FR2561410A1 - Control for a process associated with two redundant programmable automatic controllers - Google Patents

Abstract

The invention relates to a device for controlling a process 10 by means of two redundant programmable automatic controllers AP 1, AP 2 with multiprocessor structures. The main bus BP1, BP2 of each automatic controller comprises a redundancy coupler CR 1, CR 2 intended to communicate with the corresponding central unit UC 1, UC 2. A double asynchronous serial link LS connects the two redundancy couplers CR 1, CR 2 in order to provide exchange of information between the two automatic controllers at each program cycle. Application: industrial process control.

Description

PROCESS CONTROL ASSOCIATED WITH TWO PROGRAMMABLE CONTROLLERS
REDUNDANT.

The invention relates to a device for controlling a process by means of two redundant programmable controllers associated with monitoring means intended to control the similarity of information present in the two controllers operating simultaneously on said process, each controller comprising a bus. main communication between a central unit and a plurality of interfaces with modules or input and output cards, and with auxiliary coupling and function modules, said prceess being equipped with sensors electrically connected to the respective input cards of the two PLCs by a first set of tables and actuators connected to the corresponding output cards by a second set of cables.

Redundancy arrangements
existing are made up of a common monitoring unit, located outside the two programmable controllers and. electrically connected with central units by speed-skipping links The monitoring unit cooperates with a separate switching block which controls the read out of service of the defective expensive automaton.

 The object of the invention is to remedy these drawbacks and to enable the production of a reliable control device intended to synchronize the operation of the two redundant automata and to check the consistency of their information, in particular of the inputs outputs and memory words.

The contrai device according to the invention is characterized by the fact that the main bus of each automaton has a capacity for exchanging information authorizing a multiprocessor structure and comprises a redundancy coupler intended to communicate with the central unit corresponding. An asynchronous serial link is arranged between the two redundancy couplers to ensure at each cycle of the user program, predetermined information exchanges, in particular inputs, outputs, or memory words, between the two controllers.

Each redundancy coupler is formed by an asynchronous coupler comprising a memory with registers of dialogue with the corresponding central unit, and a data memory intended to store on the one hand the information coming from the central unit and / or cards of inputs and outputs associated with one of the PLCs, and on the other hand similar information from the other PLC, exchanged via the asynchrome serial link.

The test program for each redundancy coupler introduces a processing time of the order of 5 to 10 ms per cycle, and only intervenes vis-à-vis the corresponding controller at the start and end of the cycle, from so as to monitor the state of the inputs before their use by the program, and the state of the outputs after running the user program, but before their repercussion on the actuators.

Each redundancy coupler permanently monitors the orders received from the sensors as well as the actions resulting from the progress of their own programs. In the event of inconsistent orders or actions, and before these are recognized, it diagnoses the fault and causes the faulty PLC to be decoupled. From then on, only one automaton ensures the operation of the installation while maintenance operations or repairs are possible on the other. The return to operation is ensured by the redundancy coupler which performs the refresh (inputs, outputs, internal states) of the faulty PLC before coupling it to the process.

The central unit of each PLC comprises a memory containing the user program and a data memory enclosing the table descriptor. The redundancy coupler is arranged to copy said tables into its own data memory.

The central unit of each PLC is also equipped with an image memory intended to "freeze" the input and output information at each program cycle.

Each redundancy coupler acquires the value of the inputs and outputs in this image memory and then stores them in its own data memory.

The asynchronous serial link between the two redundancy couplers is itself redundant and supports two simultaneous bi-directional transmissions
Other advantages and characteristics will emerge more clearly from the description which follows of an embodiment of the invention, given by way of nonlimiting example and shown in the appended drawings, in which - FIG. 1 is a general synoptic view of the control device according to the invention; - Figure 2 shows the block diagram of the central unit of a programmable controller; - Figure 3 shows the diagram of the image memory of the central unit; - Figure t illustrates the block diagram of a redundancy coupler according to the invention, - Figure 5 is a schematic view of the double asynchronous serial link arranged between the two redundancy couplers; FIG. 6 shows the structure of the dialogue registers contained in the dialogue memory of each coupler according to FIG. 4; - Figure 7 shows the address status register 0 of the dialogue memory according to fig. 6; - Figure 8 illustrates the flow of the user program and the test program; - Figure 9 shows the structure of exchange and comparison of information "INPUTS".

With reference to FIG. 1, two redundant programmable PLCs AP1, AP2 operate simultaneously on the same process or process 10 provided with sensors 12 (pushbuttons, switches, coding wheels ...) and actuators 14 (contactors, solenoid valves, indicators, displays ...). The PLCs AP1, AP2 are of the PB 400 type from MERLIN GERIN, each comprising a main bus BP1, BP2 for communication and monitoring with very high exchange capacity allowing a multiprocessor structure. The main bus BP1, BP2 of each PLC AP1, AP2 is equipped with a central unit UC1, UC2, a plurality of interfaces with modules or input cards El, E2 and logic outputs SI, S2 (all or nothing) or analog, and auxiliary modules (not shown) for coupling and function. The sensors 12 of the process 10 are electrically connected by a first pair of cable bundles Cl, C2 to the input modules El, E2 of the two automata Api, AP2. The actuators 14 of process 10 are connected by a second pair of cable bundles C3, C4 to the output modules S1, S2 of the two automata AP1, AP2.

The main bus BP1, BP2 of each PLC AP1, AP2 is associated with a redundancy coupler CR1, CR2 intended to log in with the corresponding central unit UC1, UC2 to permanently monitor the orders received from the sensors 12 as well as the actions from the Cyclic sequence of the own program of each PLC APi, AP2. A double asynchronous LS serial link is arranged between the two redundancy couplers CRI, CR2 to synchronize the simultaneous operation of the two redundant PLCs AP1, AP2.

At each program cycle, reciprocal exchanges are carried out between the two couplers CRI, CR2 via the link
Redundant LS to control the similarity of predetermined information (inputs, outputs, memory words) present simultaneously in the two PLCs AP1, AP2.

Figure 2 shows the block diagram of the central unit
UCI of the PLC PLC the UCZ central unit of the other to the AP2 tomato has a structure identical to that of UCI and will not be described below. The central unit UC1 comprises
a processing unit 16 intended to control the operation of the PLC AP1 and to manage the exchange of information between its modules via the main bus BP1; - a RAM 18 memory for data storage; a RAMou EPROM 20 memory for storing the user program; - 22 image RAM memory of the E1 inputs and outputs
S1 ;; an intermediate bus BI UC1 for interconnecting the memories 18, 20, 22 and the processing unit 16, the latter being connected on the other hand to the main bus BP1.

In FIG. 3, the I / O image memory 22 of the central unit UC1 comprises a first zone MIE1 of input image memory cooperating with the input modules E1, and a second zone MIS2 of output image memory connected to the modules outputs S1 of PLC AP1. The function of the image memory 22 consists in memorizing the input and output information at each cycle of the program, thus avoiding any operational hazard. The direction of transmission of information between the memory 22 and the input modules El and outputs S1 reverses in the buses BP1 and BI UC1 as a function of the area MIEl or MIS1 addressed by the processing unit 16. that the orders issued to the output modules S1 are subject to prior registration in the second zone MIS1 of output image memory. The image memory 22 of the other central processing unit
UC2 similarly includes an MIE2 input image memory area cooperating with the input modules
E2, and an output image memory area MIS2 cooperating with the output modules S2.

FIG. 4 illustrates the block diagram of the redundancy coupler CR1 of the PLC PLC. The other redundancy coupler CR2 associated with the PLC AP2 is identical to CR1 and will not be described below. The architecture of the CR1 redundancy coupler is based on that of an asynchronous coupler comprising - a processing unit 24 using a MOTOROLA microprocessor 6809; - a common RAM memory 26 of dIalogue UC1 / CR1 containing the dialogue registers between the central unit UC1 and the redundancy coupler CR1; - a data memory RAM 28, having a capacity of four kbytes; - an EPROM memory 30 of capacity eight kbytes for the storage of the test program of the coupler CR1; - an intermediate bus BI CR1 for interconnecting memories 26, 28, 30 and the processing unit 24; - A 32 ′ logical adaptation interface 11 and a module 34 for managing interruptions, interposed between the intermediate bus BI CR1 and the main bus BP1 of the PLC AP1; - two independent serial transmission channels 1,2 connected to the intermediate bus BI CR1 and comprising transmission means EM1, EM2 and reception means R1, R2 associated with the redundant LS link.

In FIG. 5, the connection is schematically represented
Redundant LS between the two couplers CR1 and CR2. It consists of two pairs of channels A, A '7 B, B' forming two simultaneous two-way transmission links. The first channel A connects the transmitter
EM1 of channel 1 of coupler CR1 to the receiver RI of corresponding channel 1 of other coupler CR2 The second channel
A 'connects the EMI transmitter of channel 1 of coupler CR2 to the receiver R1 of channel 1 of coupler CR1. The third and fourth channels B, B ′ similarly connect the emitters EM2 and the receivers R2 of the two channels 2, respectively from the coupler CRI to the coupler CR2, and from the coupler CR2 to the coupler CRI. information in the different channels A, A '; B, B 'of the LS link is indicated by an arrow,
The structure of the dialogue registers contained in the dialogue memory 26 of the redundancy coupler CR1 is illustrated in FIG. 6. The memory 26 includes a register
O addressable "bit" and a plurality of registers 2 to 6 addressable "word". The other registers 1 and 7 to F are reserved. The dialogue memory 26 of the other redundancy coupler CR2 is identical, and will not be described.

 The address register o constitutes a state register whose 16-bit format is shown in FIG. 7 - C1 and C2 are bits for controlling the progress of the user program; - a is the "INDETERMINATION" bit controlled in state 1 by the CRI redundancy coupler in the event of information inconsistency with the CR2 coupler; - DEF is the "DEFAULT" bit set to state 1 following a fault in the PLC AP1 and / or AP2 or the redundant LS link ;; - RAF is the bit of "REFRESHING request" positioned in state 1 by the coupler CR1 and automatically reset to state 0 by the user program after completion of the refresh which consists of copying the inputs El into the image memory of the inputs 22 and the image memory of the outputs 22 in the outputs 51; - MI, M2 are the "ON" bits of the PLC and AP2 PLCs; - BTI, BTO are "time base" bits updated respectively by the program and by the CRI coupler; - TR6 is a bit of "Transmission" of predetermined words, contained in the tables. The state of this bit informs the redundancy coupler of the table transfer direction.

Register 2 contains the address of the table descriptor.

This value is loaded at initialization and points to the beginning of the memory area where redundancy is described (inputs, outputs, words).

Register 3 concerns the state of the link LS between couplers CR1 and CR2 and comprises four bits respectively indicating the state of the channels A, A '; B, B '.

The registers 4, 5 and 6 inform the program in the event of a fault ("DEF" bit) or indeterminacy ("IND" bit) following a discrepancy between the couplers CR1 and CR2.

In an initialization phase, the user declares all the information that he wishes to monitor by means of a configuration descriptor. This list of information grouped into exchange tables concerns the inputs, the words declared at a predetermined address in the data memory 18 of each central unit UC1, UC2, and the outputs, Each redundancy coupler CR1, CR2 copies then the tables in its data memory 28.

These declarations can be modified at will during the operation of the installation according to whether one wishes to lighten or reinforce the surveillance.

The phase of checking the similarity of the information (inputs, outputs, memory words present in the two PLCs AP1, AP2 operating simultaneously on the same process 10) is illustrated diagrammatically in FIG. 8.

This control phase is determined by the test program of the redundancy couplers CR1, CR2, and takes place at the beginning and at the end of each cycle of the user program of PLC, AP2 automata. The comparison of the inputs takes place before the processing The comparison of the outputs and the memory words occurs after the processing and controls the raIchIssernent. Each redundancy coupler
CR1, CR2 is in dialogue with the central unit UC1, UC2 associated with the PLC AP1, AP2, and constantly monitors the following points - the data memory 16 - the state of the inputs before their use by the program, - the state of the outputs after completion of the user program, but before their repercussion on the actuators 14.

In the event of a discrepancy between the two PLCs AP1 and AP2, the couplers CR1, CR2 cause the start of a first fault procedure D1 for inputs, and a second fault procedure D2 for outputs or words These two fault procedures D1, D2 diagnose the nature of the fault, and can cause the decoupling of the PLC AP1,
AP2 defective. A single PLC then ensures the operation of the installation while maintenance or repair operations are possible on the other.
The return to operation is ensured by the CR1 coupler,
CR2 correspondent which refreshes (inputs, outputs, internal states) of the faulty PLC before coupling it to process 10.

The information exchange and comparison process is explained in detail below 1) Exchange and comparison of INPUTS (see the flowchart in fig. 9!
The redundancy coupler CR1 acquires the value of the inputs El in the area MIE1 of the image memory 22 associated with the central unit UC1 of the PLC AP1. The other coupler
CR2 similarly records the value of the inputs
E2 in the area MIE2 of the image memory 22 associated with the central unit UC2 of the PLC AP2. The two couplers
CR1, CR2 store the value of the inputs in their respective data memories 28, then simultaneously exchange the data via the redundant duplex LS link. The couplers CRI, CR2 store the data exchanged in their data memories 28 so as to subsequently authorize the comparison of the inputs via their respective processing units 24.

If the inputs are similar, the couplers CR1 and CR2 simultaneously send a command command to the corresponding central units UC1, UC2 to ensure synchronization of the two PLCs AP1, AP2 before user processing.

The fault procedure D1 intervenes automatically in the event of inconsistency of the inputs and provides for a new phase of acquisition, exchange and comparison of MIE1 and MIE2. If the inconsistency continues, the couplers CR1, CR2 directly read the data on the input cards El, E2, and then carry out their exchanges (LS link) and their comparison in the memories 28. The result of this comparison generates two additional series of tests (see fig. 9) making it possible to identify either the faulty image memory 22 or the faulty input card El or E2.

2) exchange and comparison of outputs and words.

a) outings
The process of acquisition, exchange and comparison of the outputs is similar to that used for the inputs, with the difference that the values of the outputs S1 and S2 are recorded in the zones MIS1 and MIS2 of the image memories 22 of the central processing units UC1 and UC2.

b) words
Idem, the acquisition of the words taking place in the data memory 18 of each central unit UC1 and UC2.

The consistency of the outputs and the words controls the synchronization of the two PLCs AP1, AP2 before the downscaling
The presence of the redundancy couplers CRI, CR2 associated with the duplex LS link makes it possible to synchronize the operation of the two redundant PLC controllers, AP2 and to check the comparison of their inputs, outputs and memory words.

The test program for the CR1 and CR2 couplers introduces a processing time of 5 to 10 ms per cycle.

The invention is of course in no way limited to the mode of implementation more particularly described and shown in the accompanying drawings, but it extends quite the contrary to any variant remaining within the framework of equivalences

Claims (10)

CLAIMS 1. Device for controlling a process (10) by means of two redundant programmable controllers (AP1, AP2) cooperating with redundancy monitoring means, intended to control the similarity of information present in the two controllers operating simultaneously on said process, each automaton (AP1, AP2) comprising a main bus (BPl, BP2) for communication between a central unit (UC1, UC2) and a plurality of interfaces with modules or input cards (El, E2) and of outputs (S1, 52), and with auxiliary coupling and function modules, said process (10) being equipped with sensors (12) electrically connected to the respective input cards (E1, E2) of the two automata (AP1, AP2 ) by a first bundle of cables (C1, C2), and of actuators (14) connected to the corresponding output cards (S1, S2) by a second bundle of cables (C3, C4), characterized in that the bus main (BP1, BP2) of each PLC (AP1, AP2) has a capacity of information hangers authorizing a multiprocessor structure and includes a redundancy coupler (CR1, CR2) intended to dialogue with the corresponding central tics unit, UC2), and that an asynchrome serial link tS) is arranged between the two redundancy couplers (CR1, CR2) to ensure at each cycle of the user program exchanges of predetermined information, in particular inputs, outputs or memory words, between the two automated machines (AP1, AP2). 2. Process control device according to claim 1, characterized in that each redundancy coupler (CRI, CR2) is formed by an asynchronous coupler comprising a memory (26) with registers of dialogue with the central unit ( UC1, UC2) corresponding, and a data memory (28) intended to store on the one hand the information coming from the central unit (UCî, UC2) and / or from the input cards (El, E2) and from outputs (S1, S2) associated with one of the PLCs, and on the other hand similar information from the other PLC, exchanged via the asynchronous serial link (LS). 3. Device for controlling a process according to claim 2, characterized in that each redundancy coupler tCR1, CR2) further comprises a memory (30) for storing the test program occurring at the start and at the end of each user program cycle, so as to monitor the state of the inputs before their use by the user program, and the state of the outputs after running the user program, but before their repercussion on the actuators (14). 4. A process control device according to claim 2 or 3, characterized in that each redundancy coupler (CR1, CR2) is provided with a processing unit (24) with microprocessor controlling the process of comparing information of the same nature (either inputs, or outputs, or memory words) stored in the corresponding data memory (28), and that control means ensure either the synchronization of the two automata (AP1, AP2) in the event of similarity of said information, either the diagnosis of the det'a ## t and possibly the decoupling of the defective PLC in the event of inconsistency of said information. 5. A device for controlling a process according to claim 4, characterized in that each redundant coupler is provided with an intermediate bus (BI CR1, BI CR2) in connection with the processing unit (24 ) and the various memories, in particular (26) with dialogue registers, (28) of data, and (30) of the test program, said intermediate bus (BI CR1, BI CR2) being connected on the one hand to the main bus (BP1 , BP2) of the automaton (AP1, AP2) corresponding via an adaptation logic interface (32), and on the other hand to said asynchronous serial link (eS) connected to the other automaton. 6. A process control device according to one of claims 2 to 5, characterized in that the central unit (UC1, UC2) of each automaton (AP1, AP2) comprises a memory (20) of the user program and a data memory (18) containing the descriptor of tables, and that the redundancy coupler (CR1, CR2) is arranged to copy said tables into its own data memory (28). 7. Process control device according to claim 6, characterized in that the central unit (UC1, UC2) of each PLC (AP1, AP2) is equipped with an image memory (I / O 22) intended to memorize at each program cycle the input and output information, said image memory (22) comprising a first zone ( MIE1, MIE2) cooperating with the input cards (El, E2) and a second zone (MIS1, MIS2) connected to the output cards (S1, 52), and that each redundancy coupler (CRI, CR2) acquires the value of the inputs (E1, E2) and the outputs (51, S2 ) in said first and second areas of the corresponding image memory (I / O 22), and then stores them in its own data memory (28). 8. Device for controlling a process according to one of claims 1 to 7, characterized in that the asynchronous serial link (LS) between the two couplers (CR1, CR2) redundancy includes two simultaneous two-way transmission links.  9. A process control device according to claim 8, characterized in that the duplex link (LS) is redundant and comprises two pairs of elementary channels (A, A '; B, B') connected to means d transmission (EM1, EM2) and reception means (R1, R2) of two independent channels (1,2) of serial transmission associated with each redundancy coupler (CR1, CR2).  10. Device for controlling a process according to claim 7 to 9, characterized in that the redundancy coupler (CR1, CR2) of each automaton (AP1, AP2), acquires memory words in the data memory (18 ) of the corresponding central unit (UC1, UC2), and that the consistency of the output information and words controls the synchronization of the two PLCs before the refresh.