Method for Ensuring Safe Operation of a Programmable Automatic Control Device and Automatic Control Device for Carrying Out the Said Method

The present invention relates to a method for ensuring safe or reliable operation of a programmable automatic control device intended to control a user device such as a machine or a plant and an automatic control device for carrying out the said method.

There are already known programmable automatic control devices which are so designed that a simple failure of any component thereof places the outputs of the automatic control device into a predetermined state. However, the known automatic control devices of this type are designed in the form of a system redundant in space, i.e., in the form of a duplicated system. They suffer from the major disadvantage of being expensive and difficult to use and to program.

The present invention has as its purpose to provide to the problem relating to the programmable automatic control devices a solution which allows fulfilling the same safety or reliability functions as the known automatic control devices, but at a lower cost.

To achieve this purpose, the present invention provides a method for ensuring safe or reliable operation of a programmable automatic control device, which is characterized in that, for a same given state of the inputs of the automatic control device, a same processing unit such as a microprocessor is caused to execute the same program successively twice by using every time another bus, and use is made as a criterion of correct operation of the automatic control device the identity of the two signals resulting from the two successive executions of the program.

According to an advantageous feature of the invention, there is produced from the two signals resulting from the two successive executions of the program a control signal for the user device, the polarity of which changes at the rate of the two signals or remains constant depending on whether the signals are identical or different, the said difference being indicative of a failure in the operation of the automatic control device.

According to another advantageous feature of the invention, the said program includes a test program portion and a user program portion.

According to the method of the invention, there is performed in the test program portion a test of the microprocessor by running a test program using all the instructions of the user program, a test of the inputs of the automatic control device including a check on the inputs which are not activated in the absence of an external signal, a test of the internal variables including a check on all such variables, preferably by reversing them twice, and an internal software for the system such as the delays-counters program.

According to another advantageous feature of the invention, provision is made, in case of defective operation of the automatic control device, for stopping the polling of its inputs, the placing of its imputs into the "O" state and, if appropriate, an alarm.

The automatic control device according to the present invention, for carrying out the said method, comprises a single processing unit such as a microprocessor, two alternately switchable buses, two demultiplexers, each associated with a bus, a device for generating an output signal of the automatic control device, having two states indicative of correct operation of the automatic control device and of defective operation thereof, respectively.

According to an advantageous feature of the invention, the generating device includes a bistable device such as a flip-flop with two inputs each connected to an output of a demultiplexer and capable of producing at its output an a.c. or a d.c. signal depending on whether the output signals applied successively to their inputs are of the same binary state or different from one another.

According to another feature of the invention, the program storage is divided into two zones, i.e., a test zone and a user zone.

According to still another advantageous feature of the invention, the automatic control device includes a preferably wired decoder for calibrating the processing unit, which is connected to the test outputs of this unit.

According to the present invention, the input multiplexer device may be provided with alternately polled double inputs or simple inputs which are adapted to be supplied with power by the outputs of the automatic control device.

According to an advantageous feature of the invention, the data storage device includes two data storages used alternately.

It is also advantageous to use in the device for generating the output signal of the automatic control device a transformer whose primary winding is connected to the two-input bistable device, the said transformer producing at the output of its secondary winding a "O. " state when the two input signals of the bistable device are different from one another.

For a fuller understanding of the invention, reference is had to the following description, taken in connection with the accompanying drawings, in which:

FIG. 1 is a block diagram of an embodiment of the safety automatic control device of the invention; and

FIG. 2 is a block diagram illustrating the operating principle of the automatic control device of the invention.

FIG. 1 shows by way of example a programmable automatic control device according to the present invention, which comprises essentially a processing unit consisting of a microprocessor P with which are associated, as shown, a program storage MP, a program counter CP, two address buses BA1 and BA2, a data bus BD, an address bus switch CBA, an input multiplexer device ME and an output demultiplexer device DMS, as well as a data storage device MD. Furthermore, the microprocessor includes a wired decoder DC connected to test outputs ST of the microprocessor, represented in the form of a separate block.

As seen in FIG. 1, the output demultiplexer device DMS includes two demultiplexers DMS1, DMS2 connected on the one hand to the data bus BD and, on the other hand, to the address buses BA1 and BA2, respectively. Each of the demultiplexers DMS1, DMS2 includes a certain number of parallel outputs designated respectively by S1 . . . Sn and S1' . . . Sn'. The corresponding outputs of the two demultiplexers are connected, as shown in FIG. 1 for the outputs S1, S1', to two inputs of a bistable device such as a flip-flop BS. The output of the flip-flip BS is connected through a band-pass filter FI to the primary winding of a transformer TR whose secondary winding circuit includes two relays R1,R2 which, through a contact C1,C2, respectively, ensure the closing or the opening of a circuit (not shown) for the supply of the user system with electric power.

As regards the input demultiplexer device ME, it is seen that FIG. 1 illustrates two variants of embodiment, one with double inputs illustrated in full lines and a second variant with a simple input shown in interrupted lines. In the first form of embodiment, there are provided two input multiplexers ME1,ME2 with inputs E1 . . . En and E1' . . . En'. As shown in FIG. 1 for the corresponding inputs E1,E1', a coincidence detector DCO is associated with each pair of inputs. The double inputs, such as the inputs E1,E1', are adapted to be polled alternately. In the second form of embodiment, the simple inputs may be supplied with power from the outputs SA1 . . . SAn of an output device DSA of the microprocessor. To this end, the device DSA is connected, on the one hand, to the address buses BA1, BA2 and, on the other hand, to the data bus BD. The connection between the various outputs SA1 . . . SAn and the simple inputs E1 . . . En may be effected by means of a set of contacts, of which only the contact CA1 is shown.

As regards the program storage MP, it should be noted that it is divided into two zones, i.e., a TEST zone and a USER zone. As for the program counter CP, it is so arranged as to be able to address the storage MP and act upon the switch of the address buses CBA to accomplish independently of the program the switching of the buses BA1,BA2 under the action of a clock signal provided by the microprocessor P. The latter may be a microprocessor in groups of 4 bits microprogrammed for a question of speed and/or, if appropriate, a 1-bit microprocessor.

To complete the description of FIG. 1, it is seen that the block ST of test outputs of the microprocessor is connected to the address buses BA1,BA2 and to the data bus BD. A certain number of alarm-signalling devices are provided, such as the devices AL1 and AL2 associated with the coincidence device DCO and with the wired decoder DC, respectively. With each input of the multiplexer E1 . . . En; E1' . . . En' is associated a sensing device, of which only the sensing devices DE1 and DE1' are shown.

The description of the automatic control device illustrated in FIG. 1 allows understanding the operating principle of a security control device according to the present invention, which is illustrated in FIG. 2.

The principal consists in executing, for a same data state of the inputs of the automatic control device, by a same processing unit, i.e., the microprocessor P, the same program twice successively by using alternately two buses, i.e., the buses BA1, BA2.

As seen in FIG. 2, the program is divided into two portions;

a user portion PRU programmed by the user of the automatic control device using the conventional language of the automatic control devices (booleangrafcet);

a test portion PRT. In this portion run in each execution of the program, i.e. in each polling of the inputs, the following tests are carried out:

a. A test of the microprocessor is performed. To this end, a typical program is run using all the instructions from the microprocessor and delivering a series of for example eight outputs (test output block ST). These outputs must assume predetermined values which are checked by a wired decoder, i.e., the decoder DC;

b. A test of the inputs is performed. It is verified that the inputs are not activated in the absence of an external signal. This external signal is applied in principal by an output SA1 . . . SAn of the automatic control device;

c. A test of the internal variables is performed. All of these all checked. Preferably, they are reversed twice;

d. The internal software of the system, such as the delays-counters program, is performed.

On the first execution of the program including the TEST and USER programs PRT and PRU, after polling the input sensors CE1 . . . CEn, use is made for example of the bus BA1. At the end of the first execution of the program, the automatic control device produces an output pulse which the demultiplexer DMS1 transmits to the corresponding output of the flip-flop BS and a change of bus is caused to take place by means of the program counter CP. Also placed into the zero state are the wired decoder DC and the supplies of the input sensors in case the input multiplexer ME is of the type with simple inputs. The second execution of the program or polling then starts, addressing the same inputs in the case of an input multiplexer with simple inputs or the input sensors CE1' . . . CEn' in the case of double inputs. Use is now made of the bus BA2 and the output demultiplexer DMS2. At the end of this second execution of the program, the automatic control device again produces an output impulse which the demultiplexer DMS2 applies to the other input of the flip-flop BS. If this second pulse is identical with the first one, i.e. is in the same binary state, the position of the flip-flop BS is reversed. In the contrary case, i.e., if the state of the second pulse is different from that of the first pulse, the flip-flop retains its position. Consequently, if the flip-flop delivers an alternating signal at half the frequency of the executions of the program or of the pollings, the automatic control device operates correctly. This signal passes through the filter FI or directly to the transformer TR and energizes the coils of the two relays R1,R2 connected in series or in parallel in the secondary circuit of the transformer. On the other hand, any failure at one of the two chains used during the execution of the program causes the flip-flop to assume the "0" or "1" state. Under such conditions, the transformer cannot transmit power to the relays. Otherwise stated, the transformer stops the information and an alarm is produced. It is seen that the outputs of the automatic control device are then in a predetermined state.

It should also be noted that for a programmable automatic control device with 40 inputs/outputs, the running of the TEST program and of the USER program takes place every time in 5 milliseconds. The output frequency is therefore 50 fixed cycles. Owing to the execution of each program within such a short time, the successive polling for a given state of the inputs of the automatic control device is feasible without being prejudicial to the user device. The latter may be any machine or plant where the safety of the personnel and of the equipment must be ensured. By way of example, mention may be made of power plants, presses, shearing machines, transport systems or the like.

It appears from the foregoing that the automatic control device of the invention has a simple structure and is inexpensive due to the use of both a spacial redundancy and a redundancy in time, i.e., a "dynamic" redundancy. The function of the band pass filter FI is to discard any information of a frequency differing from a polling frequency or of a whole multiple thereof.