Digital output device and method for generating digital output

Abstract

Provided is a digital output apparatus for generating alternating signals that differs from a software process, while maintaining the configuration and safety of the conventional art, in order to reduce the CPU processing load for generating alternating signals by a fail-safe CPU. This digital output apparatus is provided with two computation devices, a collation unit that collates the computation results from the two computation devices, and two output conversion units that each receives an output instruction based on the respective computation results from the two computation devices. The collation unit outputs a first alternating signal when the computation results match, and the two output conversion units output a second alternating signal when the output instruction is an alternating signal output instruction and output a non-alternating signal when the output instruction is an alternating signal stopping instruction.

Description

Technical Field

[0001] The present invention relates to a digital output device and a method for generating digital output related to fail-safe technology, and is particularly suitable for railway safety devices for controlling railway vehicles to the safe side and the like.

Background Art

[0002] Railway safety devices are always required to have high safety, and fail-safe performance for controlling railway vehicles to the safe side is required even when abnormalities or failures occur in the safety devices themselves or peripheral devices.

[0003] In existing systems, a configuration has been adopted in which a plurality of identical arithmetic units (CPUs) are provided, and the operations of these arithmetic units are compared and collated by a collation unit to ensure safety. The arithmetic results of these arithmetic units are compared and collated by the collation unit every arithmetic cycle. When a discrepancy occurs in the arithmetic results, the arithmetic unit stops operating and the system is transitioned to the safe side. A CPU having such a function is called a fail-safe CPU and has been used in existing systems.

[0004] Also, as an output from the arithmetic unit, in order to provide fail-safe performance, an alternating signal, which is a signal that periodically changes, is used. Each arithmetic unit provided in the fail-safe CPU has an output unit that outputs an alternating signal. Conventionally, a digital signal that periodically changes between two electrical states, H (high) or L (low), has been used as this alternating signal.

[0005] Similarly, when the collation result of the arithmetic unit is normal and correct, the collation unit outputs an alternating signal as the collation result, and when the collation result is abnormal and inconsistent, the alternating signal stops and a fixed signal is output.

[0006] The above pluralThe alternating signal output from the arithmetic unit and the alternating signal based on the verification result output from the verification unit are further input to the fail-safe AND. The fail-safe AND takes the logical product of the input alternating signals and outputs an alternating signal only when all inputs are in an alternating state. The alternating signal output from the fail-safe AND is rectified and amplified by an AC amplifier to drive a relay.

[0007] With the above configuration, the relay is driven and a signal is output to the outside only when the outputs from the arithmetic unit and the verification unit are all in an alternating state. If the periodic change of the alternating signal stops due to an abnormality in the arithmetic unit, a mismatch in the verification result, or an abnormality in the circuit itself, the relay at the final stage is released and the external output of the system becomes safe. This forms a fail-safe configuration.

[0008] Figure 4 is a block diagram showing the schematic configuration of an existing system. The on-vehicle security device 1 includes a fail-safe CPU 2 having arithmetic units A and B (3 and 4) and a verification unit 5 inside, output units A and B (13 and 14), a fail-safe AND 10, an AC amplifier 11, and a relay 12. In this configuration, arithmetic units A and B generate alternating signals respectively, and each of output units A and B outputs an alternating signal to the fail-safe AND based on the alternating signals from arithmetic units A and B respectively.

[0009] Note that in the configuration of Figure 4, based on the 0 / 1 write instructions from arithmetic units A and B, output units A and B convert the alternating signal to a voltage and output it to the fail-safe AND 10, but in some cases, the arithmetic unit itself may output an alternating signal as an electrical signal.

[0010] Figure 5 is a timing chart showing the signal output states of the components constituting the existing system shown in Figure 4. In the configuration shown in Fig. 4, the arithmetic units A and B generate the alternating signals output to the fail-safe AND 10. As an example of a specific method, the arithmetic units A and B have internal timers (not shown), and according to these, generate triggers for generating external outputs at a constant period (501). When a trigger occurs, the arithmetic units A and B execute the process of generating an external output according to the interrupt process (505). At this time, the arithmetic units A and B generate an alternating signal at the frequency required for charging the AC amplifier 11, for example, by switching the 0 / 1 instruction to a register (not shown) implemented in the external output section (502). This process operates by timer interrupt, and when outputting an alternating signal, it switches 0 / 1, and when stopping the alternating signal, it instructs one of the values to the output section. The output sections A and B convert the 0 / 1 signal input from the arithmetic units A and B into an electrical signal and output it to the fail-safe AND 10 (503). On the other hand, when stopping the output of the alternating signal, the interrupt process always occurs and continuously writes 0 or 1 (504).

[0011] As described above, in the existing system, an alternating signal input is required to charge the AC amplifier 11, and further, the change period of the alternating signal needs to be a specified frequency according to the characteristics of the AC amplifier 11. The fail-safe AND 10 only outputs according to the state of the alternating signal and does not have the function of changing the frequency. Also, since the output from the collation unit 5 depends on the operating frequency of the arithmetic units A and B, it was necessary to generate the specified frequency for charging the AC amplifier 11 based on the output from the arithmetic units A and B.

[0012] Also, in the existing system, since the alternating signals from the arithmetic units A and B respectively are alternating signals according to a constant frequency generated by software operation, the alternating signal is generated by alternately operating 0 and 1 on the output signal by software through interrupt processing at regular intervals. Each of A and B converts this 0 and 1 signal into the voltage required for the fail-safe AND 10, thereby converting it into an electrical signal. force section A and B respectively convert this 0 and 1 signal into the voltage required for the fail-safe AND 10, thereby converting it into an electrical signal.

[0013] Therefore, in the existing system, in order to perform an interrupt by a timer inside the arithmetic unit and generate an alternating signal with a constant frequency necessary to charge the AC amplifier, the count process by the timer and the output generation process when an interrupt is received are added as processing loads to arithmetic units A and B, respectively.

[0014] In the method adopted in the existing system as described above, the process of generating an interrupt signal at a constant period and the 0 / 1 process in response to the interrupt exist as loads on the arithmetic unit. Here, in general microcontrollers, some have channels for generating pulse outputs, but such channels have the constraints that a counter is required and the number of ports capable of generating pulse outputs per microcontroller is small.

[0015] Also, Patent Document 1 realizes a method of reducing the processing load of CPU operations by performing frequency output at a location separate from the arithmetic unit, but since it aims to improve the productivity of applications by separating the OS, middleware, and applications, it has not achieved a reduction in processing load.

Prior Art Documents

Patent Documents

[0016]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0017] In the existing system described above, the arithmetic scale of the system was small, there was a margin in the arithmetic processing of the CPU, and this processing load did not pose a problem. However, in recent years, the amount of information in the communication between on-vehicle security devices and ground devices or other devices has increased, and the functions required of security devices have become more complex and sophisticated. As a result, the processing load on the CPU has a tendency to increase. Consequently, there is a problem that the generation of alternating signals by software processing compresses other CPU processing.

[0018] Therefore, an object of the present invention is to provide a digital output device that generates an alternating signal different from software processing while maintaining the conventional configuration and ensuring safety in order to reduce the CPU processing load for generating an alternating signal.

Means for Solving the Problem

[0019] In order to solve the above problems, one of the typical digital output devices according to the present invention includes two arithmetic units, a collation unit that collates the arithmetic results of each of the two arithmetic units, and two output conversion units that receive output instructions based on the arithmetic results of each of the two arithmetic units. and if the calculation results of the two calculators match, output a first alternating signal A collation unit for collation, and two output conversion units that respectively receive output instructions based on the arithmetic results of each of the two arithmetic units receive, if the output instruction is an alternating output instruction, output a second alternating signal, and if the output instruction is an alternating stop instruction, output a non-alternating signal and , two check sections that count the second alternating signals output by each of the two output conversion sections is provided. Each of the two calculators obtains the count values from the corresponding two check sections, and from the count values, determines whether each of the two output conversion sections is outputting the second alternating signal in the state of the alternating output instruction, and whether each of the two output conversion sections is outputting the non-alternating signal in the state of the alternating stop instruction It is.

Effects of the Invention

[0020] According to the present invention, by providing an output conversion unit that performs alternating output at a constant frequency based on an output instruction from an arithmetic unit, it is possible to reduce the processing load on the CPU without changing the existing system configuration. In addition, by providing a check unit that monitors the frequency output from the output conversion unit, the CPU can detect a failure of the output conversion unit and prevent the system from operating on the non-safe side, ensuring the same level of safety as before. Problems, configurations, and effects other than those described above will be clarified by the description in the form for carrying out the following invention.

Brief Description of the Drawings

[0021]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Embodiments for Carrying Out the Invention

[0022] Hereinafter, as embodiments for carrying out the present invention, examples will be described in detail with reference to the drawings. Here, in the description of the drawings, the same parts are denoted by the same reference numerals.

Examples

[0023] FIG. 1 is a block diagram showing the schematic configuration of an on-vehicle safety device according to an embodiment of the present invention. The on-vehicle safety device 1 has a fail-safe CPU 2, and this fail-safe CPU 2 has two arithmetic units 3 and 4 and a collation unit 5 that collates the arithmetic results of the respective arithmetic units. Here, the two arithmetic units 3 and 4 are respectively referred to as arithmetic unit A and arithmetic unit B, and the output channels (not shown in FIG. 1) corresponding to the respective arithmetic units A and B are respectively referred to as channel A and channel B.

[0024] In addition, the on-vehicle security device 1 is configured to perform an output related to safety, and includes output conversion units 6 and 7 that receive signals from the arithmetic units 3 and 4 respectively and output an alternating signal or a non-alternating signal of a certain frequency, and check units 8 and 9 that receive the alternating signals output from the output conversion units 6 and 7. Here, the two output conversion units 6 and 7 are respectively referred to as output conversion unit A and output conversion unit B, and the check units 8 and 9 corresponding to the respective output conversion units A and B are respectively referred to as check unit A and check unit B.

[0025] That is, the present invention is characterized by a fail-safe CPU 2 having an arithmetic unit A (3) and an arithmetic unit B (4) and a collation unit 5, an output conversion unit A (6) and an output conversion unit B (7), and a check unit A (8) and a check unit B (9).

[0026] Furthermore, the on-vehicle security device 1 has a fail-safe AND 10 that outputs an alternating signal only when all the signals input by logically synthesizing the signals from the output conversion units A and B of the digital output device and the signals from the collation unit are in an alternating state, an AC amplifier 11 that rectifies and amplifies the output from the fail-safe AND 10 to drive a relay 12, and a relay 12 that outputs a control signal to the outside.

[0027] FIG. 2 is a diagram showing the output states of signals in each component constituting the on-vehicle security device in a timing chart. Based on their respective calculation results (251 or 252), the arithmetic unit A and the arithmetic unit B output an alternating output instruction (201) or an alternating stop instruction (202) to the output conversion units A and B.

[0028] Based on the instruction values from the arithmetic units A and B, when the output conversion units A and B receive an alternating output instruction (201), they output an alternating signal having a frequency necessary for storing charge in the coil of the relay 12 by the AC amplifier 11 (203). On the other hand, when the output conversion units A and B receive an alternating stop instruction 202 from the arithmetic units A and B, they output a non-alternating signal instead of an alternating signal (204).

[0029] Unless the stop state of the alternating signal undergoes periodic signal changes, the state of the signal level (electrically H or L) in the stop state does not affect the system.

[0030] Further, the verification unit 5 verifies the calculation results of the calculators A and B, and outputs an alternating signal (205) when the operations of these two calculators A and B are the same. This alternating signal 205 is the verification result by the verification unit 5 and does not affect the calculations themselves in the calculators A and B.

[0031] The alternating signal outputs from the output conversion units A and B and the alternating signal output from the verification unit 5 are input to the fail-safe AND 10. This fail-safe AND 10 is a circuit specifically constituted by a flip-flop or the like. By the signals input to the fail-safe AND 10 serving as the clock sources of each other's signals, the output of the fail-safe AND 10 becomes an alternating signal only when all the signals are in the alternating state (206).

[0032] This alternating signal is rectified and amplified by the AC amplifier 11, and the coil of the relay 12 is pressurized only when the fail-safe AND 10 outputs an alternating signal at a certain frequency (208). As a result, externally, the output state (the state where the coil of the relay 12 is pressurized and the contact is closed) is achieved only when the outputs from the output conversion units A and B and the output from the verification unit 5 are all in the alternating state (210).

[0033] When the calculators A and B output an alternating stop instruction, the alternating input to the fail-safe AND 10 stops, and thereby the alternating signal from the fail-safe AND 10 stops (207). As a result, the charge supply from the AC amplifier 11 stops, so that the charge of the coil of the relay 12 is released (209), and the contact of the relay 12 that outputs a control signal to the outside is in the open state (211).

[0034] Here, for the alternating signal input to the AC amplifier 11, it is necessary to use the hardware-specified frequency required for storing charge. The charge in the coil of the relay 12 is stored only when the alternating signal from the fail-safe AND 10 is at a constant frequency. This constant frequency is generated inside the output conversion unit A or B.

[0035] FIG. 3 is a timing chart showing the behavior when an abnormality occurs as the output state of signals in each component constituting the on-vehicle security device as in FIG. 2. When the collation unit 5 detects a discrepancy in the calculation results of the arithmetic units A and B, or when at least one of the two arithmetic units A and B detects an abnormality and stops operating (301), etc., when the fail-safe CPU 2 detects an abnormality, the alternating signal from the collation unit 5 stops (302).

[0036] As a result, even if the signals from the output conversion units A and B are in an alternating state, the alternating signal from the collation unit 5 stops, and by logical synthesis in the fail-safe AND 10, the alternating signal output from the fail-safe AND 10 stops (207).

[0037] In this way, when at least one of the two arithmetic units A and B detects a failure, or when the calculation results of the two arithmetic units A and B become inconsistent due to an abnormality in the hardware or arithmetic unit, and the collation unit 5 detects this and stops the alternating signal, or when there is an abnormality in the path and the alternating signal from at least one of the output conversion units A and B stops, the alternating signal from the fail-safe AND 10 stops (207), the supply of charge from the AC amplifier 11 is interrupted (209), and the contacts of the relay 12 are released (211). As described above, the configuration of the on-vehicle security device according to the embodiment of the present invention has fail-safe properties when an abnormality occurs.

[0038] Further, compared with the configuration of the existing system shown in FIG. 4, in the configuration according to the embodiment of the present invention shown in FIG. 1, each of the arithmetic units A and B only needs to instruct each of the output conversion units A and B to output either an alternating output or an alternating stop state. Therefore, by implementing the frequency generation by the count process using the timer and the generation process of the output in the output conversion unit, the processing load on the arithmetic unit is reduced.

[0039] Next, a failure may occur in the output conversion unit A or B. Due to this failure, a case may occur where an unintended alternating signal continues to be output, and the fail-safe AND 10 also continues to output an alternating signal in response to this unintended alternating signal.

[0040] In a normal case, by the alternating stop instruction from the arithmetic unit A or B, the alternating signal from the output conversion unit A or B stops, and the alternating signal from the fail-safe AND 10 stops, so that the external output becomes safe.

[0041] However, if the output conversion units A and B continue to output an alternating signal despite receiving a stop instruction from the arithmetic unit A or B, the system cannot be controlled to the safe side. Therefore, in the configuration shown in FIG. 1, check units A and B are provided to monitor the output states of the output conversion units A and B by receiving the alternating signals of the output conversion units A and B so that each of the arithmetic units A and B can monitor the states of the output conversion units A and B.

[0042] FIG. 6 is a timing chart showing the operation states of the check units A and B in addition to the output states of the signals in each component constituting the on-vehicle security device shown in FIGS. 2 and 3. The operation states of the arithmetic units A and B, the collation unit 5, the fail-safe AND 10, the AC amplifier 11, and the relay 12 are the same as those in FIGS. 2 and 3.

[0043] Each of check units A and B is provided on the output lines of arithmetic units A and B respectively, receives the alternating signals from output conversion units A and B respectively, and counts the number of pulses of the respective alternating signals (601). In the example shown in FIG. 6, each of check units A and B counts the rising and falling edges of the pulses of the alternating signal. Each of arithmetic units A and B accesses each of check units A and B at regular time intervals to obtain the values of the alternating signals counted by each of check units A and B (602, 603, 606, and 609).

[0044] Each of arithmetic units A and B compares the count value obtained from each of check units A and B with the count value obtained at the previous access, and detects the presence or absence of output and the frequency of the alternating signals from output conversion units A and B respectively from a certain access time interval. Each of arithmetic units A and B compares the output state to the corresponding output conversion units A and B with the count values of the alternating signals obtained from each of check units A and B (604, 605, 607, and 610).

[0045] As a case where the comparison result shows a mismatch between its own output and the count value, when the stop of the alternating signal or an abnormal value is detected in the state of an alternating output instruction, or when the output of the alternating signal is detected as a count value in the state of an alternating stop instruction, the arithmetic unit A or B that detected it determines that the corresponding output conversion unit A or B is abnormal (in FIG. 6, 610).

[0046] When an abnormality is determined, the corresponding arithmetic unit stops operating to prevent the output from becoming non-safe. Compared with the existing configuration (the configuration shown in FIG. 4), although the process of generating the alternating output is reduced and the process of checking the output state is added instead, the cycle of the checking process can be made longer to some extent compared with the process of generating the output, so the execution of the arithmetic operations of the arithmetic unit is not pressured.

[0047] From FIG. 6, specific examples of the above-described abnormality determination will be described. FIG. 6 shows a case where, despite an output stop instruction being issued from the arithmetic unit B, the output from the output conversion unit B does not stop.

[0048] In arithmetic unit A, the count value obtained by the first count value check is 8 (602), and the count value obtained the second time is 11 (603). In the cycle shown in the figure, a constant count value is obtained the first time, and a value below the predetermined count value is obtained the second time. Therefore, it can be seen that in the state of the alternating output instruction, the output conversion unit A has normally stopped the alternating signal.

[0049] On the other hand, in arithmetic unit B, despite the alternating stop instruction from arithmetic unit B, the alternating signal continues to be output from output conversion unit B (608). Then, the count value obtained by the first count value check is 8 (606), but the count value obtained the second time becomes 16 (609), and a count value that should not be obtained is obtained as a specified value. As a result, device arithmetic unit B determines that the alternating signal is being output from output conversion unit B and detects it as an abnormality of output conversion unit B.

[0050] Thereby, when arithmetic unit B detects an abnormality of output conversion unit B, it is possible to prevent the alternating signal output from collation unit 5 from stopping and the output from becoming non-safe.

[0051] Also, since the alternating signal may be acquired as a transient numerical value depending on the timing of the alternating output instruction or the alternating stop instruction, the count value may be checked not only once but multiple times within a certain period, and a method such as detecting a case where an abnormal value continues as an abnormality detection may be used.

[0052] As described above, each of arithmetic units A and B can confirm the output states from output conversion units A and B respectively by periodically checking the count values of check units A and B respectively.

[0053] Next, as another abnormal case, if the output from output converter A or B stops and output converter A or B malfunctions, when there is no alternating output instruction from arithmetic unit A or B, the check value will always be 0 and it will be determined as normal, and it is assumed that the failure may be latent.

[0054] Since the abnormal case in this situation is a safe state for the system, it does not affect the fail - safe property of the system. However, for example, it is assumed that the abnormality will become apparent only when trying to release the brake, which may cause problems in operation, such as the failure becoming apparent only when applying the brake command. To address this, it is desirable to have a mechanism to detect such failures during maintenance work.

[0055] In the configuration of the on - vehicle safety device shown in FIG. 1, during system initialization after power - on, arithmetic units A and B each output simulated alternating signals at regular intervals, and as a result of the outputs from arithmetic units A and B, it is confirmed that the count values of check units A and B are not 0. Thereby, the soundness of output converters A and B and check units A and B can be checked.

[0056] At this time, the check of the output frequency may be performed by setting the judgment criteria for the count values by arithmetic units A and B as the count values corresponding to a certain output interval. According to the check result, for example, when the count value is 0 or shows an abnormal value, arithmetic unit A or B determines it as a failure and notifies the failure to prevent the latentization of the abnormality.

[0057] However, when adding the above - described operation mode, since an alternating signal is generated as a simulated output, it is desirable to provide a mechanism part that does not output temporarily.

[0058] In addition, although abnormalities in the paths of output conversion units A and B and check units A and B can be detected by the method described above, a method may be used in which each of arithmetic units A and B checks the count values and results obtained by the two arithmetic units against each other, and when a difference occurs in the result of the check, arithmetic units A and B detect their own abnormalities. That is, by mutually checking the results calculated from the count values, errors in the calculation results of the two arithmetic units can be detected.

[0059] Furthermore, output conversion units A and B and check units A and B can be configured by logic ICs, but may also be configured by programmable devices such as FPGAs. In this configuration, in order to avoid an unsafe-side operation due to a single fault, it is desirable that each of output conversion units A and B be configured by one individual programmable device for each corresponding arithmetic unit A and B. Also, for each of check units A and B, it is desirable that they be configured by devices separate from the corresponding output conversion units A and B of the same channel.

[0060] Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments, and various modifications are possible without departing from the gist of the present invention.

Explanation of Reference Numerals

[0061] 1 On-vehicle safety device, 2 Fail-safe CPU, 3, 4 Arithmetic units, 5 Verification unit, 6, 7 Output conversion units, 8, 9 Check units, 10 Fail-safe AND, 11 AC amplifier, 12 Relay, 13, 14 Output units 201, 202 Instructions from the arithmetic unit to the output conversion unit 203, 204 Changes in the alternating signal output according to the instructions from the arithmetic unit to the output conversion unit 205 Signal of the verification result from the verification unit 206, 207 Output signals from the fail-safe AND 208, 209 State changes of the AC amplifier according to the states of the output signals from the fail-safe AND State change of relay according to the state of 210, 211 AC amplifier Arithmetic processing of 251, 252 arithmetic unit Abnormality detection by fail-safe CPU Stop of alternating signal of collation result due to abnormality detection Interrupt signal for generating alternating signal inside arithmetic unit Output instruction from arithmetic unit to output unit Output state from output unit Stop of alternating signal from output unit Output signal generation process inside arithmetic unit Alternating signal detected by check unit Count values of check unit acquired by arithmetic unit for 602, 603, 606, 609 Count value acquisition and confirmation by arithmetic unit for 604, 605, 607, 610 Calculation device When the instruction from and the output from the output conversion unit do not match Activation timing of confirmation process in check unit inside arithmetic unit

Claims

1. Two arithmetic units, a verification unit that verifies the calculation results of each of the two arithmetic units and outputs a first alternating signal if the calculation results of each of the two arithmetic units match; two output conversion units that respectively receive output instructions based on the calculation results of each of the two arithmetic units, output a second alternating signal if the output instruction is an alternating output instruction, and output a non-alternating signal if the output instruction is an alternating stop instruction; and two check units that respectively count the second alternating signals output by each of the two output conversion units are provided, each of the two arithmetic units obtains a count value from each of the corresponding two check units, and from the count value, determines whether each of the two output conversion units is outputting the second alternating signal in the state of the alternating output instruction, and whether each of the two output conversion units is outputting the non-alternating signal in the state of the alternating stop instruction A digital output device characterized by the above.

2. The digital output device according to claim 1, each of the two arithmetic units checks the count value obtained from each of the two check units a plurality of times within a certain period of time A digital output device characterized by the above.

3. The digital output device according to claim 1 or 2, when the digital output device is initialized, each of the two arithmetic units simulates outputting the alternating output instruction, and based on the count value obtained from each of the two check units, checks the soundness of the two output conversion units and the two check units A digital output device characterized by the above.

4. The digital output device according to claim 1 or 2, each of the two arithmetic units collates the count values obtained from the corresponding two check units with each other to detect its own abnormality A digital output device characterized by the above.

5. The digital output device according to claim 1 or 2, the two output conversion units and the two check units are constituted by a logic IC or an FPGA A digital output device characterized by the above.

6. A method performed by a digital output device, a first step of verifying the calculation results of each of the two arithmetic units and outputting a first alternating signal if the verification results match; When instructing alternate output based on the calculation results of each of the two calculators, a second step of outputting a second alternate signal when instructing alternate output and outputting a non-alternate signal when instructing alternate stop; A third step of determining, from the count value obtained by counting the second alternate signal, whether the second alternate signal is being output in the state of instructing alternate output and whether the non-alternate signal is being output in the state of instructing alternate stop; A method for generating a digital output having the above.

Images