DE4407396C2 - Method for performing redundant signal processing in 2-of-3 technology - Google Patents

Description

The invention relates to a method for performing a redundant Si Signal processing in 2-of-3 technology in an arrangement with redundant Processing facilities.

Such a method and a typical application in the context of a high availability and fail-safe automation system is from Siemens Energietechnik, 6. Volume 5, September / October 1984, pages 245 to 249. The talk dante signal processing can affect different subtasks, e.g. B. Mess obtain valuation, tax and regulation tasks.

DE 28 40 634 A1 discloses a signal selection and consolidation arrangement with Ge weighting known, in which the output values of the redundant arrangements with With the help of a circuit part (signal selection logic) compared with predetermined values the.

In redundant structures with signal linking in 2-of-3 technology, three processing devices (processors) perform the same task virtually simultaneously. The output values of the processors are compared with one another in a 2-out-of-3 selection device. Output values that are impermissibly far from an average value are considered to be disturbed and are not taken into account when determining the resulting output value. This means that there is no outward appearance of a processor. The output value of the selection device is formed from the undisturbed output values of the remaining two processors. Depending on the application, different variants can be used to determine the initial value of the system. The resulting output value may e.g. B. can be determined according to one of the following variants:

• a) one of the undisturbed initial values from a processor beiter (selection for several undisturbed values, e.g. according to given priorities), or
• b) the undisturbed initial value, which is the mean of the undisturbed output values are closest, or
• c) the maximum value of the undisturbed output values of the Processor, or
• d) the minimum value of the undisturbed output values of the Processor or
• e) the mean of the undisturbed initial values of Ver worker will be used as the resulting baseline det.

It is assumed that the redundant processing ter in fault-free operation always the same or approximate have the same initial values. Only then can one as deviation of an initial value that is not permitted a fault can be closed.

This requirement is for non-recursive processing functions, d. H. Functions without historical values and Functional structures without feedback of result values, without measures to synchronize the processor met exactly. When using recursive processing processing functions, the output values run in the absence of Synchronization measures with time inadmissible the.  

According to the prerequisite, the processors ask their inputs cyclically at discrete times, which he process input values and determine the result values.

Between the acquisition and processing cycles of the ver Different processors have a time offset or a Phase difference, which can be a maximum of one cycle time. This enables them to record and process different inputs current values.

The larger the pha, the greater the value deviations send difference and the greater the rate of change of detected signals. This results in deviations in value in the result values.

The Er gives way for non-recursive processing functions results of the processors only differ from each other if the input values differ from each other. At constant Input signals (stationary operation) are the detected ones Input values and thus also the determined result values equal. Deviations in value between the redundant processes thus, only occur temporarily.

In recursive processing functions, in addition to the ak current input values also intermediate and result values previous cycles, which are referred to as historical values be used. This causes deviations in egg at a certain point in time even afterwards chung. So short-term deviations of the input values to permanent or even increasing with time Deviations in the intermediate and output values lead.

Is z. B. a binary memory element by an input i gnal set, so if the pulse width of the input signals is less than the cycle time of the processor, the Set impulse recorded in one processor, in another  Processors cannot be recorded. The result is that the Bi storage tank set in one processor and in another your processor is not set. This deviation is permanent and only disappears when a reset pulse in the appropriate processor takes effect.

For integrators, asynchronous acquisition and processing lead to the same integrators in front exposed to same initial values in parallel Processors receive different input values and this results in different initial values. In the next Cycle can also have different input values are available with additional deviating initial values the previous cycle, and so on with time the deviations between the initial values of integrators increase and ultimately inadmissible values accept.

Known methods ensure that the redun processors identical input signals clock or Process command-synchronously or cycle-synchronously. The one process known from Siemens Energietechnik ren works, for example, command-synchronously, as from the Chapter Working of the system, central part emerges. The synchronization devices required for this are complex, which results in high development and product costs most result. The large amount of hardware required leads to an increased total failure rate with an increased Repair needs.

The synchronization requires a highly dynamic Si Signal exchange, which creates a spatially decentralized opening build a redundant system, so the arrangement of re redundant processors in separate electronics cabinets or separate rooms is very difficult.

The invention has for its object a method for redundant signal processing with formation of a resultie analog or digital, non-binary output values tes according to the 2-of-3 technique, with which under Ver Avoiding clock, command or cycle synchronization Reducing an impermissible divergence of the initial values danter signal processing facilities ensured becomes.

This task is carried out in a method according to the generic term of claim 1 by its characterizing features ge solves.

The process does not work for a specific time points-bound synchronization, but with an after management of processing units through output difference is controlled. Therefore, signal runtime play ten in a spatially decentralized system arrangement significant role.

The tracking of a processor is done so that the Ver past values of the processor to be updated from after leading processors for a cycle. Past values with defined values and time limited deviations without affecting the functionality ability of redundant processing need in the sense minimizing the effort involved in tracking to be done.

The historical values selected for tracking are called synchronization values.

Advantageous refinements of the method are broad ren specified claims. You are also the next detailed explanation of the invention with reference to  embodiments shown in the drawings remove.

Show it:

FIG. 1 ranges for defined states,

Fig. 2, a signal flow in a forced synchronization,

Fig. 3 shows the transmission process for status feedback and

Fig. 4 signal flows in the case of functionally different output values per processor.

As already mentioned, the process works with a forced synchronization of the processors, which is triggered by exceeding defined output value differences. The bands used for this, that is to say value ranges for output value differences and defined output value states A to C, are shown in FIG. 1.

A first band of values B _{G is defined} as a range of values around a first reference value (mean value) Y _{G in} order to identify a need for synchronization. This first value band B _G ranges from a negative limit value -GW1 for the detection of a synchronization requirement up to a positive limit value + GW1 for the detection of the synchronization requirement. The limit values -GW1 and + GW1 are defined as distances from the first mean value Y _G.

The first reference value Y _G is the mean value of the initial values of the processors who have no need for synchronization and are not disturbed.

Correspondingly, a second value band B _{S is defined} with a second reference value (mean value) Y _S , which ranges from a negative limit value -GW2 for fault detection to a positive limit value + GW2 for fault detection. The limit values -GW2 and + GW2 are defined as distances from the second mean value Y _S , these distances being greater than the distances from the limit values -GW1 and + GW1.

The limit values GW1 and GW2 must - also in their ratio to each other - to be determined depending on the application.

The second reference value Y _S is the average of the undisturbed starting values. If there is no need for synchronism, or if there is a need for synchronism for an output value and this is simultaneously disturbed, the first or second mean or reference values Y _G and Y _{S are of the} same size.

The mean values Y _G and Y _S are determined in a similar manner using the following method.

If there is a system diagnosis that sets fault indicators for the input values when faults are detected, who will check them first. If more than one input value has a fault signal set, no resultant output value can be determined using the 2-of-3 technique. The mean values Y _G and Y _S are then not required and cannot be calculated.

For the following description it is therefore assumed that at most one input value has a fault indicator.

The mean values Y _G , Y _S are calculated iteratively by successively sorting out values which lie outside the bands for synchronization requirement B _G or fault detection B _S.

For the calculation of the second mean Y _S , at least two input values are required to fulfill the 2-out-of-3 function.

The calculation of Y _S is therefore ended when either an average value Y _{S has been} determined and the input values used to calculate the average value are all within the band B _S or, after sorting out an input value, an average value has been calculated from the remaining two input values, independently whether the input values are within or outside the band B _S.

The following description applies to the determination of Y _S as well as Y _G.

In the first step, the mean value of all input values is formed without the fault indicator set. It is then checked whether one of the input values involved in the averaging is outside the band B _G or B _S around the mean.

If all the input values lie within the band B _G or B _S , the mean value determined in the first step is valid and is used as a reference value for the band for synchronization requirements or fault detection.

If not all input values lie within the band B _G or B _S , the second step of the iteration is carried out:

If an input value lies outside the band B _G or B _S , it is sorted out.

If more than one input value lies outside the band B _G or B _S , the input value is sorted out with the greatest distance from the mean value.

If two input values lie outside the band B _G or B _S and are at the same distance from the mean value, the largest input value or the smallest input value is sorted out depending on the application.

Then, if two input values remain, a new average is formed. The calculation of Y _S is now complete.

One of two undisturbed input _{values is} sufficient for determining the first mean value Y _G. It is therefore checked even after the formation of the first mean value Y _G from two remaining input values whether these are within the band B _G.

If this is the case, the first mean value Y _G determined so far is valid and the calculation is complete.

If the remaining two input values lie outside the first band B _G , but within the second band B _S , the smallest or the largest input value is selected as Y _G depending on the application.

If the remaining two input values are also outside the band B _S , no resulting output value can be determined using the 2-of-3 technique.

The iteration is then stopped. The last determined first mean value Y _G and the associated first band B _G can be used for knowing the need for synchronization if the failure of two input values is tolerated in the sense of a 1-out-of-2 evaluation.

A state A is assigned to output values of processors who have a negligibly small, ie no relevant, deviation from the first mean value Y _G. Initial values with state A are in the first value band B _G. They do not trigger forced synchronization.

Output values with state A are not required to synchronize and are therefore used to form the first mean value Y _G.

Output values from processors with a deviation that lie outside the first value band B _G , but within the second value band B _S , have a relevant deviation that requires synchronism; they are in condition B.

The relevant deviation of the initial values with state B is a permissible deviation. Initial values with statuses A or B are not considered to be disturbed. They are all used to form the second mean Y _S.

Output values of processors whose deviations from the second mean value Y _S lie outside of the second value band B _S are assigned the state C, which means that there is an impermissible deviation and the output value is disturbed.

Fig. 2 shows an arrangement for performing the procedure, and an example of signal flows with forced synchronization. The arrangement contains three redundant processors (processing devices) V ₁ , V ₂ and V ₃ , to which the same input values EW are supplied. The outputs of the processors V ₁ to V ₃ are connected to a comparison and selection device VA, which outputs a resulting output value AW. The comparison and selection device VA forms the resulting output value AW using the 2-of-3 technique, as described above.

The limit values GW1 and GW2 are stored in the comparison and selection device VA. On this basis, the comparison and selection device VA assigns the output values W of the processors V ₁ to V _{3 to} states A to C. The comparison and selection device VA thus determines disturbed and undisturbed processors and processors with and without synchronization requirements.

The comparison and selection device arranges for carrying out a tracking of processors VA to give all processors a status.

The following statuses are defined:
GM = tracking master or synchronous master; the status GM implies that the output value of the processor with this status has the status A;
A = status of a processor whose output value has the status A;
B = status of a processor whose output value has the status B;
C = status of a processor whose output value has the status C.

Statuses B and C are synonymous with the fact that these processors track slaves or are synchronous slaves for which forced synchronous operation is to be carried out. There So processors with disruptions are also included, it is ensured that also these are automatically returned to the undisturbed state, provided there is no hard goods error that makes this impossible.

A selection strategy is implemented in the comparison and selection device VA, according to which Processors who supply output values with state A, a synchronous master GM is chosen. Synchronous master GM is in the sense of the variants listed above a) to d) the processor whose output value W is the resulting output value AW is chosen or one of the processors from whose end the resulting output value AW is formed and the state A have. In variant e)  can the further selection z. B. according to a list of priorities respectively.

The comparison and selection device communicates - via the connection shown in FIG. 2 with dashed lines - to each processor V ₁ to V ₃ the statuses GM, A, B, C of all processors V ₁ to V ₃ .

Each processor has access to a master-capable synchronization value set from another processor via line connections, of which only one is shown as a thick line in FIG. 2.

A synchronous value set consists of those for tracking selected past values. The information about the Mastery of a synchronous value set is e.g. B. in Synchronous value set included.

Each processor independently determines once per Processing cycle its master ability, being the Status message, e.g. B. GM the comparison and selection facility tion VA considered, as well as results of its own slide gnose. The master ability for a synchronous value set remains valid for one processing cycle.

A processor with status B or C, in the example in FIG. 2 this is processor V ₃ , becomes a synchronous slave. In the next cycle, it takes over the synchronization values of processor V ₁ , who has the status GM in the example and who confirms his master ability in the synchronization value record.

Every processor must ensure that its synchronization values that lead to an initial value with fault or equal have run need, not for the forced equal run can be used. This happens through the time  correct logical assignment of the status message to the associated gen synchronous value set. The response time must be between output of the output value at the output of the processor and entering the associated status message at the entrance of the processor are taken into account.

For example, if the response time is less than the time gap between an issue time of the output value and the next entry time of the status message in the processor, this ensures that any faults of the previously calculated synchronous value set in the currently recorded status message are taken into account, the ak status feedback logically to the previous one Synchronous value set is heard and applied to it may.

In Fig. 3 is an example of a transmission process for the output value W and the status message GM, A, B, C represents Darge. Fig. 3 shows a processing cycle i and a previous processing cycle i-1. The processor cycle time is designated Tvz. The cycle time Tvz of the processor is composed of a processing time Tvv and a pause time Tp. At the end of the processing time of a processor, the processor transfers its initial value W to the comparison and selection device VA during a transmission time Tü1.

The comparison and selection device VA works with its own processing tion dynamics, e.g. B. with its own cycle time Taz, the derives from a selector processing time Tav and put together a break.

The following description refers to egg as an example ne cyclical comparison and selection device VA.  

The comparison and selection device takes into account one of a ver starting value W at the time of their arrival next cycle start. At the end of their processing time Tav it transmits the status message during a transmission time Tü2 to the processor.

The pause time Tp between processing cycles of a processor beiter is chosen to be larger than the maximum possible reactivity on time Tr of the comparison and selection device.

Every processor can leave the company after a certain period of time Status message recognize whether its logically associated Ver. Synchronization value set with a forced synchronization ver may be applied.

At the beginning of each processing cycle, each processor checks First, whether he should perform synchronization, d. H. if he has status B or C. If this is not the case, the Processor its normal measuring, control or regulating function continue.

Has a processor recognized that he is performing synchronization he should check whether a master-capable synchronous value set is available. If this is fulfilled, the ver worker its synchronism values on the master synchronism value rate from. There are no synchronous values that can be mastered block, so no synchronization is carried out, but the normal measuring, control and regulating function processed.

If a processor has initial values with state C. finished, there is a malfunction at least temporarily in front. In disturbed operation, the output value AW becomes the comparison and off not select device VA from the initial values of the two disturbed processors.  

Since only two undisturbed output values are available, can from the deviations between the initial values closed on need for synchronization or another fault become the initial value responsible for the deviation however cannot be identified. Therefore, in ge disrupted operation with two undisturbed output values at the Variants a) and e) no synchronization master change pre taken. A processor is always with these variants Synchronization master, the other processor is always the same run slave.

The bands for synchronism and fault detection explained with reference to FIG. 1 apply unchanged. Variants a) to e), but not b), explained at the outset can also be used unchanged for determining the resulting output value AW. Since only two undisturbed output values are still available, with variant b) selected, the resulting output value is determined in accordance with another variant a) or c) to e).

If a second output value W fails, the 2-of-3 technology no longer undisturbed output value AW be provided. The function to be implemented is there with failed. In such a case are dependent to take appropriate measures from the respective application fen, e.g. B. The process is to be brought to a safe state However, he can increase the availability be enough if in the sense of a 1-of-2 evaluation too the failure of the second output value W is tolerated.

Such a solution is conceivable if one System diagnosis of detected disturbances in the output values can also be used.

The following is to be carried out for repair options. A permanently disrupted processor can be identified and reported by the comparison and selection facility. Such a processor V ₁ to V ₃ can be exchanged during operation without interrupting the overall function, that is to say the output of a resultant output value AW. To do this, however, two undisturbed processors must be available. Since an output value W with the state C is not taken into account when forming the resulting output value AW, a faulty processor can be exchanged without affecting the resulting output value AW.

The inclusion of a newly connected processor can e.g. B. done like this:
A newly connected processor initially delivers an output value with a set fault indicator. The comparison and selection unit therefore assigns the initial value to state C, so that the processor is automatically updated in the following cycle by the described method of forced synchronization.

The fault indicator is then reset and the Initial value of the newly connected processor is the same justifies with the baseline values of the other processors in the comparison and selection device monitored and out chooses.

When using the method according to the invention, be be taken into account that in the case of fast transients the Baseline values due to the time offset between the processors handle relatively large temporary discrepancies between the initial values can occur. This situation can occur, for example, in the case of a sudden signal change. Because these deviations caused by fast transients pass by itself and the use of the forced In such a case, no improvement, son who would rather bring deterioration must avoid be changed that such deviations affect the synchronism  rivers. A convenient countermeasure is to: Transient limitation of the output values to the maximum nope term change rate, e.g. B. due to the Stellge speed of a controlled actuator, in the ver workers or in the comparison and selection facility. Another option is automatic Adaptation of the belts for synchronism and malfunction the actual transients.

The method according to the invention can also be configured deployations in which every redundant processor determined several functionally different initial values and the mutually redundant, functionally the same off initial values in comparison and selection devices according to the 2-of-3 technique to be chosen. In such a case, the comparison and selection have the same function as described above and the individual comparison and selection devices work completely independently gig from each other.

Even in an application where the function is under different starting values of processors in separate Processing units within the processor can be determined, the inventive method ver be used, only in relation to the individual processing unit instead of a processor. It means that the forced synchronization in such a case for everyone Processing unit independent of the other processing units can be carried out.

In FIG. 4, an embodiment is shown, in which a plurality of functionally different output values W ₁ to W _n in a common processing means V ₁ to V _3, he will be averaged, which may be regarded in each case as a processing unit. A tracking of a processing device then affects all functions of this processing device, that is to say all the output values W ₁ to W _{n determined} by it. For this reason, individual states S1 to Sn are formed in comparison and selection units VA1 to VAn for each processing function. In a status selection device SW, an overall status S is formed from the individual statuses S1 to Sn, which is used to track the respective processing device, the overall status S being one of the statuses GM, A, B, C described above.

Claims (8)

1. Method for redundant signal processing with formation of a resultant analog or digital, non-binary output value (AW) according to the 2-of-3 technology in an arrangement with redundant, cyclically operating processing devices (V ₁ to V ₃ ), the Processing devices (V ₁ to V ₃ ) the same input values (EW) and their output values (W ₁ to W ₃ ) are fed to at least one comparison and selection device (VA) which outputs the resulting output value (AW), characterized by the following features :

• a) the processing devices (V ₁ to V ₃ ) work asynchronously with regard to the processing cycle and processing cycle;
• b) the individual output values (W ₁ to W ₃ ) of the processing devices (V ₁ to V ₃ ) are each assigned one of the states A, B or C, which are defined as follows:
  State A means that the initial value (W ₁ to W ₃ ) has no impermissible and no relevant deviation,
  State B means that the initial value (W ₁ to W ₃ ) does not have an inadmissible but a relevant deviation,
  State C means that the initial value (W ₁ to W ₃ ) has an impermissible deviation,
  in which
  the relevant deviation relates to the respective difference between the respective output value (W ₁ to W ₃ ) and a first average value (Y _G ), which is the average value of all output values (W ₁ to W ₃ ) with the status A, and
  the impermissible deviation relates to the respective difference between the respective output value (W ₁ to W ₃ ) and a second mean value (Y _S ), which is the mean value of all output values (W ₁ to W ₃ ) with state A or B;
• c) The assignment of the states A, B or C is carried out by using a first value band (B _G ) to determine a relevant deviation and a second value band (B _S ) to determine an impermissible deviation, whereby
• d) the first value band (B _G ) is defined by positive and negative first limit values (+ GW1, -GW1), which are defined as distances from the first mean value (Y _G ),
• e) the second range of values (B _S ) is defined by positive and negative second limit values (+ GW2, -GW2), which are defined as distances from the second mean (Y _s ),
• f) there is no relevant deviation if the respective initial value (W ₁ , W ₂ , W ₃ ) lies within the first value band (B _G );
• g) there is a relevant deviation if the respective initial value (W ₁ , W ₂ , W ₃ ) lies outside the first value band (B _G ) but within the second value band (B _S ), and
• h) there is an impermissible deviation if the respective output value (W ₁ , W ₂ , W ₃ ) lies outside the second value band (B _S );
• i) that processing device (V ₁ , V ₂ , V ₃ ) whose output value (W ₁ , W ₂ , W ₃ ) has the state B or C is tracked in such a way that it receives historical values from a processing device (V ₁ , V ₂ , V ₃ ), whose output value (W ₁ , W ₂ , W ₃ ) has the state A, is given to carry out its next processing cycle; historical values are values of recursive processing functions from previous cycles, which are required for the calculation of the result values of the recursive processing functions in the current cycle;
• j) in the comparison and selection device (VA), output values (W ₁ , W ₂ , W ₃ ) with the state A or B are used to form the resulting output value (AW).

2. The method according to claim 1, characterized in that the tracking of processing devices (V ₁ , V ₂ , V ₃ ) is carried out in the following manner:
the comparison and selection device (VA) selects one of the processing devices (e.g. V ₁ ), the output value (e.g. W ₁ ) of which is state A, and assigns it a state GM which it processes indicates the direction whose past values are to be used for tracking processing devices whose output values have the status B or C, each processing device (V ₁ , V ₂ , V ₃ ) in each processing cycle and validly indicating its past values in each processing cycle, whether they can be used for tracking. 3. The method according to claim 2, characterized in that in the processing cycles of the processing devices (V ₁ to V ₃ ) after the processing times (Tvv) there are pause times (Tp) which are so large that the processing devices (V ₁ to V ₃ ) the states (A, B, C, GM) are already available in the next processing cycle, which are based on the evaluation of their output values (W ₁ to W ₃ ) calculated in the immediately preceding processing cycle. 4. The method according to any one of the preceding claims, characterized in that the mean values (Y _G , Y _S ) of the value bands (B _G , B _S ) iteratively by successively sorting out initial values (W ₁ to W ₃ ) with relevant ter (related on Y _G ) or inadmissible (based on Y _S ) deviation are formed, whereby sorted out initial values (W ₁ , W ₂ or W ₃ ) are no longer used to calculate the mean values (Y _G , Y _S ) in subsequent iterations, and where

• a) if more than one output value (W ₁ , W ₂ , W ₃ ) of three output values that have not yet been sorted out lies outside the current value range (B _G or B _S ) in the iterative process, the output value with the greatest distance to the respective current one Mean (Y _G or Y _S ) is sorted out,
• b) if two output values (W ₁ , W ₂ , W ₃ ) of three output values that have not yet been sorted out lie outside the current value range (B _G or B _S ) in the iterative sequence and both are at the same distance from the mean value (Y _G , Y _S ) have the largest output value or the smallest output value sorted out depending on the application, and
• c) if two output values (W ₁ , W ₂ , W ₃ ) from two output values that have not yet been sorted out lie outside the current first value band (B _G ), but within the second value band (B _S ) and both were equal to the first Average (Y _G ) have, depending on the application, the largest output value or the smallest output value is sorted out.

5. The method according to any one of the preceding claims, characterized in that processing devices (V ₁ to V ₃ ) are used which contain a system diagnosis, with the disturbances of output values who are recognized, and that the output values identified as disturbed (W ₁ , W ₂ , W ₃ ) get state C. 6. The method according to any one of claims 2 to 5, characterized in that - in the sense of minimizing the effort during tracking - such past values are not taken into account when tracking, which only defines deviations in value and time-limited between the redundant processing devices (V ₁ , V ₂ , V ₃ ) without affecting the functionality of the redundant processing. 7. The method according to any one of the preceding claims, characterized in that in an application in which the processing devices (V ₁ to V ₃ ) several (n) functionally different output values (W _1.1 ... W _1.n to W _3.1 ... W _3.n ) output, from these in corresponding comparison and selection devices (VA ₁ to VA _n ) corresponding function-related resulting output values (AW ₁ to AW _n ) and individual statuses (S ₁ ... S _n ) and that an overall status (S) for tracking processing devices (V ₁ , V ₂ , V ₃ ) is formed from the individual statuses (S ₁ ... S _n ), each individual status (S ₁ ... S _n ) the states (A, B, C) for the respective output values (W _1.1 ... W _1.n , up to W _3.1 ... W _3.n ) and the overall _status (S) the states (A, B, C, GM) for tracking the processing devices (V ₁ to V ₃ ) contains. 8. The method according to any one of the preceding claims, characterized ge indicates that in a case where two output values have the state C have, and thus no resultant result according to the 2-of-3 technique can be determined, depending on the application in terms of a 1-of-2-out the failure of these two output values is tolerated.