JP2011248625A - Failure diagnosis circuit and failure diagnosis method of control device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To realize prevention of an erroneous output of a control circuit due to a failure of a diagnosis circuit without increasing an amount of hardware, in a control device in a system having high reliability, including the diagnosis circuit.SOLUTION: In the control device in the system having high reliability, a diagnosis instruction signal from an upper-level device is received at multiplexed communication control circuits, and a diagnosis instruction signal to the diagnosis circuit and a diagnosis permission signal are generated. By monitoring a diagnosis output of the diagnosis circuit by multiplexed diagnosis permission circuits using the diagnosis permission signal, the prevention of an erroneous output due to a failure of the diagnosis circuit is realized, and a problem of hardware increase by multiplexing of the diagnosis circuit is solved.

Description

  The present invention relates to a failure diagnosis circuit for detecting a failure of a control device of various systems and a failure diagnosis method thereof.

  In a control device in a system with a high potential risk such as a power plant, in order to avoid an erroneous output of the control device due to a failure, the system and the control device are made safe by performing a safe stop of the control device or preventing an erroneous output when a failure occurs A function to shift to a new state is required. In realizing this function, a failure diagnosis circuit that detects a failure of the device itself or a surrounding device in the control apparatus plays an extremely important role. For example, in Patent Document 1, in a control device such as a plant, analog output modules each having a fault diagnosis circuit are arranged in parallel, the diagnosis result is output to the other party, and only the operating side is output by the output switching means, which is duplicated A stable control circuit configuration is disclosed.

  Non-Patent Document 1 shows an international standard that defines requirements for using an electrical / electronic / programmable electronic safety control device as a part of a safety control system. Functional safety certification is a system safety Is defined as a four-level Safety Integrity Level (SIL). SIL means how reliably certain safety control can be performed when an abnormality or failure of the apparatus is detected.

  In order to guarantee the safety of the system, the SIL also requires the failure detection of the failure diagnosis circuit itself of each control device and device. Therefore, in order to ensure the safety of the system, it is necessary to implement a failure detection function of the failure diagnosis circuit by means such as multiplexing of failure diagnosis circuits and comparison of failure diagnosis circuit outputs.

  FIG. 2 illustrates a general failure diagnosis circuit in a conventional system control apparatus. In the master-slave control apparatus shown in FIG. 2, the diagnosis instruction signal 2 is transmitted from the upper apparatus 1 to the lower apparatus 200 through the communication line, and is received by the communication interface 3. The subordinate apparatus 200 distributes the received diagnostic instruction signal 2 through the communication interface 3 to form the diagnostic instruction signal 4, and provides a redundant failure diagnosis circuit 111 and failure diagnosis circuit 112, inputs the diagnosis instruction signal 4, and outputs the diagnosis output. Are compared by the comparison circuit 19 to check the normality, and then a diagnostic output 20 is generated to diagnose the function of the comparison output circuit 21 of the duplex output exemplified as the diagnosis target.

  From the host device, a control signal that is the original function of the lower device 200 is output together with the diagnosis instruction signal 2 and is distributed to the pair of output circuit A22 and output circuit B23 to be compared with a duplicate output. After the normality of the output circuit A22 and the output circuit B23 is verified by 21, the control target 300 such as a motor or actuator is controlled by the normal control signal 24.

  However, multiplexing of fault diagnosis circuits imposes other functions on physical and cost aspects such as mounting area. In particular, when a fault diagnosis circuit using a microcomputer is used for fault diagnosis of the control device, multiplexing of the fault diagnosis circuit causes a large problem due to an increase in logical area, cost, power consumption, and heat generation. ing.

JP 2003-256037 A

IEC61508-1-7, “Functional safety of electrical / electronic / programmable electronic safety-related systems” part1-7

  In a control device of a system that requires high safety, it is extremely important to prevent an erroneous output caused by a failure of a failure diagnosis circuit. However, simple redundancy / multiplexing of the fault diagnosis circuit directly increases the amount of hardware, that is, increases the cost. Therefore, establishment of erroneous output prevention technology that suppresses the increase in hardware has become an issue.

  The present invention relates to a failure diagnosis device and a failure diagnosis method in a case where a host device instructs a failure diagnosis from a host device to a lower device in a master-slave control device of a system in which a host device issues a command to a lower control device. A communication control circuit that receives a command including a diagnosis instruction from the device is multiplexed, the communication control circuit inputs the diagnosis instruction to a single failure diagnosis circuit, and the diagnosis output from the failure diagnosis circuit is multiplexed to the multiplexed diagnosis permission circuit. By distributing and outputting a diagnosis permission signal by a multiplexed communication control circuit and inputting it to a multiplexed diagnosis permission circuit to monitor the diagnosis output and comparing the permitted diagnosis output, It is characterized by preventing erroneous output of the device due to failure of the failure diagnosis circuit without multiplexing.

  In the control device having the host device and the lower device, the multiplexed communication control circuit provided in the lower device outputs the diagnosis instruction and the diagnosis permission signal to the failure diagnosis circuit in response to the diagnosis instruction from the host device. Are performed in parallel, and the fault diagnosis circuit output is monitored by the multiplexing diagnosis permission circuit, so that the fault diagnosis circuit itself is diagnosed without being multiplexed, thereby preventing the erroneous output of the control device.

  Further, according to the present invention, in a failure diagnosis method for a control device having a host device and a lower device, the lower device receives a diagnosis instruction from the host device and outputs a diagnosis instruction signal and a diagnosis permission signal to the failure diagnosis circuit in parallel. By doing so, it is possible to prevent erroneous output without multiplexing the fault diagnosis circuit itself.

  As a result, an increase in hardware can be suppressed, and stable operation of the control device and improvement of the service life can be realized by reducing costs and reducing power consumption and heat generation.

It is a block diagram which shows the control apparatus of this invention. It is a block diagram which shows the control apparatus of a prior art example.

  The embodiment of the present invention will be described in the following order for each example. Examples described below are preferred specific examples of the present invention, and various technically preferable limitations are given. However, the scope of the present invention is not limited to these examples unless otherwise specified. For example, each condition given in the following examples is only a preferable example, and the arrangement relationship in each drawing used for the description is also schematic.

  FIG. 1 shows a configuration of a control device used for plant control or the like which is an embodiment of the present invention. Here, a case where a control device having a master-slave configuration having a host device and a lower device has one each of a host device and a lower device that issue a diagnosis instruction signal to the lower device will be described. There are no restrictions on the number and type of devices, subordinate devices (input / output / others) and communication mode. In addition, the circuit configuration of the lower device is duplicated, and the comparison output comparison circuit of the duplex output is targeted for diagnosis, but there are no restrictions on the internal multiplicity including the higher device and the diagnosis target.

  In the conventional example shown in FIG. 2, the fault diagnosis circuits 111 and 112 are duplicated and the diagnosis outputs are compared by the comparison circuit 19. When the outputs become inconsistent and the fault diagnosis circuit operation is abnormal, the control device is controlled 300. It shuts off from the power supply and shifts to a safe state to prevent erroneous output of the control circuit due to a failure diagnosis circuit failure. This prevents damage to the system due to malfunction of the controlled object.

In contrast, the present invention distributes and compares the diagnosis instruction signal from the communication control device, and also compares the diagnosis output of the failure diagnosis circuit using the diagnosis permission signal and then compares the diagnosis output signal. Diagnose without duplication and prevent erroneous output.
[Basic configuration]
In FIG. 1, the control circuit includes a host device 1 and a lower device 100, and the host device 1 instructs the lower device 100 to execute a failure diagnosis of the lower device 100 by a diagnosis instruction signal 2. The lower level device 100 receives the diagnostic instruction signal 2 from the higher level device 1 through the communication line by the communication interface 3.
(Communication control)
The diagnosis instruction signal 4 received and distributed by the communication interface 3 is input to the communication control circuit A5 and the communication control circuit B6, and is input to the comparison circuit 9 as the diagnosis instruction signal 7 and the diagnosis instruction signal 8. The communication control circuit A5 and the communication control circuit B6 are double redundant communication control circuits, and duplex communication with the host device 1 including the diagnosis instruction signal 2 and the normal control signal. The communication control circuit A5 and the communication control circuit B6 output a diagnosis instruction signal 7 and a diagnosis instruction signal 8 to the comparison circuit 9 particularly when a failure diagnosis is instructed from the host device 1. The comparison circuit 9 compares the diagnosis instruction signal 7 and the diagnosis instruction signal 8 and outputs a comparison signal 10 indicating the coincidence or disagreement between them to the failure diagnosis circuit 11.

The communication control circuit A5 generates a diagnosis instruction signal 7 and a diagnosis permission signal 13 from the diagnosis instruction signal 4. Similarly, the communication control circuit B6 generates a diagnosis instruction signal 8 and a diagnosis permission signal 14 from the diagnosis instruction signal 4. The diagnosis permission signal 13 and the diagnosis permission signal 14 set time conditions such as a time limit and a time window, and check the output of the failure diagnosis circuit 11 with the configuration described below.
[Failure diagnosis circuit]
Next, the failure diagnosis circuit 11 will be described. The failure diagnosis circuit 11 receives the comparison signal 10 from the comparison circuit 9 and generates and outputs various diagnosis outputs 12 corresponding to the instruction contents of the host device 1. That is, the failure diagnosis circuit 11 outputs a diagnosis instruction signal 7 when the comparison signal 10 is input, and outputs a diagnosis output 12 indicating a normal state when the diagnosis instruction signal 8 matches. If they do not match, a diagnostic output 12 indicating an abnormal state is output. The diagnosis output 12 is distributed to the duplex diagnosis permission circuit A15 and diagnosis permission circuit B16.
[Diagnosis permission circuit]
Next, the diagnosis permission circuit A15 and the diagnosis permission circuit B16 will be described. The diagnosis permission circuit A15 and the diagnosis permission circuit B16 are redundant output permission circuits, and the diagnosis signal 12 of the failure diagnosis circuit 11 is distributed to the diagnosis permission circuit A15 and the diagnosis permission circuit B16.

  The diagnosis permission signal 13 and the diagnosis permission signal 14 from the communication control circuit A5 and the communication control circuit B6 are input to the diagnosis permission circuit A15 and the diagnosis permission circuit B16, respectively. The diagnosis permission circuit A15 and the diagnosis permission circuit B16 monitor the diagnosis output 12 with the diagnosis permission signal 13 and the diagnosis permission signal 14 of the communication control circuit A5 and the communication control circuit B6, and meet the conditions of the diagnosis permission signal 13 and the diagnosis permission signal 14. In this case, the diagnostic output signal 17 and the diagnostic output signal 18 are output to the comparison circuit 19 at the next stage.

That is, the communication control circuit A5 and the communication control circuit B6 have a function of checking the normality of the diagnosis output 12 from the diagnosis permission signal 13 and the diagnosis permission signal 14, and outputting a duplicated diagnosis output signal 17 and diagnosis output signal 18.
[Comparison circuit]
If the diagnosis output signal 17 and the diagnosis output signal 18 do not match in the comparison circuit 19, it is determined that the failure diagnosis circuit 11 has failed, the control signal 24 to the controlled object 300 is cut off, and the control circuit and system are made safe. Transition to the state. When the diagnosis output signal 17 and the diagnosis output signal 18 coincide with each other, a normal diagnosis output 20 is output, and the duplexed output comparison / collation circuit 21 to be diagnosed is diagnosed. When the duplex output comparison / collation circuit 21 is operating normally, the control object 300 is controlled by the control signal 24.

1: Host device 2, 4, 7, 8: Diagnosis instruction signal 3: Communication interface 5: Communication control circuit A
6: Communication control circuit B
9, 19: Comparison circuit 11: Failure diagnosis circuit 13, 14: Diagnosis permission signal 15: Diagnosis permission circuit A
16: Diagnosis permission circuit B
17, 18: Diagnostic output signal 21: Duplex output comparison / collation circuit 100: Subordinate device 300: Control target

Claims (12)

A control device of a system that performs control by a control device having a host device and a host device, wherein the host device receives a control signal and a diagnosis instruction signal from the host device, a fault diagnosis circuit, and a control In a control device having an output circuit that outputs a control signal to a target,
A multiplexed communication control circuit that receives a diagnosis instruction signal received from the host device, and a diagnosis permission that permits diagnosis output by monitoring the diagnosis output of the failure diagnosis circuit by the multiplexed communication control circuit output A fault diagnosis circuit for a control device comprising a circuit.   2. The failure diagnosis circuit for a control device according to claim 1, further comprising a comparison circuit for comparing diagnosis instruction signals from the multiplexed communication control circuits.   3. The failure diagnosis circuit for a control device according to claim 2, wherein the comparison circuit issues a diagnosis instruction to the failure diagnosis circuit only when the multiplexed diagnosis instruction signals match. Fault diagnosis circuit.   2. The failure diagnosis circuit for a control device according to claim 1, wherein the communication control circuit generates a diagnosis permission signal and outputs the diagnosis permission signal to the diagnosis permission circuit, and the diagnosis permission circuit uses the diagnosis permission signal to perform the failure diagnosis. A fault diagnosis circuit for a control device, characterized by monitoring a diagnostic output of the circuit.   5. A failure diagnosis circuit for a control device according to claim 4, further comprising a comparison circuit for comparing the diagnosis outputs from the multiplexed diagnosis permission circuits to diagnose the normality of the diagnosis output. Fault diagnosis circuit.   6. The failure diagnosis circuit for a control device according to claim 1, wherein each of the multiplexed communication control circuits transmits a control signal to the output circuit, and an output of the output circuit is a multiplexed output. A fault diagnosis circuit for a control device, which is output to a comparison / collation circuit and collated and then output as a control signal to control a control target. In a control device of a system that performs control by a control device having a host device and a subordinate device, the fault diagnosis method for the control device instructing fault diagnosis from the host device to the subordinate device having a fault diagnosis circuit,
Failure diagnosis of a control device characterized in that diagnosis instruction signals from the host device are multiplexed and input to the failure diagnosis circuit to perform failure diagnosis, and diagnosis instruction signals are multiplexed to permit diagnosis of failure diagnosis Method.   8. The failure diagnosis method for a control device according to claim 7, wherein the multiplexed diagnosis instruction signals are compared, and the failure diagnosis is performed only when the diagnosis instruction signals coincide with each other.   8. The failure diagnosis method for a control device according to claim 7, wherein a multiplexed diagnosis permission signal is generated, and the failure diagnosis output is monitored using the diagnosis permission signal to monitor the failure diagnosis output. A fault diagnosis method for a control device.   10. The failure diagnosis method for a control device according to claim 9, wherein multiplexed diagnosis output signals are compared, and the diagnosis target is diagnosed only when the diagnosis output signals match. Diagnosis method.   8. The control device failure diagnosis method according to claim 7, wherein when the multiplexed diagnosis instruction signals are inconsistent, a control circuit failure is detected and the control device is shifted to a safe state. Device failure diagnosis method.   8. The control device failure diagnosis method according to claim 7, wherein when the multiplexed diagnosis output signals do not match, the control device failure is detected and the control device is shifted to a safe state. Fault diagnosis method.

Images