JPH056704B2 - - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION [Technical Field] The present invention relates to a fail-safe device for a control circuit, and more particularly to a fail-safe device that backs up the control operation of a control circuit having a central processing unit when the control circuit fails.

[Prior Art] Conventional fail-safe devices for this type of control circuit include, for example, Japanese Patent Application Laid-Open No. 48-3351 and Japanese Patent Application Laid-Open No. 53-1999.
There is something disclosed in 54441.

FIG. 1 shows an example of a conventional fail-safe device for this type of control circuit. Here, 1 is a main control circuit having, for example, a microcomputer as a processing device, and outputs a control signal b'. It also outputs a signal a' for determining the state of the main control circuit to the backup circuit 10. The main control circuit state determination signal a' is, for example, a signal with a predetermined frequency obtained by the main control circuit 1 periodically inverting the output port according to a program. Therefore,
If the main control circuit 1 fails, a signal for determining the status
The output of a′ will stop, or the frequency will become abnormally low or high.

10 is a backup circuit constituting an auxiliary control circuit as a fail-safe device for the system;
A failure of the main control circuit 1 is detected using the state determination signal a', and in the event of a failure, a signal c' for backing up the control signal b' and a switching signal e' are generated. 2
0 is a switching circuit which outputs a control signal b' or a backup signal c' as a control output d' to the device to be controlled, depending on the state of the switching signal e'. 30
is a reset circuit, which determines an abnormality such as a failure of the main control circuit 1 based on the state determination signal a of the main control circuit 1, and resets the main control circuit 1 at a predetermined cycle when the main control circuit 1 fails. It generates a signal f.

However, in such a conventional control circuit fail-safe device, the main control circuit 1 is switched by one switching signal e' from the backup circuit 10.
The configuration is such that the control output is selected by switching between the control signal b' from the backup circuit 10 and the backup signal c' from the backup circuit 10.
0, the backup circuit 10 generates the switching signal e' even though the main control circuit 1 is operating normally, and as a result, the switching circuit 20
There was a problem in that there was a very high risk that the backup signal c', which had failed and became abnormal, would be selected as the control output.

Therefore, a serious problem arises in that the backup circuit, which is supposed to function as a fail-safe device for the main control circuit, disrupts the control output due to its own failure, which in turn significantly reduces the reliability of the entire system.

[Objective] The present invention has been made by focusing on such conventional problems, and the present invention has been made in order to prevent the switching circuit from switching when a signal with a predetermined period or near a predetermined period is generated on the signal line for switching the switching circuit. It is an object of the present invention to provide a fail-safe device for a control circuit in which the risk of malfunction is extremely reduced by switching the backup signal to be selected as the control output.

[Configuration] In order to achieve such an object, the present invention includes a main control circuit as a first control means for sending a first control signal to a controlled object, and a second control circuit for sending a first control signal to a controlled object.
a backup circuit as a second control means having means for transmitting a control signal, a failure determination means for determining a failure of the first control means, and an output means for outputting a signal having a predetermined period according to the determination;
a switching circuit as a switching means for switching between a control signal and a second control signal and outputting the same to a controlled object; and a switching circuit outputting the second control signal when the signal outputted by the output means has approximately a predetermined period. The present invention is characterized in that it includes a period determination circuit as a switching control means for controlling the switching control so as to perform control.

[Example] Hereinafter, the present invention will be described in detail with reference to the drawings.

FIG. 2 shows an embodiment of the invention. Here, 1
00 is a main control circuit having, for example, a microcomputer as a processing device, and outputs a control signal b. Furthermore, for the backup circuit 110,
A signal a for determining the state of the main control circuit is output. This state determination signal a is, for example, the main control circuit 100.
can be a signal of a predetermined frequency obtained by periodically inverting the output port according to a program. That is, if an abnormality such as a failure occurs in the main control circuit 100, the output of the state determination signal a will stop, or the frequency will abnormally decrease or increase.

The backup circuit 110 constitutes an auxiliary control circuit as a fail-safe device of the system, and controls the main control circuit 1 by the state determination signal a.
00 failure, and when it is determined that it is a failure, the backup signal c and, for example, a rectangular wave g with a predetermined period are output.
and occurs.

Reference numeral 120 denotes a switching circuit, which switches between the control signal b and the backup signal c according to the state of the switching signal e, and outputs it as a control output d to the device to be controlled.
130 is a reset circuit, and the state determination signal a
This determines whether there is an abnormality in the main control circuit 100, and generates a signal to reset the main control circuit 100 in accordance with the determination.

Reference numeral 150 denotes a period determination circuit, which generates a switching signal e and supplies it to the switching circuit 120 only when the period of the rectangular wave g is equal to or in the vicinity of a preset period, in response to the input of the rectangular wave g.

Next, each part related to the present invention will be described.

FIG. 3A shows an example of a schematic configuration of the main control circuit 100 in order to explain the generation of the state determination signal a. Here, 102 is a control unit, which includes a central processing unit CPU that controls each unit, a ROM that stores the control procedure of the controlled object and the processing procedure shown in Figure 4, a RAM as a data memory, etc., and an input/output unit for various signals. etc. 104 is a register, and the control unit 102 sets a predetermined value to this register 104 when executing a series of control procedures. 106
is a timer that counts the clock signal CLK for a fixed period of time. 108 is a comparator, and as shown in FIG.
Interrupt signal when equal to the value set in
Generates INT and supplies it to the control unit. Also, this signal INT is used as a reset signal for the timer.

FIG. 4 shows a state determination signal a by the control unit 100.
This section describes the procedure for generating an interrupt signal.
Make it start according to INT input. signal
In response to the INT input, signal a is first output in step S1.
Determine whether or not the power is in the energized state. Then, in steps S2 and S3, the signal a is inverted, and the process ends. That is, according to this processing procedure, when the control circuit 100 is operating normally, the signal a has a constant frequency, so this signal can be used to determine the state of the control circuit 100.

FIG. 5A shows an example of a schematic configuration of a backup circuit in order to explain the period determination of the state determination signal a. Here, 112 is a control unit, which can have the same configuration as the control unit 102, for example.
116 is a timer, which provides a fixed time clock signal.
The count is performed according to the CLK input. A capture register 118 stores, for example, the count value of the timer 116 at the rising edge of the signal a. As shown in FIG. 5B, the control unit 112 starts the timer 11 at the rising edge of the signal a.
The period of the signal a can be measured from the value counted by 6 and the current value. That is,
As shown in the figure, if values A, B, C, and D are obtained in sequence, the period of signal a can be found by calculating B-A, C-B, D-C, etc. .

FIG. 6 shows an example of a switching control procedure of the switching circuit 120 performed by the control section 112, and this procedure is started at the rising edge of the signal a. First, in step S11, the period of signal a is determined, and then in step S12, it is determined whether the period is equal to or close to that during normal operation. here,
If the determination is affirmative, the process ends, and if the determination is negative, the process proceeds to step S13.

In step S13, a counter is incremented to indicate how many times the negative determination in step S12 has been made. This counter can also be realized by software using, for example, a part of memory. Then, in step S14, it is determined whether the value of the counter exceeds a preset value. Here, if the judgment is negative, end the process,
If the determination is affirmative, it is determined in step S15 that a failure has occurred in the main control circuit 100, and, for example, a flag provided in the memory area of the control unit 112 is turned on.
This processing procedure ends.

The generation of the rectangular wave g with a predetermined period by the backup circuit 110 can be achieved by, for example, providing an interrupt signal generation circuit as shown in FIG. 3A in the backup circuit.
When a failure of the main control circuit 100 is determined, the same procedure as that shown in FIG. 4 can be performed.

FIG. 7 shows a configuration example of a period determination circuit for signal d, where 151 and 152 are a bandpass filter and a retriggerable monostable multivibrator, respectively. That is, the switching signal g is input to the retriggerable monostable multivibrator 152 via the bandpass filter 151, and the output of the retriggerable monostable multivibrator 152 is used as the switching signal e. The retriggerable monostable multivibrator 152 is
It is retriggered every time a pulse is input, and continues to output if a pulse is input at a cycle shorter than a predetermined cycle.For example, TTL IC 74122,
74LS122 (Texas Instruments), etc. can be used. Therefore, the switching signal e is output only when a signal having a predetermined period or a signal near a predetermined period is input to the period determining circuit.

By configuring the fail-safe device as described above, even if the main control circuit 100 is normal, if the backup circuit 110 fails, a mode is established in which the backup signal c, which has become abnormal due to the failure, is selected as the control output. switching circuit 120
The probability that a switching signal e will be generated that switches between the two is extremely small.

In other words, unless the backup circuit 110 fails in a mode in which it outputs a signal with a predetermined period or a signal near a predetermined period as a switching signal, the switching circuit will not pass the backup signal as a control output, and such a switching circuit will not pass the backup signal as a control output. Since there is almost no possibility that a major failure will occur, the probability that the backup circuit will fail and interfere with the main control circuit when the main control circuit is normal can be extremely reduced.

FIG. 8 shows another embodiment of the device according to the invention. This example deals with a failure such as a disconnection of the signal line of the signal e. Note that the switching circuit 120 is configured to select the control signal b from the main control circuit 100 as the control output d when the switching signal e is de-energized.
When configured, a pull-down resistor 160 is provided on the switching signal line e. Further, when the switching signal e is energized, the control signal b from the main control circuit 100
The switching circuit 12 selects the control output d as the control output d.
0, a pull-up resistor 170 is provided on the switching signal line e. In either case,
It is preferable to arrange the resistor as close to the switching circuit 120 as possible.

As a result, even if a failure occurs such as a disconnection in the cycle determination circuit 140 or a disconnection in the switching signal line e, the control signal b is passed as the control output d, so that the main control circuit 100 can be operated normally due to a failure of the fail-safe device. Control operations will no longer be inhibited.

It should be noted that the present invention can of course be applied to various control systems, and in its application, the main control circuit and the backup circuit may have the same functions, or the backup circuit may simply be the minimum necessary control system for the control target. Of course, it is equally applicable to cases where the basic operation of the device is guaranteed. For example, when the present invention is applied to a control system for an automobile, the main control circuit is configured to perform flexible ignition control, fuel injection control, etc. according to driving conditions, while the backup circuit is configured to perform flexible ignition control, fuel injection control, etc. according to driving conditions.
When the main control circuit fails, fixed data such as injection time and ignition timing can be generated.

Furthermore, although the number of fail-safe devices including backup circuits is simply one stage in each of the above-described embodiments, it is extremely easy to provide a desired number of stages as required.

Furthermore, it is also easy to provide a plurality of period determination circuits and switch the switching circuits based on a combination of their outputs, and in this case, the reliability of the device can be further improved.

In addition, a bandpass filter is provided in the period determination circuit, but if there is a high probability that the failure mode of the backup circuit is a failure in which the switching signal period becomes large or a failure in which the switching signal stops, For example, a high pass filter can be provided instead of the pass filter.

[Effects] As explained above, according to the present invention, the configuration is such that the switching circuit is switched only when a signal with a predetermined period or a signal near a predetermined period is generated on the switching signal line, and the backup signal is used as the control output. Therefore, even if the main control circuit is normal, if the backup circuit fails, the switching circuit can be switched to a mode that allows the backup signal that has become abnormal due to the failure to pass through to the control output. The possibility that a switching signal is generated and an abnormal control output is output can be greatly reduced, and the reliability of the control system can thereby be dramatically improved.

[Brief explanation of the drawing]

FIG. 1 is a block diagram showing a configuration example of a fail-safe device of a conventional control circuit, FIG. 2 is a block diagram showing a first embodiment of the device of the present invention, and FIGS. 3 A and B are respective main control circuits thereof. 4 is a block diagram showing a configuration example of the main part of the main part and a timing chart of each part thereof, FIG. 4 is a flowchart showing an example of the procedure for generating a state determination signal in the main control circuit, and FIGS. 5A and B are respectively , a block diagram showing an example of the configuration of the main parts of the backup circuit and a timing chart of each part thereof, FIG. 6 is a flowchart showing an example of a failure determination procedure for the main control circuit in the backup circuit, and FIG. 7 is a diagram showing the backup circuit. FIG. 8 is a block diagram showing an example of the structure of a period determination circuit for a switching signal generated by the circuit. FIG. 8 is a block diagram showing a second embodiment of the device of the present invention. 1,100... Main control circuit, 10,110...
Backup circuit, 20, 120... switching circuit,
30, 130...Reset circuit, 102...Control unit, 104...Register, 106...Timer, 1
08...Comparator, 112...Control unit, 116...
Timer, 118...Capture register, 150
...Period determination circuit, a, a'...Status determination signal,
b, b'...control signal, c, c'...backup signal, d, d'...control output, e, e'...switching signal,
f...Reset signal, g...Switching signal.

Claims (1)

[Scope of Claims] 1. A first control means for sending a first control signal to a controlled object, a means for sending a second control signal to the controlled object, and determining a failure of the first control means. a second control means having a failure determination means and an output means for outputting a signal having a predetermined period according to the determination; and switching for switching between the first control signal and the second control signal and outputting the same to the controlled object. and switching control means for controlling the switching means to output the second control signal when the signal output by the output means has approximately the predetermined period. Fail-safe device for control circuits. 2. The control circuit according to claim 1, characterized in that when information related to switching control by the switching control means is interrupted, the switching means outputs the first control signal. Fail safe device.