Monitoring Circuit for a Multiprocessor Means of an Apparatus or of a System

German Published Application 37 06 325, incorporated herein, discloses a control and data network that contains a master computer which transmits data to connector modules from which it can also receive information. Every connector module has a processor to which this data is supplied, which processes this data on the basis of a program, and which correspondingly drives an electrical means, for example a motor. The individual connector modules can be brought into an emergency stop condition by the master computer, so that the electrical devices can be brought to a standstill or into a desired condition when malfunctions or safety problems occur. Every connector module comprises a monitoring circuit responsible for this connector module that, given a faulty operation of the processor, resets it into an initial condition and informs the master computer thereof. Such a control and data network is extremely involved; moreover, there is no monitoring of the function and functionability of the electrical devices.

The invention is directed to a monitoring circuit for a multiprocessor means that is utilized in apparatus or systems in order to undertake safety-relevant or reliability-relevant monitorings. For example, the operating condition and the faultless functioning of function elements such as final control elements and generators are monitored. A reliable working of the processors is only guaranteed when all processors participating in a communication are in an identical status at a specific point in time. An appropriate monitoring is extremely involved and is undertaken such that at least two of the processors mutually monitor one another.

An object of the invention is to provide a monitoring circuit for a multiprocessor means such that this monitoring circuit is uncomplicated, given at least a same monitoring reliability.

This object is inventively achieved by a monitoring circuit for a multiprocessor means of an apparatus or of a system, whereby the apparatus or the system comprises at least one function element. At least one processor assumes a reliability-relevant monitoring of the function element, and wherein the processor produces a malfunction signal at an output given the occurrence of a malfunction of the function element. The monitoring circuit responds to the malfunction signal, and at least the function element is switched into a quiescent condition, and all processors are switched into the same condition.

An advantage of the invention is that the monitoring circuit monitors the occurrence of a malfunction signal of the existing processors. The circuit-oriented expense is low since the processors need not mutually monitor one another. Given the occurrence of a malfunction signal, at least the one function element is placed into a quiescent condition and all processors are placed into an identical condition. As a result thereof, thus a reliable working of the devices and systems is produced.

Upon occurrence of the malfunction signal, it is especially advantageous when a first signal for effecting the highest-priority interrupt and a second signal for effecting the hardware resets of all processors is generated.

An especially simple structure results when the malfunction signal switches a switch in a supervisory circuit of the monitoring circuit via a second condition for generating the first signal into the original condition for generating the second signal.

A monitoring circuit is especially insensitive to disturbance when the supervisory circuit is executed as a quiescent current circuit and whereby the malfunction signal opens a switch and the first signal is thus generated. The switch is closed for generating the second signal.

In a further development, a current monitoring circuit is advantageously provided, whereby the current monitoring circuit generates the first signal given an interruption in the current, and a subsequent detection of current generates the second signal. The sensitivity of the monitoring circuit to a disturbance is reduced since an active monitoring is thereby involved.

The monitoring circuit is employed with particular advantage when the processors monitor reliability-relevant or safety-relevant functions in a medical apparatus. Especially high demands are thus made of the reliability of the monitoring.

The drawing FIGURE illustrates schematically a monitoring circuit according to the invention which monitors reliability and/or safety functions.

The Drawing FIGURE shows a monitoring circuit of a multiprocessor means as utilized, for example, in apparatus and systems for monitoring reliability-relevant or safety-relevant functions. The illustrated monitoring circuit comprises a constant current source 1 and a constant current circuit 2. A first switch 3 of a relay 4, the relay 4, first, second and third current-monitoring circuits 5, 6, 7, and first, second, and third switches 8, 9, 10 are connected in series in this constant current circuit 2. The switch 8 can be driven by a malfunction signal of a first processor 11. The second switch 9 can be driven by a malfunction signal of a second processor 12. The third switch 10 can be driven by a malfunction signal of a third processor 13. The processors 11, 12, 13 monitor the function of function elements of the apparatus or of the system such as, for example, of a motor 14 as a final control element, of an x-ray tube 15 as a radiation generator, as well as of a control/regulating means 16. The monitoring is both for functionability as well as whether the predetermined function is satisfied.

When, for example, the processor 11 that monitors the motor 14 identifies a malfunction of the motor 14, then this processor 11 generates a malfunction signal at an output, so that the switch 8 is driven and is opened in the exemplary embodiment. The constant current circuit 2 is thus interrupted, the relay 4 being switched as a result thereof. The switch 3 of the relay 4, and a further switch 17 of the relay 4 that is inserted into a safety or alarm circuit 18 with a supply unit 19 of the function elements, is thus opened. Thus, at least the motor 14 and, in the exemplary embodiment, the x-ray tube 15 as well as the control/regulating means 16 are switched into a quiescent condition. Of course, other function elements that are not shown can also be switched into the quiescent condition. The interruption of the constant current circuit 2 is detected by the current-monitoring circuits 5, 6, 7 which, in response thereto, generate a first signal 23 at their outputs 20, 21, 22 that effects the highest priority interrupt of all processors 11, 12, 13. A second signal 24 that is likewise generated by the current-monitoring circuits 5, 6, 7 due to the closing of the switches 8, 9, 10, effects a hardware reset of all processors 11, 12, 13. Given the occurrence of a malfunction, the function elements are switched into a quiescent condition and the processors 11, 12, 13 are switched into an identical condition. A forced synchronization thus occurs which guarantees a reliable operation of, for example, medical equipment. In the exemplary embodiment, the processor 12 monitors the x-ray tube 15 and the processor 13 monitors the control/regulating means 16. Given the occurrence of a malfunction of the x-ray tube 15 and/or of the control/regulating means 16, the above-described forced synchronization is likewise produced.

When operation is to be resumed, then a reset switch 25 which is connected parallel to the first switch 3 of the relay 4 is to be actuated. This can occur, for example, on the basis of a hardware command or of a software command that is triggered by the operator. The relay 4 is switched, so that the switch 3 and the switch 17 are closed. The monitoring circuit is thus active and the function elements assume their function.

Of course, it is also possible within the framework of the invention to provide only one current-monitoring circuit and one switch that are driven, given the occurrence of a malfunction signal of at least one processor. In an especially simple embodiment, only the malfunction signal at the output of the processors can also be monitored. Given the occurrence of a malfunction signal, the highest priority interrupt and the "hardware reset" of all processors, as well as the switching of the function elements into the quiescent condition, are then effected.

Although various minor changes and modifications might be proposed by those skilled in the art, it will be understood that we wish to include within the claims of the patent warranted hereon all such changes and modifications as reasonably come within our contribution to the art.