JP2799104B2 - Redundant switching device for programmable controller - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to the improvement of the performance of a redundant standby redundant control type programmable controller.
More particularly, the present invention relates to an optimal duplex switching device for improving performance against instantaneous power failure.

[0002]

2. Description of the Related Art In recent plant control, a control system having higher reliability is required, and improvement of the reliability of a programmable controller which is the core of such a control system is also an important issue.

[0003] Among the techniques for improving reliability, the dual configuration scheme is a commonly used scheme. Further, two programmable controllers are provided, one of which is a regular system for actual control, and the other is a regular system. The standby redundancy control system, which is a standby system that switches from the normal system to perform control when an abnormality occurs in the normal system, is most often used.

[0004] In the standby redundancy control system, a duplex switching device for switching between two programmable controllers can be simplified, and high reliability and low cost can be achieved.

[0005] In this duplex system, it is a serious problem that the service system is switched to the standby system and a difference occurs in the execution state of the plant control.

In particular, a momentary power failure (10 to 20 (msec
c) Even if a momentary power failure occurs, the plant control is continued after the power recovery, and the plant is controlled before the power failure so that there is no difference between the execution states of the plant control before and after the power recovery. The controlled working system and the working system after power recovery must be the same.

[0007] An example of a countermeasure for this problem is disclosed in Japanese Patent Application No. Sho 64-64.
No. 8402 discloses this.

According to this method, during power supply, the output of the duplexing switching circuit is maintained in accordance with the output state of the duplexing switching circuit. There is provided holding means for following the output of the duplex switching circuit, and the output of the duplex switching circuit at the time of power restoration is determined by the output of the holding means.

[0009]

The prior art has the following problems.

In an actual system, first, there is a variation in the internal power supply of each device, the detection of power supply, and the like with respect to the power failure of the original power supply, and the individual power failure recovery timing of each device does not match. Therefore, the abnormal signals transmitted from both systems at the time of a power failure also vary.

Second, the actual duplicated PC ("PC" is
In a switching operation of a program controller, which is often used hereinafter, when the PC-A system under control stops as shown in FIG. 5, the control right shifts from the A system to the B system. However, the system B performs a series of processes such as a process of taking over the control data and parameters of the system A, a process of taking over the program for continuing the program interrupted by the system A, and a process of synchronizing the plant control for synchronizing with the operating plant. In order to avoid the difference in the plant execution state
The PC-B system actually enters the plant control after the switching process by the software is completed.

In the plant control at this time, since the output of the system A is continuously maintained, the switching of the PC is performed only when the output of the duplex switching device is switched from the viewpoint of the controlled plant. Is not performed, but when the switching process by software is completed.

Therefore, switching to software is a complete switching operation of the normal system.

As described above, in the above-described method, when the power supply is momentarily interrupted as shown in FIG.
There is variation in the system internal power supply.
When the power of the system is interrupted, the control right is transferred to the system B, and then the entire power is interrupted. Depending on the variation, the system B is stopped during the switching process. Is in a state of holding the A-system output.

In the above method, the circuit that follows and holds the output of the duplexing switching circuit retains the control right of the B system that has newly obtained the control right even during a power failure, that is, because the priority is transferred to the B system. When the power is restored, the duplex switching circuit gives control to the incomplete B system as a normal system.

Therefore, before the power failure and after the power recovery, since the service system has not completed the switching process, the system is switched to the incomplete B system as the service system. However, there is a problem that a difference occurs in the execution state of the plant.

Such a problem occurs because the information held during the power failure is not the information of the normal system during the execution of the plant control, but the output information of the duplex switching circuit.

[0018] Therefore, an object of the present invention is to provide a system in which plant control is performed even before a power failure occurs after a power failure, even if there is a variation in power failure recovery timing of each device with respect to an instantaneous power failure of the main power supply. Therefore, the continuity of the plant control is maintained so as not to change.

[0019]

To achieve the above object, the following means are conceivable.

A redundant switching device for switching between two programmable controllers provided by a standby redundancy control system, wherein the control is performed by each of the two programmable controllers for controlling a control target. Means for inputting a request signal for the right, a means for selecting one programmable controller by outputting a signal for giving control to only one of the programmable controllers, and two programmable controllers which are simultaneously controlled. And a priority holding means for holding a priority for deciding to give the control right to one of them when the right request signal is output, wherein the selecting means comprises a control right input from two programmable controllers. In response to a request signal from one of the In the duplex switching device which is a means for selecting a gramable controller, the priority holding means is means for holding a priority until the switching process from the regular programmable controller to the standby programmable controller is completed. It is.

Further, the priority holding means may be constituted by a flip-flop.

Further, it is conceivable that the priority holding means has an uninterruptible power supply.

In addition, the priority holding means may be provided with a lithium battery.

[0024]

Operation First, the configuration will be described. PC is A system,
Two B-systems are provided, and the two PCs are connected to the duplex switching device via necessary signal lines. Necessary signal lines include a control right request signal and a priority request signal.

Here, the control right is a right to output information for control to a plant or the like which is the actual control target. For example, when the PC-A system controls the plant, the A system Will have control.

The priority is the right to give control to one of the PCs when two PCs request the control at the same time.

Further, it is assumed that the two PCs are connected to a host computer via a network such as a LAN.

Next, the actual operation will be described. First, the host computer sends P via the network.
A priority selection request pulse for giving a priority to the CA system is transmitted.

This pulse is transmitted to the duplexing switching device as a priority selection request signal, and is provided with a lithium battery or the like and holds a flip-flop (hereinafter abbreviated as “FF”).
Is given information indicating that the system A has priority.

In this state, when both A system and B system are started,
Both systems simultaneously transmit a control right request signal for requesting the control right. However, in the duplex switching device, the control right request signal of the B system is delayed by the information held in the FF that the A system has priority. , A is given a priority, and a control right signal is transmitted to give a control right to the A system. As a result, the system A becomes the service system and the system B becomes the standby system.

Thereafter, for example, when an abnormality occurs in the A system and the A system withdraws the control right request signal, the transmission of the control right signal to the A system is stopped and the control right signal is transmitted to the B system as in the conventional system. . Thus, the service system is switched from the system A to the system B.

Here, if the B system recognizes that the own system is a regular system, it executes a switching process and then transmits a priority selection request pulse by a program, and the F system in the duplexing switching apparatus.
Information to F that B has priority is given.

Thereafter, even if the system A returns, the service system and the priority system are the system B.

Here, the operation when an instantaneous power failure occurs will be described for different cases.

It should be noted that the case is considered separately for each P
C is because the power is not always turned on and off at the same time due to the difference in the performance of the parts even if it is manufactured according to the same specification, and this causes variations in the power on and off.

First, in the first case, the system A first loses power,
This is the case where the system A has been restored first.

In this case, the B system stops the power after continuing the plant control. At this time, the FF holds information indicating that the B system has a priority.

As a result, even if the system A recovers power first and transmits the control right request signal, the FF B
The control right request signal of the A system is delayed according to the information that the system has priority.

Thereafter, when the power of the system B is restored and the control right request signal is transmitted, the system B is selected as the service system without delay, and
The system becomes a standby system.

Next, in the second case, the system A first experiences a power failure,
This is the case where the system B recovers power first.

The system B stops power after continuing the plant control.
At this time, the FF holds information indicating that the B system has the priority.

As a result, when the system B recovers power first and transmits a control right request signal, the system B is selected as a regular system without delay. After this, even if the power of the A system is restored and the control right request signal is transmitted, the A system becomes the standby system because the B system already has the control right.

Next, in the third case, the power supply of the system B is cut off first,
This is the case where the system A has been restored first.

The control right request signal of the B system is cut off, and the control right becomes B
Transfer from system to system A.

When the A system recognizes that its own system has been switched to the regular system, the A system starts switching processing.

If the switching process has not been completed before the A-system power recovery, the A-system has not transmitted the priority selection request signal.
Since the FF keeps the B-system priority, even if the A-system is restored, the control right request signal is delayed, and after the B-system is restored, the B-system becomes a normal system and the A-system becomes a standby system.

If the A-system power outage occurs after the A-system switching process is completed and the priority selection request signal is transmitted, the FF holds information indicating that the A-system has a priority. The system is given priority, and if the system A recovers power first, the system A becomes the regular system and the system B becomes the standby system.

In this case, the system is switched, but the system A, which has become the new regular system, completes the switching process so that there is no difference in the execution state of the plant control, and is completely a regular system. Therefore, no difference occurs in the plant control execution state.

In such a case, the time difference between the power supply variations is larger than the switching processing time. Generally, the power supply variation is several tens of milliseconds, and the switching processing time is on the order of several hundred milliseconds. Therefore, in an actual control system, such a case is extremely small.

Finally, as a fourth case, consider a case in which the system B has been powered down first and the system B has been restored first.

The control right request signal of the B system is cut off, and the control right becomes B
Transfer from system to system A.

When the A system recognizes that its own system has been switched to the regular system, it starts the switching process. However, if the switching process is not completed before the A system power recovery, the A system issues a priority selection request signal. Since it has not been transmitted, the FF holds information indicating that the B system has the priority.

As a result, when the system B recovers power first, the system B is selected as a regular system without delay, and the power A is restored later.
The system becomes a standby system.

When the switching process of the A system is completed, the priority selection request signal is transmitted, and the A system has a power failure after the A system has completely become a normal service system, the FF issues a message indicating that the A system has a priority. In order to retain the information, during the power failure of both systems, the A system has priority, and when the B system recovers power first, the A system becomes the regular system and the B system becomes the standby system.

In such a case, as in the third case, A
Since the system is a completely regular system, there is no difference in the execution state of the plant control. However, as in the third case, such cases are extremely rare.

As described above, even if a momentary power failure occurs and the power supply of each device varies, the system that controlled the plant before the power failure is selected as the normal system after the power recovery. Therefore, there is no difference between the execution states of the plant control before and after the power failure and the continuity of the plant control can be maintained.

[0057]

FIG. 1 shows an embodiment of the present invention.

This embodiment is composed of two PCs (A system 2 and B system 3), a duplex switching device 1 and signal lines.

Further, the two PCs are linked to a host computer via a network such as a LAN, and receive power from a power source (large power source).

Each PC is, for example, CPU, RO
M, RAM, and electronic devices such as an internal power supply.

The duplexing switching device 1 also has a CPU, RO
Each PC is composed of an electronic device such as a RAM, and a voltage is supplied from an internal power supply of each PC via a diode (referred to as a “matching power supply”).

Further, each PC has a signal line for outputting a “priority request signal” requesting “priority”, and a signal for outputting a “control right request signal” requesting “control right”. Various signal lines, such as a control signal line for controlling a plant, are connected. These signal lines are composed of, for example, an electric harness.

Here, the "control right" is a right to output information for control to a plant or the like which is an actual control target. For example, the PC-A system controls the plant. At this time, a "control right signal" is transmitted to the A system, and the A system has the control right. Further, the “priority” is a right to give control to one of the PCs when two PCs request the control at the same time.

Specifically, the PC-A system 2 outputs the A-system priority selection request signal 221 and the A-system control right request signal 201 to the duplexing switching device 1, and the duplexing switching device 1
An A-system control right signal 202 is output to the CA system 2, and similarly, a B-system priority selection request signal 321 and a B-system control right request signal 301 are output from the PC-B system 3 to the duplex switching device 1, The duplexing switching device 1 outputs a B-system control right signal 302 to the PC-B system 3.

Various plants such as a chemical plant and an iron making plant can be considered as plants to be controlled.

FIG. 2 shows an embodiment of the duplex switching device of the present invention.

This embodiment is configured to include an FF, various logic gates, and a battery.

The configuration and function will be described below, and the detailed operation will be described later in the description of FIG.

The priority storage FF 10 having the battery 102
1 to which A-system priority selection request signals 221 and B
The system priority selection request signal 321 is connected.

As the battery 102, for example, an uninterruptible power supply such as a CVCF or a lithium dry battery can be considered.

The priority system storage FF 101 is, for example, a C-MO
It is realized by a logic element such as S.

The output of the FF 101 is an A-system priority selection signal 222, which is converted to a B-system priority selection signal 322 via the inverting gate 103.

Further, a delay circuit 213 is connected to the A-system control right request signal 201 to generate an A-system request delay signal 223 and, together with the A-system priority selection signal 214, the OR gate 21.
4 is input.

The delay circuit 213 has, for example, C-
An A-system OR gate output 224, which is an output of the OR gate 214, which is realized by an electronic device such as a MOS or a resistor, is used as an input of the AND gate 211.

The B-system request delay signal 323 is also input to the OR gate 314 together with the B-system priority selection signal 322, and the output of the B-system OR gate 324 is input to the AND gate 311.

Next, FIG. 3 shows an example of a program for a duplex PC according to the present invention.

The program will be described below.

After the start, the PC requests a control right and turns on a control right request signal.

Next, whether or not the own system is a regular system is determined based on the own system control right signal, and if it is a standby system, a standby system process is executed.
It is determined again whether the own system is a regular system.

If it is determined that the own system is the regular system, the regular system switching process is executed if the regular system switching process has not been performed. Then, by sending a pulse to the priority selection request signal of the own system to the priority system storage FF 101 provided in the duplex switching device 1, the FF 101 inputs own system priority information indicating that the own system has priority. I do.

Thereafter, the ordinary system processing is performed, and if there is no error, it is determined again whether or not the own system is the ordinary system.

If there is an error, the control right request is canceled, the control right request signal of the own system is turned off, and error processing is performed.

Next, the operation for an instantaneous power failure according to the present invention will be described with reference to FIG.

In the initial state, it is assumed that the system A is operating as the normal system, the system B is operating as the standby system, and the system control is performed by the system A.

In the following description, “ON” and “OFF”
Corresponds to the digital signals “high” and “low”.

The initial signal state is that the A-system power supply is normal and the B-system power supply is normal, both systems can operate, and the priority memory F
Since F101 stores the A-system priority information (A-system has priority), the A-system priority selection signal 222 is on, the B-system priority selection signal 322 is off, and the A-system control right The request signal 201 is on, and the B-system control right request signal 301 is on, indicating that both systems can be controlled.

The A-system OR output signal 224 (see FIG. 2), which is another input signal of the AND gate 211, is on and the A-system control prohibition release signal 203 (see FIG. 2) is also on. All inputs are on and AND gate 2
A control right signal 20 which is an output signal of signal 11 (see FIG. 2)
2 is on.

Similarly, the B-system OR output signal 324 (see FIG. 2) which is another input signal of the AND gate 311 (see FIG. 2) is on, but the B-system control inhibition release signal 30
3 (see FIG. 2) is off, and the AND gate 311
The B-system control right request signal 302, which is the output of (see FIG. 2), is off.

Here, the A-system OR output signal 224 (see FIG. 2) is on because of the OR gate 214 (see FIG. 2).
A request delay signal 223 (see FIG. 2) of
Because the A-system priority selection signal 222 is on, the B-system OR
The output signal 324 (see FIG. 2) is on because the B-system request delay signal 323 (see FIG. 2) of the input signals is on.

Here, both systems check the control right of the own system by the program, and determine whether or not the own system is selected as the regular system.

The PC-B system 3 checks the B system control right signal 302, and determines that the own system is the standby system because it is off, performs the standby system processing, and again executes the B system control right signal 30.
The loop for checking 2 is repeated.

The PC-A system 2 checks the A-system control right signal 202, judges that the own system is the regular system because it is on, and executes the switching process if it is the first time that the regular system switching is detected. After that, if it is not the first time, the priority selection request pulse transmission process is performed without performing the switching process.

Thus, the A-system priority selection request signal 221
Is transmitted and input to the priority storage FF101. In this case, since the FF 101 stores the A-system priority information, the A-system priority selection signal 222, which is the output of the FF 101, remains ON, and is inverted by the inversion gate 103 (see FIG. 2). B system priority selection signal 32 which is a signal
2 remains off.

Assuming that the initial state of the FF 101 stores the B-system priority information, the A-system priority selection signal 222 output from the initial FF 101 is turned off, and the inverted B-system priority selection signal 322 Is on, and when the A-system priority selection signal 321 is transmitted, the FF 101
Is switched to A-system priority, A-system priority information is stored (A-system has priority), and the A-system priority selection signal 222 output from the FF 101 is turned on from off. A certain B-system priority selection signal 322 changes from on to off.

Next, an operation in a case where an instantaneous power failure occurs and the A-system internal power supply is turned off first and the B-system internal power supply is turned off later due to variations in the timing of turning on and off the internal power supply due to the difference in PC capacity and the like. Will be described as an example.

When the A-system internal power is turned off, the PC-A system 2 stops, and the A-system control right request signal 201 turns off.

This signal is passed through the delay circuit 213 (see FIG. 2) and the A-system request delay signal 223 (see FIG. 2).
Is also turned off, and the OR gate 2 receiving this signal
14 (see FIG. 2) are all turned off.
The system OR output signal 224 (see FIG. 2) is also turned off, and all the inputs of the AND gate 211 (see FIG. 2) are not turned on, so that the output of the system A control right signal 202 is turned off.

On the other hand, since the A-system control right signal 202 is off, the B-system control prohibition release signal, which is the inverted signal of the A-system control right signal 202, is turned on, and the inputs of the AND gate 311 (see FIG. 2) are all turned on. The B-system control right signal 302 which is the output signal is turned on, and the control right is switched from the A-system to the B-system.

Here, the PC-B system 3 checks the B-system control right signal 302, and if it determines that its own system is the regular system, it is the first time of the regular system switching detection. At the time of execution, the switching process is executed so that there is no difference in the execution state of the plant control.

However, in general, the time difference between the on / off of the power supply is much shorter than the execution time of the switching process. Therefore, after the A system stops, the B system executes the switching process while the B system is executing the switching process. The system power is turned off, and the system B stops with the switching process incomplete and the incomplete working system.

Further, since the switching process is not completed for the B system, and thereafter the B system is stopped without transmitting the B system priority selection request signal 321, the information stored in the FF 101 remains the A system priority state information. is there.

Next, when the power supply of the system B is turned off, all the power supplies of the PC-A system 2 and the PC-B system 3 are also turned off. Request signal 301, B-system request delay signal 32
3, B-system OR output signal 324, B-system control inhibition release signal 3
03, the B-system control right signal 302, and the A-system priority selection signal 222 (for the above signals, see FIG. 2) are turned off.

At this time, the information held in the priority storage FF101 is the information of the A-system priority. However, even if all the power is turned off, the battery 102 is connected to the FF101, so even during the power failure, A-system priority information is held.

Further, the plant keeps the A-system output and keeps the A-system output since the A-system stopped.

Thereafter, when the B-system power supply is turned on, the power supply of the duplexing switching device 1 is restored, and the FF 101 stores the A-system priority in the stored information.
2 is turned on, and the inversion gate 103 (see FIG. 2) receiving this turns off the B-system priority selection signal 322.

Since the A-system control right signal 202 and the B-system control right signal 302 are off, the A-system control prohibition release signal 203 (see FIG. 2) and the B-system control prohibition release signal 303 (see FIG. 2) is turned on.

When the B-system power supply is turned on, the PC-B system 3
The B-system control right request signal 301 is turned on, but among the inputs of the AND gate 311 (see FIG. 2), the B-system OR output signal 3
24 (see FIG. 2), the B-system control right signal 30
2 remains off.

The input of the OR gate 314 (see FIG. 2) is in a state of waiting for the B-system request delay signal 323 to turn on after the delay time because the B-system priority selection signal 322 is off.

On the other hand, the OR gate 214 (see FIG. 2)
Since the A-system priority selection signal 222, which is one of the inputs, is on, the A-system OR output signal 224 (see FIG. 2) is turned on.
As a result, the control right does not transfer to the B system, and the A system is in a startup waiting state.

Thereafter, when the internal power supply of system A rises, P
The CA system 2 turns on the A system control right request signal 201.

As a result, all of the inputs of the AND gate 211 (see FIG. 2) are turned on.
The A-system control right signal 202 which is the output of 1 is turned on.

Since the B-system control right release signal 303 (see FIG. 2) which is an inverted signal of this signal is turned off,
Not all of the inputs of the AND gate 311 (see FIG. 2) are turned on, and the B-system control right signal 302 remains off.

In this way, the system A has the control right, and the system A starts the plant control again from the state where the system A is stopped.

On the other hand, the plant keeps the output of the system A while the PC is stopped. If the system A resumes the plant control after the return of the PC, the continuity of the output state can be maintained. There is no difference in the execution state of the plant control before and after the power failure. As described above, according to the present invention, the priority at the time of power recovery can be controlled by a program, and the PC executing the plant control before the power outage is set to the regular system, and the priority is given to this PC. As a result, the service system after the momentary power failure is made the same system as the service system that was performing plant control before the power failure, and there is no difference between the plant control execution state before the power failure and the plant control execution state after the power recovery, and the continuity of control Can be kept.

[0115]

According to the present invention, the plant-controlled working system does not change before and after the power failure even if there is a variation in the power failure timing of each device with respect to the momentary power failure. Continuity can be maintained.

[Brief description of the drawings]

FIG. 1 is an explanatory diagram of an example of a PC duplex configuration according to the present invention.

FIG. 2 is an explanatory diagram of an embodiment of a duplex switching device according to the present invention.

FIG. 3 is an explanatory diagram of a program example of a PC.

FIG. 4 is an explanatory diagram of an operation at a momentary power failure according to the present invention.

FIG. 5 is an explanatory diagram of a switching operation of a redundant PC.

FIG. 6 is an explanatory diagram of an operation at the time of an instantaneous power failure in the conventional method.

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 1 ... Redundant switching device, 2 ... PC-A system, 3 ... PC-B
System, 101: Priority memory FF, 102: Battery, 201 ...
A-system control right request signal, 301... B-system control right request signal, 2
02 ... A control right signal, 302 ... B control right signal, 22
1 ... A system priority selection request signal, 321 ... B system priority selection request signal, 222 ... A system priority selection signal, 322 ... B system priority selection signal

──────────────────────────────────────────────────続 き Continuing from the front page (72) Ryuichi Watanabe, Inventor 5-2-1 Omika-cho, Hitachi City, Ibaraki Prefecture Hitachi Process Computer Engineering Co., Ltd. (56) References JP-A-63-174101 (JP, A) JP-A-62-79502 (JP, A) JP-A-64-8402 (JP, A) JP-A-3-129403 (JP, A) (58) Fields investigated (Int. Cl. ⁶ , DB name) G05B 9/03 G05B 9/02 G05B 19/048

Claims (4)

(57) [Claims] 1. A redundant switching device for switching between two programmable controllers provided by a standby redundancy control method, for controlling a control object transmitted from each of the two programmable controllers. Means for inputting a request signal for the control right of a request, means for selecting one programmable controller by outputting a signal for giving control only to one programmable controller, and two programmable controllers, When simultaneously outputting a control right request signal, a priority holding means for holding a priority for deciding to give control to one of the two is provided, and the selecting means is input from two programmable controllers. In response to a control right request signal, one of the In a duplex switching device which is a means for selecting a gramable controller, the priority holding means is a means for holding a priority until a switching process from a regular programmable controller to a standby programmable controller is completed. A redundant switching device for a programmable controller, characterized in that: 2. The dual switching device for a programmable controller according to claim 1, wherein said priority holding means comprises a flip-flop. 3. The redundant switching device for a programmable controller according to claim 1, wherein said priority holding means comprises an uninterruptible power supply. 4. The switching device according to claim 1, wherein said priority holding means includes a lithium battery.