Controller having a fail safe function, automatic train controller and system using the same

• US 5,805,797 A
• Filed: 12/28/1995
• Issued: 09/08/1998
• Est. Priority Date: 12/28/1994
• Status: Expired due to Term

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Sato, Hiroshi, Nohmi, Makoto, Kanekawa, Nobuyasu, Tashiro, Korefumi
• Primary Examiner(s): Decady, Albert
• Application Number:
  US08/580,336
• Time in Patent Office: 985 Days
• Field of Search: 395/180, 395/182.01, 395/182.08, 395/182.09, 395/185.01, 395/185.02, 364/228.3, 364/229, 364/229.3, 371/37.7, 371/67.1, 371/68.1, 371/48
• US Class Current: 714/48
• CPC Class Codes: B61L 15/0062 On-board target speed calculation or supervision
• CPC Class Codes: B61L 15/0063 Multiple on-board control systems, e.g. "2 out of 3"-systems
• CPC Class Codes: B61L 25/021 Measuring and recording of train speed
• CPC Class Codes: B61L 3/22 using magnetic or electrostatic induction; using electromagnetic radiation
• CPC Class Codes: G06F 11/0796 Safety measures, i.e. ensuring safe condition in the event of error, e.g. for controlling element
• CPC Class Codes: G06F 11/1004 to protect a block of data words, e.g. CRC or checksum G06F11/1076 takes precedence; security arrangements for protecting computers or computer systems against unauthorized activity G06F21/00
• CPC Class Codes: G06F 11/1641 where the comparison is not performed by the redundant processing components
• CPC Class Codes: G06F 11/165 with continued operation after detection of the error

Abstract

An ATP device generates control data for two systems from an ATP command speed signal, provides duplicate logic units in the ATP device so as to process the respective control data, provides at least two CRC data for checking the control data for each system, and changes the CRC data of the opposite logic unit or selects one of the two according to the content of a failure detection signal from each of the duplicated logic units. It is possible to check the control data and the operation of each logic circuit in such a way that only when all the data, circuits, and elements operate normally will an output signal for controlling the object to be controlled be outputted, and when a failure is detected in a part, an output signal to that effect is outputted. Therefore, when a failure occurs, a fail safe function for performing control on the safe side is made possible.

Claims

1. A controller comprising

a plurality of processors to which input signals are applied for outputting output signals obtained by executing a plurality of operations on said input signals, including a first processor among said plurality of processors which supplies an output signal to an input of one of a plurality of second processors and at least one other processor among said plurality of second processors which supplies an output signal to said first processor, and

means for inverting the polarity of said output signal of said one other processor among said plurality of second processors being supplied as an input signal to said first processor.

2. A controller according to claim 1, wherein said first processor and said second processors are connected so that said first processor makes a closed signal loop via said plurality of second processors, and said polarity inverting means causes the polarity of a signal on said closed signal loop to be inverted.

35. A controller according to one of claims 1, 3, 5, 7, 9, 10-14, 21, 24, 27 and 30, wherein said processors comprise microcomputers for executing an accident diagnosis processing operation periodically after a parallel input signal is processed.

36. A controller according to one of claims 1, 3, 5, 7, 9, 10-14, 21, 24, 27 and 30, wherein said input signal, said output signal, and said failure detection signal are alternating signals which alternate when said plurality of processors are all normal.

3. A controller comprising

a first processor to which an input signal is applied for outputting an output signal obtained by executing a plurality of operations on said input signal, and a second processor to which an input signal is applied for outputting an output signal obtained by executing a plurality of operations on said input signal, an output signal of said first processor being supplied to an input of said second processor, and

means for supplying an output signal of said second processor to an input of said first processor with an inverted polarity with respect to that of said input signal to be inputted to said first processor.

4. A controller according to claim 3, wherein said first processor is connected to form a closed loop, via said second processor, in which closed loop the polarity of a signal is inverted.

5. A controller comprising a first serial converter for converting parallel input signals to a serial signal, a first processor for processing said serial signal of said first serial converter, a first parallel converter for converting a serial output signal of said first processor to parallel signals, a second serial converter for converting parallel input signals to a serial signal, a second processor for processing said serial signal of said second serial converter as an input signal, and a second parallel converter for converting a serial output signal of said second processor to parallel signals, means for supplying one of the output signals of said first parallel converter to said second serial converter as one of said parallel input signals thereto, and means including an inverter for supplying one of the output signals of said second parallel converter to said first serial converter to supply to said first serial converter a signal which is inverted in polarity with respect to that of other parallel input signals inputted to said first serial converter.

6. A controller according to claim 5, wherein, when said one of said parallel input signals inputted to said first serial converter from the output of said second parallel converter makes a closed loop via said second serial converter, said second processor, and said second parallel converter, the polarity thereof is inverted with respect to that of other parallel input signals inputted to said first serial converter.

7. A controller comprises, means for supplying a plurality of input signals in the form of a group of signals inputted in parallel, a first multiplexer and a second multiplexer for multiplexing said plurality of input signals to respective signals first and second output in time division, a first processor for processing said first output signal provided by said first multiplexer, a first demultiplexer for integrating parallel output signals of said first processor which are divided in time, a second processor for processing said second output signal provided by said second multiplexer, and a second demultiplexer for integrating parallel output signals of said second processor which are divided in times, and means for supplying one of the output signals of said first demultiplexer to said second multiplexer together with said plurality of input signals which are inputted in parallel, and means including an inverter for supplying one of the output signals of said second demultiplexer to said first multiplexer together with said plurality of input signals to supply to said first multiplexer a signal which is inverted in polarity with respect to that of other signals which are inputted to said first multiplexer.

8. A controller according to claim 7, wherein, when said one of input signals inputted to said first multiplexer from the output of said second demultiplexer makes a closed loop via said second multiplexer, said second processor, and said second demultiplexer, the polarity thereof is inverted with respect to that of other parallel input signals inputted to said first multiplexer.

9. A controller comprising a plurality of processors for executing a plurality of operations, an adder for adding an output signal of a first processor of said plurality of processors and an optional value, means for supplying input signals to said plurality of processors respectively, means for supplying an output signal of a second processor among said plurality of processors to an input of said first processor among said plurality of processors, means for supplying an output signal of said first processor to said adder, and means for supplying an output signal of said adder to an input of said second processor.

10. A controller comprising N processors, where N is a positive integer, for executing a plurality of operations, an adder for adding an output signal of the N=N of said N processors and an optional value, and means for supplying input signals to said N processors, an output signal of a N=1 processor among said N processors being supplied to a N=2 processor among said N processors, output signals of said N=2 processor being supplied to a N=3 processor, and output signals of each subsequent processor being supplied to a sequentially following processor, an output signal of said adder being supplied to said N=1 processor.

11. A controller comprising a first processor and a second processor for executing a plurality of operations, an adder for adding an output signal of said first processor and an optional value, a subtracter for subtracting an optional value from an output signal of said second processor, and means for supplying input signals to said first processor and said second processor respectively, an output signal of said adder being supplied as an input to said second processor, an output signal of said subtracter being supplied as an input to said first processor.

12. A controller comprising N processors, where N is a positive integer, for executing a plurality of operations, M adders, where M is a positive integer, for adding an output signal of a respective one of said N processors and an optional value, a subtracter for subtracting an optional value from an output signal a N=N processor of said N processors, and means for supplying input signals to each of said N processors, an output signal of a N=1 processor among said N processors being supplied to an M=1 adder among said M adders, an output signal of said M=1 adder being supplied to a N=2 processor among said N processors, an output signal of an N=2 processor among said N processors being supplied to an M=2 adder among said plurality of adders, an output signal of said M=2 adder being supplied to a N=3 processor among said processors, output signals of each subsequent processor being supplied to a sequentially following adder and outputs of each subsequent adder being supplied to a sequentially following processor, with an output of the N=N processing being supplied to said subtracter, and an output signal of said subtracter to said N=1 processor.

13. A controller comprising a first serial converter for converting a parallel input signal to a serial signal;

a first processor for processing said serial signal of said first serial converter;

a first parallel converter for converting a serial output signal of said first processor to a parallel signal;

a second serial converter for converting a parallel input signal to a serial signal;

a second processor for processing said serial signal of said second serial converter;

a second parallel converter for converting a serial output signal of said second processor to a parallel signal;

a first status discrimination signal for discriminating the statuses of said first serial converter, said first processor, and said first parallel converter;

means for providing a second status discrimination signal for discriminating the statuses of said second serial converter, said second processor, and said second parallel converter;

means for providing a first failure detection signal for indicating the statuses of said first serial converter, said first processor, and said first parallel converter in response to said first status discrimination signal;

means for providing a second failure detection signal for indicating the statuses of said second serial converter, said second processor, and said second parallel converter in response to said second status discrimination signal;

polarity inversion failure detection signal generating means for generating a polarity inversion failure detection signal by inverting the output polarity of said second failure detection signal;

a first adder for adding said first status discrimination signal and said polarity inversion failure detection signal; and

a second adder for adding said second status discrimination signal and said first failure detection signal;

an output signal of said first adder being supplied to said first serial converter together with said parallel input signal and an output signal of said second adder being supplied to said second serial converter together with said parallel input signal.

14. A controller comprising a first processor for outputting a first detection signal and a first output signal which is obtained by inputting and processing a first input signal and a polarity inversion detection signal;

a second processor for outputting a second detection signal and a second output signal which is obtained by inputting and processing a second input signal and said first detection signal;

a first connection for supplying said first detection signal to said second processor; and

a second connection for supplying said polarity inversion detection signal of said second processor to said first processor;

wherein said second processor outputs said second detection signal on the basis of said first detection signal inputted via said first connection, and said second connection outputs a polarity inversion detection signal, obtained by inverting the polarity of said second detection signal, to said first processor; and

wherein said first processor outputs said first detection signal on the basis of said polarity inversion detection signal.

15. A controller according to claim 14, wherein said second connection includes a logic unit for inverting the polarity of said second detection signal outputted from said second processor.

16. A controller according to claim 14, wherein said second processor includes a logic unit for inverting the polarity of said second detection signal processed by said second processor on the basis of said first detection signal.

17. A controller according to one of claims 14 to 16, wherein said first input signal or said second input signal includes processing data for processing by said first processor to produce first and said second processor and check data for checking the operations of said first and second processors.

18. A controller according to claim 17, wherein the processing data of said first input signal is the same as that of said second input signal.

19. A controller according to claim 17, wherein said check data checks the content of said processing data.

20. A controller according to claim 17, wherein one of said first processor and said second processor has a logic unit for implementing logic for said first detection signal or said second detection signal and the check data of said first input signal or said second input signal.

21. An ATP device comprising a first logic unit, including a first failure detector for checking first control data including at least two kinds of CRC data according to an ATP command speed signal for instructing the speed of an electric motor vehicle using one of said CRC data and for outputting a first failure detection signal, a first frequency converter for converting said first control data to a first ATP command speed frequency signal, and a first frequency comparator for comparing a speed frequency signal which is proportional to a detected speed of said electric motor vehicle and said first ATP command speed frequency signal and for outputting a first output signal according to a deviation between said speed frequency signal and said first ATP command speed frequency signal;

a second logic unit, including a second failure detector for checking second control data including at least two kinds of CRC data according to said ATP command speed signal using one of said CRC data and outputting a second failure detection signal, a second frequency converter for converting said second control data to a second ATP command speed frequency signal, and a second frequency comparator for comparing said speed frequency signal and said second ATP command speed frequency signal and for outputting a second output signal according to the deviation between said speed frequency signal and said second ATP command speed frequency signal; and

a matcher for correlating said first output signal and said second output signal and outputting alternating signals;

said CRC data of said second failure detector being changed by said first failure detection signal and said CRC data of said first failure detector being changed by said second failure detection signal.

22. An ATP device according to claim 21, wherein a first signal line for transmitting a signal for changing said CRC data of said second failure detector using said first failure detection signal is connected between the output side of said first failure detector and the input side of said second failure detector, and a second signal line for transmitting a signal for changing said CRC data of said first failure detector using said second failure detection signal is connected between the output side of said second failure detector and the input side of said first failure detector.

23. An ATP device according to claim 22, wherein one of said first signal line and said second signal line has a logic circuit for inverting said first failure detection signal or second failure detection signal.

24. An ATP device comprising a first microcomputer responsive to an ATP command speed signal for instructing the speed of an electric motor vehicle for generating first control data including at least two kinds of CRC data;

a second microcomputer responsive to said ATP command speed signal for generating second control data including at least two kinds of CRC data;

a first logic unit, including a first failure detector for checking said first control data inputted from said first microcomputer using one of said CRC data and for outputting a first failure detection signal, a first frequency converter for converting said first control data to an ATP command speed frequency signal, and a frequency comparator for comparing a speed frequency signal which is proportional to the speed of said electric motor vehicle and said ATP command speed frequency signal and for outputting a first output signal according to a deviation between said speed frequency signal and said ATP command speed frequency signal;

a second logic unit, including a second failure detector for checking said second control data inputted from said second microcomputer using one of said CRC data and for outputting a second failure detection signal, a second frequency converter for converting said second control data to an ATP command speed frequency signal, and a frequency comparator for comparing said speed frequency signal of said electric motor vehicle and said ATP command speed frequency signal and for outputting a second output signal according to a deviation between said speed frequency signal and said ATP command speed frequency signal; and

a matcher for correlating said first output signal and said second output signal and for outputting alternating signals;

said CRC data of said second control data being changed by said first failure detection signal and said CRC data of said first control data being changed by said second failure detection signal.

25. An ATP device according to claim 24, wherein a first signal line for transmitting a signal for changing said CRC data of said second failure detector in response to said first failure detection signal is connected between the output side of said first detector and the input side of said second detector, and a second signal line for transmitting a signal for changing said CRC data of said first failure detector in response to said second failure detection signal is connected between the output side of said second detector and the input side of said first detector.

26. An ATP device according to claim 25, wherein one of said first signal line and said second signal line has a logic circuit for inverting said first failure detection signal or second failure detection signal.

37. A controller according to one of claims 24, 27, and 30, wherein said matcher correlates said first output signal, said second output signal, said first failure detection signal and said second failure detection signal, and when said first and second output signals do not match with each other and said first and second failure detection signals do not match with each other, the alternation of said failure detection signals is stopped, and an emergency brake signal is outputted to said electric motor vehicle in response to the stopping of the alternation when said first and second failure detection signals do not match with each other.

27. An automatic train control system comprising a generator which is installed outside an electric motor vehicle for generating an ATP command speed signal for instructing the speed of said electric motor vehicle;

a receiver which is installed inside said electric motor vehicle for receiving said ATP command speed signal from said generator;

a speed detector which is installed inside said electric motor vehicle for detecting a speed of said electric motor vehicle and for generating a speed frequency signal in proportion to said speed; and

an ATP device which is installed inside said electric motor vehicle for controlling the speed of said electric motor vehicle using said ATP command speed signal and said speed frequency signal;

said ATP device comprising;

a first microcomputer responsive to said ATP command speed signal outputted from said receiver for generating first control data including at least two kinds of CRC data;

a second microcomputer responsive to said ATP command speed signal outputted from said receiver for generating second control data including at least two kinds of CRC data;

a first logic unit, including a first failure detector for checking said first control data inputted from said first microcomputer using one of said CRC data and for outputting a first failure detection signal, a first frequency converter for converting said first control data inputted from said first microcomputer to an ATP command speed frequency signal, and a frequency comparator for comparing said speed frequency signal and said ATP command speed frequency signal and for outputting a first output signal according to a deviation therebetween;

a second logic unit including, a second failure detector for checking said second control data inputted from said second microcomputer using one of said CRC data and for outputting a second failure detection signal, a second frequency converter for converting said second control data inputted from said second microcomputer to an ATP command speed frequency signal, and a frequency comparator for comparing said speed frequency signal and said ATP command speed frequency signal and for outputting a second output signal according to the deviation therebetween; and

a matcher connected to receive said first failure detection signal, said first output signal, said second failure detection signal, and said second output signal, for correlating said first output signal and said second output signal on the basis of said first and second failure detection signals, and for outputting alternating signals in which said first output signal and said second output signal alternate; and

a braking device which is installed inside said electric motor vehicle and which is responsive to said alternating signals, for controlling a braking force applied to said electric motor vehicle;

said CRC data of said second failure detector being changed by said first failure detection signal and said CRC data of said first failure detector being changed by said second failure detection signal.

28. An automatic train control system according to claim 27, wherein a first signal line for transmitting a signal for changing said CRC data of said second failure detector in response to said first failure detection signal is connected between the output side of said first detector and the input side of said second detector, and a second signal line for transmitting a signal for changing said CRC data of said first failure detector in response to said second failure detection signal is connected between the output side of said second detector and the input side of said first detector.

29. An automatic train control system according to claim 28, wherein one of said first signal line and said second signal line has a logic circuit for inverting said first detection signal or second detection signal.

30. An ATP device comprising:

a first microcomputer responsive to an ATP command speed signal for instructing the speed of an electric motor vehicle and for generating first control data together with first CRC data and second control data together with second CRC data;

a second microcomputer for generating third control data together with third CRC data and fourth control data together with fourth CRC data;

a first logic unit, including a first memory for storing said first control data outputted from said first microcomputer, a second memory for storing said second control data, a first switching circuit for switching said first memory and said second memory, a first failure detector and a second failure detector for checking output data of said first switching circuit, a first adder for adding said output data of said first switching circuit and an output signal of said second failure detector, a second adder for adding a speed frequency signal which is proportional to a speed of said electric motor vehicle and an output signal of said first failure detector, a first frequency converter for converting an output signal of said first adder to an ATP command speed frequency signal, and a first frequency comparator for comparing an output signal of said second adder and an output signal of said first frequency converter and for outputting a first output signal and a first failure detection signal according to a deviation therebetween;

a second logic unit, including a third memory for storing said third control data outputted from said second microcomputer, a fourth memory for storing said fourth control data, a second switching circuit for switching said third memory and said fourth memory, a third failure detector and a fourth failure detector for checking output data of said second switching circuit, a third adder for adding said output data of said second switching circuit and an output signal of said fourth failure detector, a fourth adder for adding a speed frequency signal which is proportional to a speed of said electric motor vehicle and an output signal of said third failure detector, a second frequency converter for converting an output signal of said third adder to an ATP command speed frequency signal, and a second frequency comparator for comparing an output signal of said fourth adder and an output signal of said second frequency converter and for outputting a second output signal and a second failure detection signal according to a deviation therebetween; and

a matcher for correlating said first output signal of said first logic unit, said second output signal of said second logic unit, said first failure detection signal, and said second detection signal, respectively, and for outputting alternating signals, wherein said first failure detection signal controls said second switching circuit and switches said third control data and said fourth control data, and wherein said second failure detection signal controls said first switching circuit said first switching circuit and switches said first control data and said second control data.

31. An ATP device according to claim 30, wherein a logic circuit is provided for inverting the polarity of one of said second detection signal for controlling said first switching circuit and said first detection signal for controlling said second switching circuit.

32. An ATP device according to claim 30, wherein said first microcomputer generates said first control data, said first CRC data for said first control data and said second CRC data for said first control data when said ATP command speed signal for instructing the speed of an electric motor vehicle is inputted, and said second microcomputer generates said second control data, said third CRC data for said second control data and said fourth CRC data for said second control data when said ATP command speed signal for instructing the speed of an electric motor vehicle is inputted, and an output signal of said first adder for adding said first control data and said first CRC data and an output signal of said second adder for adding said first control data and said second CRC data are inputted to said first switching circuit, and an output signal of said third adder for adding said second control data and said third CRC data and an output signal of said fourth adder for adding said second control data and said fourth CRC data are inputted to said first switching circuit.

33. An ATP device according to claim 30, wherein said first microcomputer generates said first control data together with said first CRC data and said second CRC data when said ATP command speed signal for instructing the speed of an electric motor vehicle is inputted, and said second microcomputer generates said second control data together with said third CRC data and said fourth CRC data when said ATP command speed signal for instructing the speed of an electric motor vehicle is inputted, and said first control data outputted from said first microcomputer is stored in said first memory, and an output signal of said first memory is inputted to said first failure detector, said second failure detector and said first adder, said second control data outputted from said second microcomputer is stored in said second memory, and an output signal of said second memory is inputted to said third failure detector, said fourth failure detector and said third adder, and wherein said second switching circuit switches said third CRC data and said fourth CRC data in response to said first failure detection signal, and wherein said first switching circuit switches said first CRC data and said second CRC data in response to said second failure detection signal.

34. An ATP device according to claim 30, wherein said first microcomputer generates first data, said first CRC data and said second CRC data when said ATP command speed signal for instructing the speed of an electric motor vehicle is inputted, and said second microcomputer generates second data, said third CRC data and said fourth CRC data when said ATP command speed signal for instructing the speed of an electric motor vehicle is inputted, and said first CRC data and said second CRC data are inputted to said first switching circuit, and an output signal of said first switching circuit and said first data are added in a fifth adder, and said third CRC data and said fourth CRC data are inputted to said second switching circuit, and an output signal of said first switching circuit and said first data are added in a sixth adder, and an output signal of said fifth adder is inputted to said first adder, said first failure detector and said second failure detector, and an output signal of said sixth adder is inputted to said sixth adder, said third failure detector and said fourth failure detector.