US 4,520,482 AGrant
Safety Controller
Issue Date:1985-05-28
•4 Claims
•4 Drawing Sheets
Abstract
A safety controller comprises a comparator and two identical subcontrollers operating on the same input signals. The comparator provides error detection by comparing the outputs of the two subcontrollers. Each subcontroller includes combinational devices and memory registers for providing exhaustive testing of the registers and of the truth tables of the combinational devices of each of the subcontrollers. Controllers of the present invention are particularly useful as railway safety devices.
Metadata
Assignee
- Societe d'Etudes Et Conseils A E R O
Inventors
- Remy Fourre
- Bruno de Langre
Application Information
Application Number:US 4166205
Filing Date:1982-09-10
Priority Date:1981-09-14
Art Unit:236
Classifications
IPC:
G06F 1116
Field of Search:
37136468;25184;187
Patent Drawings (4 sheets)
Description
The present invention relates to a process for designing logic and digital "safety" controllers comprising a system for detecting errors by means of comparison between two identical sub-controllers operating on the same input signals. It also relates to a controller built in accordance with the process. More precisely, the invention consists of a layout of combinational devices and of memory registers for each of the sub-controllers that allows exhaustive testing of the registers and of the truth tables of the combinational devices of each of the sub-controllers.
For better comprehension of the invention, a few definitions should first be given:
Fault (state of): a definitive modification of a component that prevents it from performing completely its normal function. A fault of a combinational circuit leads to a modification of its truth table.
Single fault: the occurrence of one fault on one physical component of the safety controller (for example, a register or a combinational device designed as a PROM).
Sequential fault: a fault of a combinational device or of a register by which its output signals become combinational functions of several successive input signals. An application of the invention which is the subject of this application will apply to detection of sequential faults that introduce dependency on two successive inputs.
Latent fault: a fault that has ot yet caused an error, that is, an abnormal binary state of an output line of the component as fault.
"Safety": said of a device in which every error can be detected, or is not dangerous for the system controlled.
"Dynamization" of a component: the act of causing to be described all the possible binary states at the input wires of a component in order to explore its whole truth table. A "safety" controller detects the presence of an error by comparison of the output of two sub-controllers. Detection is therefore only possible if the two sub-controllers do not commit the same error simultaneously.
However, if the fault of a sub-controller remains latent for some time, the probability that the second sub-controller may be affected by the same fault causing the same error cannot be neglected.
Consequently, the truth tables of the logic circuits must be checked by systematically imposing on them all the possible input signals in order to cause rapid appearance of the modifications of the truth tables.
The object of this invention is therefore a process that periodically causes the combinational devices and registers of a sub-controller to operate on batches of test bits that systematically describe all the logic states of their inputs. For this reason, each of the sub-controllers has a looped structure, consisting of several blocks of registers and of one or more blocks of combinational devices, such that each block of combinational devices only operates on one block of registers or of combinational devices and that each block of registers is only fed from one block of registers or of combinational devices.
The registers and combinational devices are controlled by the same clock signal which therefore causes shifting of the contents of the blocks of registers, it being possible to modify the contents when one or more blocks of combinational devices are inserted between two successive blocks of registers. One or more input devices moreover provide for selecting, on certain input wires of certain bllocks of registers or combinational devices, between the signal from the preceding block and an outside signal on which the sub-controller must operate.
Because the sets of bits contained in the register blocks are separated, in accordance with the looped structure of the sub-controller, the input devices may be synchronized so that one or more sets of bits circulate in the loop without ever being modified by the input devices. These bits are called "test bits".
The functions provided by the combinational devices and the links between combinational devices and registers are selected so that it is possible, firstly, to carry out the desired sequential function on the input signals and, secondly, to "dynamize" each combinational device and each register by the successive states of the test bits.
Initially, the test bits are identical on the two subcontrollers, and they remain identical as long as none of the subcontrollers incurs any fault.
A comparator facility is placed between the two sub-controllers. This comparator facility receives the input signals of the combinational devices as well as, possibly, the signals taken at the input of certain blocks of registers, and detects any error caused by a single fault of one of the sub-controllers, either in the process bits, or during a dynamization step, by the test bits of the faulty component.
Several forms of application of the invention are described below as examples and refer to the appended drawings in which:
FIG. 1 illustrates schematically the principle of the invention applied to two blocks of registers and to one block of combinational devices;
FIG. 2 illustrates an application of the invention to a digital filter;
FIG. 3 illustrates the principle of the invention applied to three blocks of registers in order to detect sequential faults of order 2; and
FIG. 4 illustrates the principle of the invention applied to only one combinational device and two registers.
FIG. 1 illustrates the principle of the invention applied to a sub-controller consisting of two blocks, BRA and BRB, with N registers each, one block BDC with N combinational devices DCI . . . DCN, in parallel, and input and output devices DE and DS, respectively provided with an input EO and an output SO. Of course, the complete safety controller comprises a second sub-controller identical to that illustrated here.
The sets of output wires S1 . . . SN of the combinational devices DC1 . . . DCN are mixed to form sets of input wires, respectively S'1 . . . S'N of registers RA1 . . . RAN of the first block. S1 and S'1, S2 and S'2 , . . . SN and S'N have the same number of wires respectively.
The sets of wires E1 . . . EN transmit the respective contents of registers RA1 . . . RAN of BRA to registers RB1 . . . RBN of BRB. Input devices DE provides selection, on certain wires, of sets E1 . . . EN, between the signal from BRA and an outside signal applied to input EO and constituting an input of the process. Output device DS is designed for reading at SO of those wires of sets E1 . . . EN that carry the process results.
Sets of wires E'1 to E'N transmit to DC1 . . . DCN the respective contents of registers RB1 . . . RBN.
Sets of E'1 . . . E'N also lead to a device which is not illustrated and that compares the signals of the two sub-controllers, by means of set of wires C1 . . . CN.
The sub-controller, in accordance with the invention, therefore forms a loop in which the combinational devices DC1 . . . DCN, which may be different from each other, execute invariable logic operations on two separate sets of bits. The contents of BRA and BRB are never combined.
This property is used to cause the registers and the combinational devices to operate alternately on the process bits and the test bits. During one clock cycle, either BRA contains a set of batches of process bits and BRB a set of batches of test bits, or BRA contains a set of batches of test bits and BRB a set of batches of process bits, and the contents of BRA and BRB shift from one cycle to the other.
When BRA contains process bits, certain of them are read and/or modified at DS and DE, and the batches are loaded in BRB, while the test bits contained in BRB are loaded in DC1 . . . DCN and the results loaded in BRA.
Devices DE and DS operate during one clock cycle of two, when BRA contains process bits.
Devices DC1 . . . DCN and register blocks BRA and BRB thus operate alternatively on batches of test bits internal to the sub-controller and on batches of process bits that come partially from the outside through input EO of DE.
Reading of E'1 . . . E'N by the comparison device provides detection by comparison with the other sub-controller of any combinational error in a combinational device of BDC, any error in a register of BRA and BRB and any erroneous or unsynchronized writing in DE, provided that the other sub-controller is not faulty.
The separation of the batches of bits between the cascades (RA1, RBI, DCI) . . . (RA2, RB2, DC2), . . . (RAN, RBN, DCN) is a preferential method of implementing the invention that provides a means of improving the simplicity and the safety of the comparison device by minimizing the number of batches affected by the fault of a component.
The breakdown of the logic function into several sub-functions distributed between DC1 . . . DCN and the transfers between combinational devices by recombination of wires between S1 . . . SN to form S'1 . . . S'N, enable very complex calculations to be performed very rapidly (for example, real-time digital filtering).
Judicious choice of the recombination of wires of S1 . . . SN enables the graphs (E'1) .times. (S'1) . . . (E'N) .times. (S'N) to be rendered bijective, although graphs (E'1) .times. (S1) . . . (E'N) .times. (SN) are generally subjective.
This bijectivity is necessary so that the batches of test bits can successively describe all the logic states of the inputs of the registers and of the combinational devices.
This advantageous choice of devices DC1 . . . DCN and of wire combinations makes use of calculation methods based on Petri networks.
FIG. 2 illustrates an example of a practical application of the invention to a 2,000 Hz frequency modulation filter, that can be used for example in railway safety techniques.
The controller receives a signal at 1,990 Hz or 2,010 Hz, samples at 500 kHz, at its input EO.
Signal EO is considered as being 1,990 Hz when the controller counts 251 or 252 measurements during the interval between two consecutive rising fronts and as 2,010 Hz when the controller counts 248 or 249 measurements during the interval between two consecutive rising fronts.
Outut SO turns to a high lvel after three intervals consecutive to 251 or 252 measurements and to a low level after three intervals consecutive to 248 or 249 measurements. SO remains set at its last value in all other cases.
Each of the two sub-controllers consists of two blocks of 6 8-bit registers, BRA and BRB, and of a block of 6 8-bit combinational devices, BDC. Each combinational device may be, for example, a 256--8 bit word read-only memory. The 8 bit output is read in the memory at the address equal to the 8 bit input. Typical values of the contents of the six read-only memories used in the present example are listed in hexadecimal form in table No. 1 below. One register of BRA is read by one only register of BRB and one register of BRB is read by one only combinational device of BDC.
There are therefore 6 modules formed of two registers and one combinational device.
Each module (i) has 8 incoming lines (inputs of RA (i)) and 8 outgoing lines (outputs of DC (i)).
The five output lines of DC (i) of low order are reinjected into the five lines of low order at the input of the same module at RA (i).
The three output lines of DC (i) of high order are injected into the three high-order lines at the input of the following module at RA (i+1).
The six modules are laid out in ring form which means that the three high-order outputs of DC6 are reinjected into the three high-order inputs of RA1.
EO is recopied by DE on the low-order line at the input of RB1 when BRA contains process bits that are read by BRB.
SO is read by DS on the low-order line of the sixth module when BRA contains process bits which are read by BRB.
The initial 8 bit values to be loaded in the block of registers that initially contain the process bits are: 01, 00, 00, 00, 04, 00
The initial 8 bit values to be loaded into the block of registers that initially contain the test bits are, for example: 40, 8A, 2C, 99, 64, 96
The successive 8 bit values taken by the test bits in each of the 6 modules are listed in table No. 2 below. Each modules has 256 possible values, which test the components.
A method of comparison which is not illustrated applies to the 6 batches of 8 bits taken at C1 to C6 in the two sub-controllers. The structure in the form of separate modules enables 11 batches to be made up, from the 6 batches, each containing one erroneous bit at most, which facilitates the construction of a safety comparator device that makes use of a coding system based on parity of batches.
Table 3 below illustrates the bits that constitute these 11 batches.
This example shows that it is effectively possible to determine the combinational functions having the properties used by the invention in the case of a process of a certain complexity.
FIG. 3 illustrates an example of an application that consists of three blocks of registers and of one block of combinational devices.
At the start of each clock timing pulse, two of the blocks of registers contain test bits and these test bits therefore form two sets that are totally separate passing through loop BRA-BRB-BRC-BDC-BRA, the third set consisting of process bits.
Input device DC only allows input of data during one clock pulse out of three, when BRA contains process bits.
An advantageous property resides in the ability ot perform a test of sequential faults of registers and combinational devices. The combinational functions and the likes between BDC and BRA are selected so as to allow each of the sets of test bits to dynamize the registers and combinational devices, one of the dynamizations being partially redundant so that the respective clock pulse numbers P1 and P2 of these dynamizations are incommensurable numbers.
The successions of binary values taken by the two sets of test bits thus cover all the possible successions of two binary batches for each register and combinational device in at most PI.times.P2 process clock pulses.
FIG. 4 illustrates another application of the invention consisting of one only combinational device N and two registers RA and RB.
It is not possible, in this case, to render the graph (E').times.(S') bijective by crossing the wires of S.
A correction device CG is used in this case, designed to oblige certain wires of S to render the graph (E').times.(S') bijective, still in the same way. The method of Petri networks provides a means of determining these wires as long as the combinational function is not excessively surjective.
CG is synchronized with the passage of the batch of test bits and dots not modify it.
It moreover goes without saying that the invention is not limited to the methods of realization illustrated and described and that a number of modifications may be made to it without leaving the scope of the present invention.
Claims
We claim:
1. A controller of the type including a pair of sub-controllers and a comparator facility operating on outputs from the two subcontrollers, said controller comprising, in combination: (I) a pair of said subcontrollers, each of said sub-controllers being identical when containing no faults and comprising: (1) at least two blocks of parallel registers; (2) at least one block of parallel combinational units for providing predetermined operations on signals transmitted to the inputs of said combinational units; (3) an output device for providing an output signal; (4) an input device, (a) having an input for receiving an input signal to said subcontroller and (b) coupled between the output of one of said blocks and devices and the input of another one of said blocks and devices, for selectively transmitting (i) the signal as received from said output of said one of said blocks and devices, unmodified by said input signal, to said input of said another one of said blocks and devices, and (ii) the signal received from said output of said one of said blocks and devices, modified by said input signal, to said input of said another one of said blocks and devices; wherein (a) said blocks and devices of said subcontroller are coupled to one another so that the output of each of said blocks and devices is coupled in series to the input of another of said blocks and devices so as to form a shifting loop, (b) at least one set of test bits moves cyclically through said shifting loop, without being modified by said input signals, the values of the test bits being modified only by said combinational units, (c) said test bits dynamize all of said registers and combinational units successively and cyclically through a testing cycle so as to provide every possible logic value at the respective inputs of said registers and units and output signals from said output device such that a no-fault condition of said sub-controllers is indicated when output signals of said two sub-controllers are identical during a testing cycle; and (II) comparator means for comparing said output signals from said subcontrollers so as to detect differences in said output signals representative of faults in one of said subcontrollers.
2. A controller according to claim 1, wherein said first and second blocks of registers, said block of combinational units and said input device are coupled to one another so that said input device alternately transmits (i) the signal received from said output of said one of said blocks and device, unmodified by said input signal and (ii) the signal received from said output of said one of said blocks and devices, modified by said input signal, so as to alternately transmit to said combinational units test bits and process bits.
3. A controller according to claim 2, wherein each of said subcontrollers include a correction device coupled to said block of combination units for forcing certain output bits from said combinational units when the latter receives said test bits so as to render the output function of said combination units bijective.
4. A controller according to claim 1, wherein each of said subcontrollers includes a third block of parallel registers, said third block being coupled to said first and second blocks of registers, said block of combinational units, said input device and said output device so as to form a part of said shifting loop, said blocks and devices being coupled in series to one another so that said input device successively transmits, (i) the signal received from said output of said one of said blocks and devices, modified by said input signal, (ii) the signal received from said output of said one of said blocks and devices, unmodified by said input signals, and (iii) the signal received from said output of said one of said blocks and devices unmodified by said input signal, so as to successively transmit to said combinational unit a set of process bits, a set of test bits and a second set of test bits, the respective numbers of clock pulses for one complete dynamication cycle for each of said sets of test bits being incommensurable numbers so that said combinational unit successively receives every sequential combination of two logical states of the said two sets of test bits.