JP2004164394A - Method of starting duplex controller - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a method of matching setting information of a stopped controller with those of a controller in controlling state when the controller stopped in a duplex control system is started. <P>SOLUTION: The method includes: a step for starting a first controller 10 being one of the plurality of the controllers for controlling an apparatus 30; a step for allowing the first controller to determine a first condition that a second controller 20 is normally operated and also works in the control state to control the apparatus 30; a step for allowing the first controller to acquire the setting information being used by the second controller to control the apparatus as temporary setting information when the first condition is satisfied by the second controller; and a step for allowing the first controller to compare the temporary setting information with the setting information stored in the first controller, and to store the temporary setting information as the normal setting information in the case of non-coincidence. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a method for activating a control device, and more particularly to a method for activating a duplicated control device.
[0002]
[Prior art]
In an object requiring continuous operation such as a thermal power plant, a plurality of control devices are installed for the device to be controlled, and one of the plurality of control devices operates in a controlled state to control the device. There is a case where a duplicated control system in which one of the control devices operates in a standby state is used.
When the control device in the standby state receives the setting information from the control device in the control state, the setting information of the control device in the control state and the setting information of the control device in the standby state may be matched. When the control is switched from the control device in the control state to the control device in the standby state, the setting information of each control device must be matched so as not to affect the operation of the device.
[0003]
When a stopped control device is started for maintenance or the like, the setting information of the control device in the control state and the setting information of the stopped control device may not match. It is desired that the setting information of the control device that has been stopped at the time of startup be matched with the setting information of the control device that is in the control state at the time of startup.
[0004]
An initial loader program that is started when the power of a control device placed in a distributed environment is turned on acquires definition information and a parser program from the definition information server, starts the parser program, and obtains the parser program by analyzing the definition information file. Using the obtained control program name and initial information file name, access the definition information server to obtain the program and the initial information file, generate an object on the control device based on the obtained program, and store the initial information file in the object. A method of starting a control system characterized by taking in the information of the control system is disclosed. (For example, Patent Document 1)
[0005]
FIG. 4 shows an example of the configuration of a conventional dual control device.
A first control device 110 and a second control device 120 for controlling the controlled device 130 to be controlled are provided.
The first control device 110 includes a first calculation unit 111 and a first database 112. The first control device 110 is connected to the controlled device 130 via a control line 113.
The first calculation unit 111 includes a CPU, and controls the controlled device 130 using a control calculation program based on detection information of various sensors (not shown) attached to the controlled device 130 and input information of an administrator. And outputs the control information to the controlled device 130 via the control line 113.
The first database 112 stores setting information including control information, detection information, and input information.
Since the second control device 120 has the same function as the first control device 110, the description is omitted.
The first control device 110 and the second control device 120 are connected by a network 140 and can transmit and receive information.
[0006]
Further, the setting information server 150 may be installed on the network 140. To the setting information server 150, setting information is periodically transmitted from a control device in a control state (here, the second control device 120) and stored in the setting information database 151.
When a control device that has been stopped due to maintenance or the like (here, the first control device 110) is activated, the first control device 110 may access the setting information server 150 and acquire setting information.
[0007]
Alternatively, the design terminal 160 may be installed on the network 140. When activating the first control device 110, the user may create a setting information change program and copy the setting information from the second control device 120 to the first control device 110 in some cases.
[0008]
In a control system having a plurality of control devices that are duplicated for enhancing reliability, when a stopped control device is started, the setting information of the stopped control device is used to set the control device in the control state. Preferably, it is automatically matched with the information. It is preferable that the setting information be matched without using the setting information server 150.
Further, in a control system including a plurality of duplicated control devices, when a plurality of control devices are started at substantially the same time, one control device starts in a control state, and the setting information of another control device is controlled. It is preferable that the control device be started up in a standby state after being matched with the setting information of the control device in the state.
[0009]
[Patent Document 1]
JP 2001-236208 A
[Problems to be solved by the invention]
SUMMARY OF THE INVENTION An object of the present invention is to provide a control system having a plurality of control devices that are duplicated to enhance reliability. When a stopped control device is started, the setting information of the stopped control device is controlled by the control information. It is an object of the present invention to provide a method that is automatically matched with setting information of a control device in a state.
Another object of the present invention is to provide a control system including a plurality of control devices that are duplicated to enhance reliability, even when a plurality of control devices are started almost simultaneously, one control device remains in a control state. It is an object of the present invention to provide a method of starting up, and setting information of another control device is matched with setting information of a control device in a control state, and is started in a standby state.
[0011]
[Means for Solving the Problems]
The means for solving the problem will be described below using the numbers and symbols used in [Embodiments of the Invention]. These numbers and symbols are added to clarify the correspondence between the description of [Claims] and the description of [Embodiments of the Invention]. It should not be used to interpret the technical scope of the described invention.
[0012]
The starting method of the redundant control device according to the present invention includes the following steps.
A step of activating a first control device (10), which is one of a plurality of duplicate control devices that control the same control target device (30).
A control state in which the first control device (10) controls that the second control device (20), which is another control device of the plurality of control devices, is operating normally and controls the device (30). Determining a first condition that includes operating in step (a).
Setting information used by the first control device (10) to control the device (30) from the second control device (20) when the second control device (20) satisfies the first condition. Obtaining the temporary setting information as temporary setting information.
A step in which the first control device (10) compares the temporary setting information with the setting information stored in the first control device (10), and, if different, stores the temporary setting information as regular setting information.
[0013]
Further, the step of acquiring the temporary setting information by the first control device (10) includes a step of stopping the activation when the acquisition fails.
[0014]
Further, the step of the first control device (10) determining that the second control device (20) satisfies the first condition includes the following steps.
A step in which each of the plurality of control devices has a self-diagnosis function and determines whether the device is operating normally.
A step of determining, by the self-diagnosis function, a status including whether each of the plurality of control devices is operating in a control state for controlling the device (30) or in a standby state as a spare.
The plurality of control devices are connected by a network (40), and each control device communicates with another control device to transmit information including that the other control device is operating normally and the status of the other control device. Steps to get.
[0015]
Further, the starting method of the redundant control device according to the present invention includes the following steps.
When the first control device (10) is normal and the second control device (20) does not satisfy the first condition, the first control device (10) again controls the second control device before starting the control. Confirming that (20) satisfies the first condition, and if so, resetting the first control device (10).
[0016]
BEST MODE FOR CARRYING OUT THE INVENTION
With reference to the accompanying drawings, an embodiment of a starting method of a redundant control device according to the present invention will be described below.
FIG. 1 shows an outline of a control system in which a control device is duplicated.
A first control device 10 and a second control device 20 for controlling the controlled device 30 to be controlled are provided.
The first control device 10 includes a first calculation unit 11 and a first database 12. The first control device 10 is connected to the controlled device 30 by a control line 13 that transmits control signals and detection information.
[0017]
The first calculation unit 11 includes a CPU, and controls the controlled device 30 using a control calculation program based on detection information of various sensors (not shown) attached to the controlled device 30 and input information of an administrator. And outputs the control information to the controlled device 30 via the control line 13.
The control information is represented by a control calculation result for controlling the controlled device 30. The detection information is information used for calculating control information, and is exemplified by a physical quantity input from a sensor installed in the controlled device 30. The input information is exemplified by target information and management information of the output of the controlled device 30 input to the user.
Further, the first calculation unit 11 can determine that the first calculation unit 11 is in a normal state. Specifically, the normal state is exemplified by a state where no error occurs in the calculation or a state where the setting of the system does not cause an error. Further, the first calculation unit 11 determines a status that is either the control state in which the control unit 30 is currently controlling the controlled device 30 or the standby state in which the control unit 30 is operating as a standby. Can be. The first calculation unit 11 periodically detects the status.
Further, the first calculation unit 11 performs a first setting matching process and a second setting matching process described later.
[0018]
The first database 12 is a storage device typified by a RAM disk such as a flash ROM, and stores a control operation program and system setting information for performing normal control.
Since the second control device 20 has the same function as the first control device 10, the description is omitted.
The first control device 10 and the second control device 20 are connected by a network 40 and can transmit and receive information.
Each control device can obtain, via the network 40, control operation results of other control devices, information indicating whether the control device is in a normal state, and control information including status information indicating whether the control state is a standby state.
[0019]
The calculation unit of the control device in the control state directly controls the controlled device 30.
The calculation unit of the control device in the standby state uses the same control calculation program, detection information, and input information as the calculation unit of the control device in the control state, and performs the same calculation to calculate the same control calculation result. The control device 30 is not controlled. Alternatively, the arithmetic unit of the control device in the standby state acquires setting information for control from the arithmetic unit of the control device in the control state, but does not control the controlled device 30.
When an abnormality or an error occurs in the control device in the control state, the control device in the standby state instantaneously enters the control state and can control the controlled device 30.
[0020]
In the present embodiment, an example of an activation method when the control device operating in the control state is the second control device 20 and the first control device 10 which is the stopped control device is activated is illustrated. The number of control devices shall be limited to two.
[0021]
While the first control device 10 is stopped for some reason, the setting of the control device may be changed while the second control device is operating alone. In this case, the setting information stored in the first control device 10 may be different from the setting information of the second control device 20.
If the control calculation program of the stopped first control device 10 is directly started due to the different setting information, the behavior of the entire system may be unstable because different setting information is used. When the control device in the control state is switched from the second control device 20 to the first control device 10 in a case where the duplexed control device has different setting information, the control of the controlled device 30 fluctuates and affects the operation. There are cases.
Therefore, when the stopped first control device 10 is started, the setting information of the first control device 10 must be matched with the setting information of the second control device 20 in the control state.
[0022]
FIGS. 2 and 3 show a method in which the setting information of the first control device 10 is matched with the setting information of the second control device 20 in the control state when the stopped first control device 10 is activated. It is.
[0023]
FIG. 2 shows the outline steps from when the power of the stopped first control device 10 is turned on to when the control calculation program is activated.
The power of the stopped first control device 10 is turned on (Step 100, hereinafter S100). When the power of the first control device 10 is turned on, the basic application starts (S200). Thereafter, the first setting matching process is automatically performed (S300). By the first setting matching process, the first calculation unit 11 performs a process of matching the setting information of the first control device 10 with the setting information of the second control device in the control state. Details of the first setting matching process will be described later with reference to FIG. If the process of the first setting matching process has failed, the activation of the first control device 10 is stopped (S400). After the first setting matching process, a second setting matching process is performed (S500). In the second setting matching process, when a plurality of control devices are started almost at the same time in a situation where no overlapping control device is operating normally, one control device is started in a control state and another control device is started. In order to start up the apparatus in a state where the apparatus is consistent with the control apparatus in the control state, the processing includes resetting another control apparatus started as a standby system once (S600). Details of the second setting matching process will be described later.
After the end of the second setting matching process, the control calculation program is started (S700). When the second control device 20 is operating in the control state, the first control device 10 operates in the standby state (S800). If necessary, the first control device 10 can be switched to the control state. A known technique is used for switching between the control state and the standby state of the duplexed control device.
[0024]
The steps of the first setting matching process used in the first calculation unit 11 of the first control device 10 will be described with reference to FIG.
After the start application is started, the first setting matching process automatically starts (S301).
The first calculation unit 11 determines whether the first control device 10 is part of a duplex system according to the settings set on the hardware (S302). Alternatively, the first operation unit 11 can determine whether there is another control device via the network 40 to determine whether the first control device 10 is part of a duplex system. .
When the first calculation unit 11 determines that the first control device 10 is not part of the duplex system, the process proceeds to step 311. In this case, the first control device 10 uses the original setting information stored in the first database 12 as regular setting information.
[0025]
When the first calculation unit 11 determines that the first control device 10 is a part of the duplex system, the other operating control devices (here, the second control device 20) operate normally. The first condition including that the second control device 20 is operating and the operating second control device 20 is in the control state is acquired. When the second control device 20 satisfies the first condition, the first calculation unit 10 determines that the setting file including the setting information can be copied from the second control device 20 (S303).
If the first arithmetic unit 11 determines that the second control device 20 does not satisfy the first condition and the second control device 20 cannot copy the setting file, the process proceeds to step 312.
If the first calculation unit 11 determines that the setting file can be copied, the first database 12 searches for a temporary folder in the first database 12, and if not, creates a temporary folder (S304). The first calculation unit 11 acquires a setting file including the setting information of the second control device 20 via the network 40, and copies it to a temporary folder as a temporary setting file (S305). The acquisition of the setting file of the first calculation unit 11 is performed by communication.
[0026]
The first calculation unit 10 determines whether the setting file has been successfully copied from the second control device 20 (S306). The success is determined by confirming that the copy has been completed without any error.
If the copy has failed, the first control device 10 is set to a failure state and the startup is stopped (S400) in order to prevent startup in a state where there is inconsistency. Further, the first calculation unit 11 sets the failure flag f1. By setting the failure flag f1, another control device can determine that the state of the first control device 10 is abnormal.
If the copy is successful, the first calculation unit 10 compares the temporary setting information included in the obtained temporary setting file with the original setting information stored in the first database (S308).
If the temporary setting information and the original setting information are the same, there is no need to use the temporary setting information, and the temporary setting folder copied to the temporary folder is deleted to reduce the used capacity of the disk (S309). If the temporary setting folder has been deleted, the process proceeds to step 311 using the original setting information as regular setting information.
If the temporary setting information and the original setting information are not the same, the first arithmetic unit 11 adopts the temporary setting information as regular setting information and overwrites the place where the regular setting information is stored (S310). After the temporary setting information is overwritten on the regular setting location, the process proceeds to step 311.
[0027]
When proceeding to step 311, the first calculation unit determines that the consistency of the setting information has been normally obtained, and sets the flag f2 (S311). After setting the flag f2, the process proceeds to step 312.
[0028]
By performing steps 301 to 311 described above, the setting information is matched when the control device in the control state other than the control device is normally operating. Further, if the matching fails, the activation of the control device is stopped, whereby an abnormal activation state can be prevented. If the control device is not a part of the duplex system, or if there is no control device in the control state, or if the control device in the control state is not operating normally, the setting information stored therein is stored. Is used and invoked.
[0029]
In step 312, the first calculation unit performs a process of reading the setting file.
Next, a second setting matching process is performed (S400).
[0030]
In the second setting matching process, the first arithmetic unit 11 is in a normal state by the self-diagnosis function and that the second control device 20 is normally activated in the control state via the network 40. And it is determined whether or not a second condition including that the flag f2 is not set in its own calculation is satisfied.
If the second condition is satisfied, the first calculation unit 11 forcibly resets itself.
The second condition may include that the control device is duplicated and that the flag f1 is not set.
If the second condition is not satisfied in the additional processing, the control calculation program is started.
[0031]
By performing the above-described second setting matching process, when at least one of the control devices is not operating in the control state when starting the controlled device 30, two overlapping control devices are started almost simultaneously. Sometimes, after the first control device operates in the control state, the control device started later is reset. Here, the setting information with the control device in the control state can be matched by executing the first setting matching process of FIGS. 2 and 3 again.
[0032]
It is preferable that the above-described method of starting the dual control device is used for controlling a plant in which continuous operation is performed and the effect of stopping the operation due to abnormality in the control device is large.
Specifically, continuous operation of a thermal power plant is required, and the abnormal shutdown of the thermal power plant has a large social impact. For this reason, a thermal power plant may have a duplicated control device. Furthermore, in a thermal power plant having a duplicated control device, it is preferable that the setting information of the control system and the setting information of the standby system be matched when the control device is switched. In the control of a thermal power plant, a sudden change in control is not preferable in terms of continuation of operation, and further, when it is not possible to cope with changing operating conditions, the required power may not be supplied.
[0033]
【The invention's effect】
The present invention is directed to a control system including a plurality of control devices that are duplicated to improve reliability. When a stopped control device is started, the setting information of the stopped control device is set to a control state. A method can be provided that is consistent with the configuration information of the control device.
The present invention is directed to a control system including a plurality of control devices that are duplicated to improve reliability. When a plurality of control devices are activated almost simultaneously, one control device is activated in a control state and the other control device is activated. The device can provide a method in which the setting information is matched with the setting information of the control device in the control state, and is started in the standby state.
[Brief description of the drawings]
FIG. 1 shows an outline of a control system in which a control device of the present invention is duplicated.
FIG. 2 shows a schematic flow from when a stopped control device is turned on to when it is activated.
FIG. 3 shows a flow of a dual activation program used in a calculation unit of the control device.
FIG. 4 shows an outline of a control system in which a conventional control device is duplicated.
[Explanation of symbols]
Reference Signs List 10 first control device 11 first calculation unit 12 first database 13 control line 20 second control device 21 second calculation unit 22 second database 23 control line 30 controlled device 40 network

Claims (4)

A step of activating a first control device, which is one of a plurality of duplicate control devices controlling the same control target device;
That the first control device is operating normally in a second control device, which is another control device in the plurality of control devices, and is operating in a control state in which the device is controlled; Determining a first condition including:
When the second control device satisfies the first condition, the first control device tentatively sets the setting information used for controlling the device from the second control device as temporary provisional setting information. Steps to get as
A step in which the first control device compares the temporary setting information with the setting information stored in the first control device, and stores the temporary setting information as regular setting information if different;
including,
How to start the redundant controller. Further, in the step of acquiring the temporary setting information, the first control device includes a step of stopping activation when the acquisition fails.
A method for activating the redundant control device according to claim 1. In the step of the first control device determining that the second control device is the first condition,
Each of the plurality of control devices has a self-diagnosis function, a step of determining whether or not itself is operating normally,
Each of the plurality of control devices, by the self-diagnosis function, whether the device itself is operating in a control state for controlling the device, or determining a status including whether it is operating in a standby state as a spare,
The plurality of control devices are connected via a network, each control device communicates with another control device, information including that the other control device is operating normally, and the status of the other control device. Obtaining the
including,
A method for activating the dual control device according to claim 1. Further, when the first control device is normal and the second control device does not satisfy the first condition, before the first control device starts control, the second control device again executes the Confirming that a first condition is satisfied, and, if so, resetting the first control device.
A method for activating the dual control device according to claim 1.

Images