FAIL-SAFE PROCESSING APPARATUS
BACKGROUND OF THE INVENTION
Field of the Invention
The present invention relates to a multiple-system fail-safe processing
apparatus that is used in a field requiring high safety, includes therein a plurality of
calculation units, and provides a fail-safe configuration to ensure a match between
the calculation results.
Description of the Related Art
A system performing calculation in a field requiring high safety, such as railway
signaling safety systems and power plants, includes multiple calculation units and
performs a series of controls so that the system checks whether or not the calculation
results are matched; if matched, the system continues normal operation; and if
unmatched, the system transitions to a safe state.
Thus, it is necessary to eliminate the factors for which a plurality of calculation
units simultaneously produce the same erroneous output. One of the factors
includes a temporary voltage variation of a power supply. Japanese Patent Laid-
Open No. 2002-116921 (Patent Document 1) and Japanese Patent Laid-Open No. 6-
298105 (Patent Document 2) include a plurality of calculation units to each of which
power is separately supplied from a different power supply. There is a low
probability that a plurality of power supplies simultaneously generate a failure of the
same type, which allows a reduction in probability that a plurality of calculation units
simultaneously produce the same erroneous output due to a power supply failure.
However, if different power supplies separately supplying power
simultaneously generate the same voltage variation, the plurality of calculation units
simultaneously output the same erroneous data, thus leading to a possibility that the
output control unit cannot detect the erroneous data and outputs the erroneous data
to outside. In order to detect a temporary voltage variation of a plurality of power
supplies, Patent Document 1 provides a configuration in which one CPU is also
connected to the other power supply and monitors the other power supply, and
Patent Document 2 provides a configuration in which both CPUs mutually monitor
each other's power supply output. However, if a temporary voltage variation occurs
in a power supply, the CPU may output erroneous data without receiving a
calculation stop command such as reset from a power monitoring unit. Accordingly,
it is an object of the present invention to provide a fail-safe processing apparatus that
eliminates the possibility of outputting an erroneous calculation result even if a
temporary voltage variation occurs in a power supply supplying power to a plurality of
calculation units.
SUMMARY OF THE INVENTION
In order to solve the above problem, one of a plurality of power supplies
separately supplying power to a plurality of calculation units constituting a fail-safe
- 2 -
processing apparatus supplies power not only to the associated calculation unit but
also to the other circuit portions other than the calculation units constituting the failsafe
processing apparatus, or has a different power supply capacity.
According to the present invention, even if a temporary voltage variation
occurs in a power supply, each calculation unit has a difference in timing affected by
the voltage variation, and hence the present invention can prevent each of the
calculation units from simultaneously outputting the same erroneous calculation
result.
BRIEF DESCRIPTION OF THE DRAWINGS
FIG. 1 is a configuration view illustrating a fail-safe processing apparatus
according to a first embodiment;
FIG. 2 is an equivalent circuit diagram simplified by replacing the circuits other
than the calculation units according to the first embodiment with resistor and
capacitor components;
FIG. 3 is a diagram illustrating voltage variation, clock, and evolution in time of
output data in each calculation unit at input voltage variation according to the first
embodiment;
FIG. 4 is a configuration view illustrating a fail-safe processing apparatus
according to a second embodiment; and
FIG. 5 is a configuration view illustrating a fail-safe processing apparatus
according to a third embodiment.
DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS
Hereinafter, first to third embodiments will be described in sequence as the
embodiments of the present invention.
[First Embodiment]
The first embodiment of the present invention will be described with reference
to FIGS. 1 to 3.
The first embodiment as a multiple-system fail-safe processing apparatus
basically has a dual-system configuration including two calculation units
simultaneously performing the same calculation and two power supplies having the
same capacity. FIG. 1 is a configuration view illustrating a fail-safe processing
apparatus 11 according to the first embodiment.
The fail-safe processing apparatus 11 is applied to a calculation unit requiring
fail-safe properties of output data. In order to ensure fail-safe properties, the
configuration illustrated in FIG. 1 includes two calculation units: a calculation unit
A(12) and a calculation unit B(13). Data outputted from the fail-safe processing
apparatus 11 is based on the data calculated by the calculation unit A(12) and the
calculation unit B(13).
The data outputted from the calculation unit A(12) and the calculation unit
B(13) is once held (temporarily stored) in a buffer 17 in an output control unit (16).
- 3 -
The calculation unit A(12) and the calculation unit B(13) mutually monitor each
other's output data to confirm that the mutual output data is equal to each other. If
the output data is equal to each other, the data stored in the buffer 17 in the output
control unit 16 is outputted by an instruction of the calculation unit A(12). If the
mutual output data is not equal to each other due to a problem of at least one of both
the output data, data is not outputted from the buffer 17. Note that the calculation
unit A(12) and the calculation unit B(13) have a function to send a reset signal to the
other party (paired system) to stop calculation, and reset the other side if a problem
occurs such that the mutual output data is not equal to each other.
There is a very low probability that both the calculation unit A(12) and
calculation unit B(13) fail at the same time, and hence such a method allows a
configuration of a fail-safe processing apparatus enabling fail-safe output.
However, if there are factors for the same failure occurring simultaneously in
both the calculation unit A(12) and the calculation unit B(13), there is also a risk of
outputting an erroneous signal from both the calculation units. Thus, although the
output data is mutually monitored, the calculation unit A(12) and the calculation unit
B(13) cannot detect the error and may output the erroneous signal to outside.
Therefore, as described above, the fail-safe processing apparatus needs to
eliminate the factors for the simultaneous occurrence of the same failure as much as
possible to sufficiently suppress the probability of outputting the erroneous signal to
outside.
Examples of the factors for the simultaneous occurrence of the same failure
include a power supply supplying power to the calculation unit A(12) and the
calculation unit B(13). When the calculation unit A(12) and the calculation unit B(13)
are powered from a common power supply, a temporary failure occurring in the
common power supply may cause the calculation unit A(12) and the calculation unit
B(13) to simultaneously output the same erroneous data.
In light of this, the calculation unit A(12) is powered from the power supply
A(14), and the calculation unit B(13) is powered from the power supply B(15).
There is a very low probability that both the power supply A(14) and the power supply
B(15) simultaneously generate a failure of the same type. Thus, the separation of
power supplies powering the calculation unit A(12) and the calculation unit B(13)
allows a reduction in probability that both the calculation units simultaneously
generate a failure of the same type.
However, if a voltage variation occurs simultaneously both in the power supply
A(14) and the power supply B(15) with the same magnitude of load for each power
supply (including the calculation unit A(12) and the calculation unit B(13)), a
temporary abnormal voltage of the same level is simultaneously outputted. This
may result in that the same abnormal condition may occur simultaneously in the
calculation unit A(12) and the calculation unit B(13). Even if each other's output
data is mutually monitored at this time, the calculation unit A(12) and the calculation
unit B(13) cannot detect the output data error and may output erroneous data to
outside.
- 4 -
In light of this, as illustrated in FIG. 1, the first embodiment devises the load
connected to each power supply to prevent the calculation unit A(12) and the
calculation unit B(13) from simultaneously outputting the same erroneous data even
if the power supply failure occurs. More specifically, the magnitude of load is
intentionally differentiated by allowing one of the power supply A(14) and the power
supply B(15) to supply power also to circuits (for example, the output control unit 16
and the other circuit 18) other than the calculation unit A(12) and the calculation unit
B(13).
For convenience of description, FIG. 2 illustrates an equivalent circuit diagram
simplified by replacing the circuits (the output control unit 16 and the other circuit 18)
other than the calculation unit A(12) and the calculation unit B(13) in FIG. 1 with
resistor and capacitor components.
FIG. 2(A) is an equivalent circuit of an A system circuit, in which an A system
power supply 20 corresponds to the power supply A(14) in FIG. 1. A resistor
component RA 22 of the load other than the calculation unit A(12) includes resistor
components of the substrate and circuits of the fail-safe processing apparatus 11. A
capacitor component CA 23 of the entire A system circuit includes a capacitor
component contained in the A system power supply 20 itself as well as the capacitor
components of the substrate and circuits of the fail-safe processing apparatus 11 to
which voltage is supplied from the A system power supply 20 other than the
calculation unit A(12). An input voltage applied to the calculation unit A(12)
corresponds to an input voltage ECPU_A24 of the A system calculation unit.
FIG. 2(B) is an equivalent circuit of a B system circuit, in which a B system
power supply 25 corresponds to the power supply B(15) in FIG. 1. A resistor
component RB 28 of the load other than the calculation unit B(13) includes resistor
components of the substrate and circuits of the fail-safe processing apparatus 11. A
capacitor component CB 28 of the entire B system circuit includes a capacitor
component contained in the B system power supply 26 itself as well as the capacitor
components of the substrate and circuits of the fail-safe processing apparatus 11 to
which voltage is supplied from the B system power supply 25 other than the
calculation unit B(13). An input voltage applied to the calculation unit B(13)
corresponds to an input voltage ECPU_B 29 of the B system calculation unit.
As illustrated in FIG. 1, the number of circuits connected to the power supply
A(14) of the A system is less than the number of circuits connected to the power
supply B(15) and the ICs for use in the output control unit 16 and the other circuit 18
are the load connected in parallel with the circuit. Thus, RA is greater than RB. FIG.
3 illustrates a relationship among the variations of the input voltage ECPU_A 24 of the
A system calculation unit and the input voltage ECPU_B 29 of the B system calculation
unit at the time of variation in the A system power supply voltage Ein_A 21 and the B
system power supply voltage Ein_B 26, clock, and output data.
The A system power supply voltage Ejn_A 21 and the B system power supply
voltage Ein_B 26 in FIG. 2 vary as illustrated by a power input variation 30 of a power
supply in FIG. 3. Thus, the input voltage ECPU_A 24 of the A system calculation unit
- 5 -
in FIG. 2 generates an input voltage variation 31 in the A system calculation unit in
FIG. 3. Likewise, the input voltage ECPU_B 29 of the B system calculation unit in FIG.
2 generates an input voltage variation 36 in the B system calculation unit in FIG. 3.
Here, the variation of the input voltage ECPU_A 24 of the A system calculation
unit and the input voltage ECPU_B 29 of the B system calculation unit at the point of
time when the power input variation 30 of the power supply occurs and the voltage
falls from Vi to V2, is expressed by the following equation.
ECPU_A = V2 x {1-exp(-t/RACA)} + Vi x exp(-t/RACA)
ECPU_B = V2 x {1-exp(-t/RBCB)} + Vi x exp(-t/RBCB)
In general, the calculation units are designed so as not to malfunction even if
about 10% of voltage variation occurs. Thus, it is assumed in FIG. 3 that an
operating lower limit threshold voltage 32 of the A system calculation unit and an
operating lower limit threshold voltage 37 of the B system calculation unit are 10% of
the rated voltage. It is also assumed that V2 is defined as a minimum value when
each input voltage of the A system calculation unit and the B system calculation unit
falls by the voltage variation, and the minimum value V2 is below the operating lower
limit threshold voltage 32 of the A system calculation unit and the operating lower
limit threshold voltage 37 of the B system calculation unit.
Assuming that a time AtA is defined as the time from when the power input
variation 30 falls until the voltage variation 31 in the A system calculation unit falls
below the operating lower limit threshold voltage 32 of the A system calculation unit,
and a time AtB is defined as the time from when the power input variation 30 falls until
the voltage variation 36 in the B system calculation unit falls below the operating
lower limit threshold voltage 37 of the B system calculation unit, the time can be
expressed by the following relational expression.
0.9 Vi = V2 x {1-exp(-AtA/RACA)} + Vi x exp(-AtA/RACA)
0.9 Vi = V2 x {1-exp(-AtB/RBCB)} + Vi x exp(-AtB/RBCB)
From the above relational expression, the time AtA and the time AtBcan be
obtained as follows.
AU = -RACAln{(0.9Vi-V2)/(Vi-V2)}
AtB = -RBCBln{(0.9Vi-V2)/(Vi-V2)}
Assuming also that f[Hz] is defined as the frequency of operating clocks 33
and 38 of respective calculation units of the A system and the B system, the length of
one bit of data is 1/f[s]. In order to generate one or more bits of difference between
a start bit of erroneous output data 35 of the output data 34 in the A system
calculation unit and a start bit of erroneous output data 40 of the output data 39 in the
B system calculation unit, the following the conditional expression needs to be
satisfied.
AtB -AtA = -RBCBln{(0.9Vi-V2)/(Vi-V2)} + RACAln{(0.9VrV2)/(Vi-V2)} > 1/f
From the above conditional expression, the respective resistor components
and capacitor components of the A system and the B system circuit (load other than
the respective calculation units of the A system and the B system) may be designed
so as to satisfy the following relational expression.
- 6 -
RACA - RBCB > 1/[f x ln{(0.9Vi-V2)/(Vi-V2)}]
In order to reliably achieve the above relational expression, a comparable load
to the calculation unit A(12) and the calculation unit B(13) may be connected to any
one of the power supplies (the power supply A(14) or the power supply B(15) in FIG.
1).
In the fail-safe processing apparatus 11 illustrated in FIG. 1, the calculation
unit A(12) and the calculation unit B(13) perform the same calculation. Then, the
output control unit 17 checks whether or not at least one of the output data 34 from
the calculation unit A(12) and the output data 39 from the calculation unit B(13)
contains an error. Then, as illustrated in FIG. 4, if there is even one bit of difference
between the output data 34 of the A system calculation unit and the output data 39 of
the B system calculation unit when a variation of the input voltage from the power
supply occurs, an error of the output data can be detected since the calculation unit
A(12) and the calculation unit B(13) mutually monitor each other's output.
This makes it possible to provide a fail-safe processing apparatus in which the
output control unit 16 can prevent erroneous output of data from the calculation unit
A(12) and the calculation unit B(13).
[Second Embodiment]
A second embodiment of the present invention differentiates the power supply
capacity among the power supply units supplying power to each calculation unit
constituting the fail-safe processing apparatus. FIG. 4 is a view illustrating a
configuration as the second embodiment in which in a dual-system fail-safe
processing apparatus (FIG. 1), the power supply units have a different power supply
capacity from each other.
For example, the power supply B(45) has a larger power supply capacity than
that of the power supply A(14). Thus, even if a voltage variation occurs
simultaneously in the power supply A(14) and the power supply B(45), the difference
in the power supply capacity can prevent the calculation unit A(12) and the
calculation unit B(13) from simultaneously outputting the same erroneous data.
[Third Embodiment]
A third embodiment of the present invention applies a triple-system as a
multiple-system fail-safe processing apparatus. FIG. 5 is a configuration view
illustrating a triple-system fail-safe processing apparatus that adds a power supply
C(54) and a calculation unit C(52). The calculation unit C(52) performs the same
calculation as the calculation unit A(12) and the calculation unit B(13) at the same
time. In addition, the calculation unit A(12), the calculation unit B(13), and the
calculation unit C(52) have a function to mutually monitor each other's output and
reset the paired system.
In the configuration illustrated in FIG. 5, the power supply C(54) supplies
power not only to the calculation unit C(52) but also the output control unit 16 and the
other circuit 18. This configuration differentiates the load between the load when
- 7 -
the power supply A(14) and the power supply B(15) supply power to the calculation
unit A(12) and the calculation unit B(13) respectively and the load when the power
supply C(54) supplies power. It is apparent that instead of the power supply C(54),
the power supply A(14) or the power supply B(15) may be configured to supply
power to the output control unit 16 and the other circuit 18.
Therefore, even if a voltage variation occurs simultaneously in all the three
power supplies, this configuration can prevent the calculation unit A(12), the
calculation unit B(13), and the calculation unit C(52) from simultaneously outputting
the same erroneous data.

What is claimed is:
1. A fail-safe processing apparatus comprising:
a plurality of calculation units having a function to simultaneously perform the
same calculation and mutually monitor output data;
an output control unit having a function to temporarily store the output data for
each of the calculation units and output the stored output data for each of the
calculation units according to an instruction from one of the plurality of calculation
units to outside; and
a plurality of power supplies provided for each of the calculation units, wherein
one of the plurality of power supplies supplies power not only to the associated
calculation unit but also to the output control unit.
2. The fail-safe processing apparatus according to claim 1, wherein
at least one of the plurality of power supplies has a different power supply
capacity from that of the other power supplies.
3. The fail-safe processing apparatus according to claim 1 or 2, wherein
if the mutually monitored output data is matched, one of the plurality of
calculation units issues the instruction to the output control unit.
4. The fail-safe processing apparatus according to any one of claims 1 to 3,
wherein
each of the plurality of calculation units has a function to send a reset signal to
the other of the plurality of calculation units.
5. The fail-safe processing apparatus according to claim 4, wherein
if the mutually monitored output data is unmatched, each of the plurality of
calculation units sends the reset signal.
6. The fail-safe processing apparatus according to claim 4 or 5, wherein
when the reset signal is received, each of the plurality of calculation units stops
its own calculation.