 4 and the B-system IO6 are also connected to the B-system microcomputer bus signal line 8. The B-system memory 4 is configured to be able to output a B-system memory status signal 14 that reports its own status to the B-system microcomputer 2 via a comparator 17.

[0034] The comparator 17 is connected to the A-system microcomputer bus signal line 7 and the B-system microcomputer bus signal line 8, respectively, and can acquire information. The comparator 17 compares information from these signal lines. This embodiment differs from the first embodiment in FIG. 1 in that the A-system memory status signal 13 and the B-system memory status signal 14 are not directly transmitted to the A-system microcomputer 1 and the B-system microcomputer 2. In the configuration of the second embodiment, the A-system memory status signal 13 and the B-system memory status signal 14 are both input once to the comparator 17. The A-system wait signal 18 is output to the A-system microcomputer 1. The B-system wait signal 19 is output to the B-system microcomputer 2.

[0035] The reason for passing through comparator 17 here is to check the status of memories 3 and 4 for each access and to check whether both systems are ready or busy. Consider the case where, when each system accesses memory, A system memory 3 is ready and B system memory 4 is busy. In this case, while access to A system memory 3 has ended, access to B system memory 4 is put on hold. This process causes the B system microcomputer 2 to stagnate.

[0036] For this reason, in the case of the above-mentioned embodiment 1, a comparison mismatch occurs due to this difference, and it is determined to be an abnormality. In embodiment 2, in order to avoid this, a method is adopted in which access to the A system memory 3 is intentionally delayed to coincide with access to the B system memory 4 that is waiting for processing of the busy system. In other words, the A system is made to wait to coincide with the B system that is in a busy state. Then, when the busy state of the B system memory ends and it becomes a ready state, access to the A system memory 3 is resumed accordingly. By doing so, it is possible to avoid unnecessary comparison mismatch by aligning the processing with the access of the delayed system.

[0037] Next, the synchronization method will be described. As an example, the operation when the microcomputers 1 and 2 access the memories 3 and 4 will be described.

[0038] When the A-system microcomputer 1 in the A-system circuit 9' accesses the A-system memory 3, the B-system microcomputer 2 in the B-system circuit 10' also accesses the B-system memory 4. For example, if the access to the A-system memory 3 is completed but the access to the B-system memory 4 is completed one cycle late due to component variations, the comparator 17 will compare and mismatch at this one cycle delayed timing.

[0039] In the second embodiment, even if the access to the B system memory 4 is completed one cycle late due to component variations, the access to the A system memory 3 is intentionally delayed by one cycle to achieve synchronization. Specifically, when the A system microcomputer 1 and the B system microcomputer 2 access the A system memory 3 and the B system memory 4, the comparator 17 monitors the A system memory status signal 13 and the B system memory status signal 14 output by the A system memory 3 and the B system memory 4, respectively. If there is a difference between these signals, the comparator 17 judges that a discrepancy has occurred when the A system microcomputer 1 and the B system microcomputer 2 accessed the A system memory 3 and the B system memory 4, respectively. When this discrepancy occurs, the comparator 17 judges which of the A system circuit 9' and the B system circuit 10' is delayed, and issues a wait signal to the system that is not delayed. As a result, the microcomputer of the system to which the wait is issued stops the operation of the microcomputer during the wait period and waits for the operation of the delayed system until synchronization is achieved.

[0040] 4 is a diagram for explaining an example of the operation of the second embodiment of the present invention. Here, the process for each step of the microcomputers 1 and 2 will be explained.

[0041] Here, the processes A1 and B1, and the processes A2 and B2 are the same as those in the first embodiment, and the comparator 17 determines that they match.

[0042] In the process B3 of the B system microcomputer 2, when writing or reading, the B system memory 4 is in a busy state. In this case, the B system memory status signal 14 indicates a busy state, and the B system microcomputer 2 waits for processing. Then, when the busy state ends and the B system microcomputer 2 becomes a ready state, it responds to the process B3.

[0043] On the other hand, in process A3 of the A system microcomputer 1, the A system memory 3 is not busy but is in a ready state, so the A system memory 3 can be accessed and the process can proceed. However, as shown in the first embodiment, the timing of process A3 of the A system microcomputer 1 and process B3 of the B system microcomputer 2 may differ, and the comparator 17 may detect a mismatch. To prevent this, the A system microcomputer 1 is put into a wait state to delay the response to process A3.

[0044] Specifically, when the comparator 17 receives information that the A-system memory status signal 13 is in a ready state and the B-system memory status signal 14 is in a busy state, the comparator 17 sends an A-system wait signal 18 to the A-system microcomputer 1. The A-system microcomputer 1 accordingly suspends its processing and delays the response of processing A3. Furthermore, when the B-system memory status signal 14 goes into a ready state, the comparator 17 stops sending the A-system wait signal 18 to the A-system microcomputer 1 (or sends a signal to cancel the wait). This allows the A-system microcomputer 1 to resume processing A3, and the end timing can be synchronized with that of processing B3 of the B-system microcomputer 2.

[0045] With the above configuration, the timing of process A3 of the A-system microcomputer 1 and process B3 of the B-system microcomputer 2 become the same, and the comparator 17 determines that they match, and the processes continue. Therefore, the comparator 17 also determines that there is a match in the next processes A4 and B4.

[0046] In this way, in the configuration of the second embodiment, the response from the memory that is not busy (ready state) is delayed to match the busy memory, thereby synchronizing the processing timing of each system. This prevents abnormalities caused by component variations and prevents unnecessary system shutdowns. On the other hand, abnormalities caused by factors other than the busy state are detected. This allows for more accurate failure detection while improving operating efficiency.

[0047] Example 3 5 is a block diagram showing an example of a hardware configuration of the third embodiment of the present invention. In the third embodiment, differences from the second embodiment will be mainly described, the same parts are given the same reference numerals, and the same description of parts that are not particularly described will be omitted.

[0048] The A-system circuit 9'' includes the A-system microcomputer 1, the A-system IO5 for inputting and outputting data, the A-system memory 3, and the A-system register 11. The A-system microcomputer 1 is connected by an A-system microcomputer bus signal line 7, and the A-system memory 3, the A-system IO5, and the A-system register 11 are also connected to the A-system microcomputer bus signal line 7. Each of the A-system memory 3, the A-system IO5, and the A-system register 11 is configured to be able to output to the comparator 17 an A-system memory status signal 13, an A-system IO status signal 21, and an A-system register status signal 23 indicating its own state (for example, "ready state" or "busy state"). The A-system register 11 is an electronic component that temporarily stores data used by the A-system microcomputer 1.

[0049] The third embodiment is also a fail-safe CPU, and in addition to the A-system circuit 9'', there is another B-system circuit 10'' of the same configuration. The B-system circuit 10'' includes a B-system microcomputer 2, a B-system memory 4, a B-system IO 6 for inputting and outputting data, and a B-system register 12. The B-system microcomputer 2 is connected by a B-system microcomputer bus signal line 8, and the B-system memory 4, the B-system IO 6, and the B-system register 12 are also connected to the B-system microcomputer bus signal line 8. The B-system memory 4, the B-system IO 6, and the B-system register 12 are each configured to be able to output to the comparator 17 a B-system memory status signal 14, a B-system IO status signal 22, and a B-system register status signal 24 indicating their own status (for example, "ready state" or "busy state"). The B-system register 12 is an electronic component that temporarily stores data used by the B-system microcomputer 2.

[0050] In the configuration of the third embodiment, the A-system memory status signal 13, the A-system IO status signal 21, the A-system register status signal 23, the B-system memory status signal 14, the B-system IO status signal 22, and the B-system register status signal 24 are input once to a comparator 17. The comparator 17 is configured to be able to output an A-system wait signal 18 to the A-system microcomputer 1 and a B-system wait signal 19 to the B-system microcomputer 2.

[0051] Comparator 17 is connected to each of A-system microcomputer bus signal line 7 and B-system microcomputer bus signal line 8, and is capable of acquiring information. Comparator 17 compares information from these signal lines. Comparator 17 compares the states of each microcomputer bus, on the premise that A-system circuit 9'' and B-system circuit 10'' operate at the same frequency, with the same program, and in the same steps. Specifically, the microcomputer bus has address signals, data signals, and control signals, and the voltage levels of these signals are compared in certain time units. If it detects a different state in even one line, it determines that one side has failed, and reports an abnormal operation as a comparison mismatch.

[0052] In addition to this operation, the comparator 17 monitors the A-system memory status signal 13, the A-system IO status signal 21, and the A-system register status signal 23, and outputs an A-system wait signal 18 for issuing a wait to the A-system microcomputer 1 to the A-system microcomputer 1. Similarly, the comparator 17 monitors the B-system memory status signal 14, the B-system IO status signal 22, and the B-system register status signal 24, and outputs a B-system wait signal 19 for issuing a wait to the B-system microcomputer 2.

[0053] The synchronization method is the same as in the second embodiment. The A-system IO5, A-system register 11, B-system IO6, and B-system register 12 can also perform synchronization in the same manner as the A-system memory 3 and B-system memory 4 described in the second embodiment. In this case, the status signals used are the A-system IO status signal 21, the B-system IO status signal 22, the A-system register status signal 23, and the B-system register status signal, instead of the A-system memory status signal 13 and the B-system memory status signal 14. These signals include information on "ready state" or "busy state." The A-system wait signal 18 and the B-system wait signal 19 can also be transmitted in the same manner as in the second embodiment and the A-system memory 3 and B-system memory 4.

[0054] In this way, in the configuration of the third embodiment, a configuration can be constructed that takes into account not only the memory, but also the signals from the IO and registers. This allows for more accurate comparisons, prevents abnormalities due to component variations, and prevents unnecessary system shutdowns. This allows for more accurate failure detection while improving operating efficiency.

[0055] The present invention is not limited to the above-described embodiments, and includes various modified examples. For example, the above-described embodiments have been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to those including all of the configurations described. It is also possible to replace a part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. It is also possible to add, delete, or replace a part of the configuration of each embodiment with another configuration.

[0056] For example, in the above embodiment, a configuration with two systems, system A and system B, is shown, but the present invention can be applied to multiple systems, and may be three or more systems, such as a triple or quadruple system. In this case, the signals are compared by a comparator, and an abnormality is detected if the comparison results in a mismatch. Furthermore, if the processing timing is different, a wait signal is sent to the microcomputer that is not delayed by the method shown in the above embodiment, and the microcomputer is made to wait, thereby preventing unnecessary system stoppage due to component variations. [Explanation of symbols]

[0057] 1...A system microcontroller, 2...B system microcontroller, 3...A system memory, 4...B system memory, 5...A system IO, 6...B system IO, 7...A system microcontroller bus signal line, 8...B system microcontroller bus signal line, 9, 9', 9''...A system circuit, 10, 10', 10''...B system circuit, 11...A system register, 12...B system register, 13...A system memory status signal, 14...B system memory status signal, 15...A system data, 16...B system data, 17...comparator, 18...A system wait signal, 19...B system wait signal, 21...A system IO status signal, 22...B system IO status signal, 23...A system register status signal, 24...B system register status signal

Claims

1. A plurality of circuits and a comparator are provided, Each of the circuits of the plurality of systems includes an input unit that receives input data, a processing unit that performs signal processing on the input data from the input unit, and a memory; the comparator compares whether the processes of the processing units in the circuits of the respective systems match each other, and if the process of the processing unit in the circuit of any system is delayed, the process of the processing unit in the other system is delayed to match the timing of the process of the processing unit in each system; The comparator receives a memory status signal including information on a busy state indicating that the memory in each system circuit is inaccessible and a ready state indicating that the memory is accessible, and when the busy and ready states of the memory status signals differ for each circuit, the comparator sends a wait signal to stop the processing unit of the ready state, and when both memory status signals are in the ready state, the comparator stops sending the wait signal.

2. 2. The computing device according to claim 1, The arithmetic device, wherein the comparator determines whether or not the processing of the processing unit is delayed based on an input unit status signal from the input unit.

3. 3. The arithmetic device according to claim 1, Each of the circuits of the plurality of systems has a register, The arithmetic device according to claim 1, wherein the comparator determines whether or not the processing of the processing unit is delayed based on a register status signal from the register.

4. The arithmetic device according to any one of claims 1 to 3, An arithmetic device, wherein the plurality of systems are composed of two systems, and the comparator compares processing units of the two systems.

Images