JP4140615B2 - Data communication method and safety system - Google Patents

Description

  The present invention relates to a data communication method and a safety system applied to a safety system, and more particularly to a data communication method between a controller and an input / output module and a safety system for performing data communication between the controller and the input / output module.

  There is known a plant control system that manages and controls field devices arranged in a plant. Moreover, in such a plant, a safety system for safety of the plant is introduced. The safety system detects important problems related to safety in the plant in the event of a serious disaster such as overflow of toxic chemicals or explosion, and shuts off the valve, disconnects the power of the field equipment, It is a system that executes switching of the internal flow, and is provided as a part of the plant control system or independently of the plant control system.

  The controller of the safety system is connected to the safety field device via an input / output module using individual buses or communication lines arranged in the plant. The controller utilizes safety field equipment to detect process conditions associated with significant events, thereby detecting “events” within the plant. When an event is detected, the controller takes action, such as closing a valve, to mitigate the harmful effects of that event.

  For example, Patent Document 1 describes a communication configuration between a controller and an input / output module in a conventional plant control system.

Japanese Unexamined Patent Publication No. 6-242979

  Safety systems are required to have extremely high reliability due to their intended functions. For example, it is necessary to avoid a situation in which the system recognizes that the system is safe in spite of the occurrence of an abnormality or reports incorrect information. In addition, although the abnormality cannot be clearly recognized, it is necessary to select the safe side process when the possibility of the abnormality is indicated.

  Therefore, in data communication applied to a safety system, it is important to be able to detect all possible communication abnormalities (Repetition, Deletion, Insertion, Re-sequence, Corruption, Delay, Masquerade).

  The present invention has been made to solve the above-described problems, and an object thereof is to realize a data communication method and a safety system with a high abnormality detection rate.

In order to achieve such a subject, the present invention is configured as follows.
(1) In a data communication method of a system comprising an input / output module and a controller,
The input / output module and the controller each have the system setting information by downloading the system setting information created by the controller to the input / output module .
When transmitting a data frame, the data transmission side identifies a transmission / reception target extracted from the setting information held by the data transmission side as a safety code for confirming the safety of data and setting items. A data frame including a setting information CRC code generated based on the setting information held on the data transmission side and a CRC code generated based on the data frame to be transmitted, and adding the safety code to the data Produces
The data receiving side expands the received data frame on the storage means, compares the CRC code in the received safety code with the CRC code generated based on the received data frame, and receives the data of the received data frame After confirming the safety of the device, the device ID in the received safety code is compared with the device ID extracted from the setting information held on the data receiving side, and the safety of the setting items of the received data frame And comparing the setting information CRC code in the received safety code with the setting information CRC code generated based on the setting information held on the data receiving side, and the input / output module and the controller A data communication method characterized by confirming the identity of setting information held by .

( 2 ) The data transmission side includes, as the safety code, a block ID for confirming the storage location of the data frame on the storage means on the data transmission side,
The data receiving side compares the block ID in the received safety code with the address actually sent to confirm the safety of the setting items of the received data frame. 1 ) The data communication method described.

( 3 ) The data transmission side includes an update code for confirming that data is updated as the safety code,
The data receiving side confirms whether the update code in the received safety code has been updated, and checks the safety of the data in the received data frame. (1) or (2) Communication method.

( 4 ) The data communication method according to any one of (1) to ( 3 ), wherein the data is at least one of collective information for each input / output module and individual information for each channel of the input / output module. .

( 5 ) In a safety system that performs data communication between the controller and the input / output module that exchanges signals with the plant,
The input / output module and the controller are configured to store setting information of the safety system by downloading the setting information of the system created by the controller to the input / output module, respectively.
A device ID that identifies a transmission / reception target extracted from the setting information held by the data transmission side as a safety code for confirming the safety of data and setting items when transmitting a data frame on the data transmission side A data frame including a setting information CRC code generated based on the setting information held on the data transmission side and a CRC code generated based on the data frame to be transmitted, and adding the safety code to the data Data frame generating means for generating
On the data receiving side, the received data frame is expanded on the storage means, the CRC code in the received safety code is compared with the CRC code generated based on the received data frame, and the data of the received data frame After confirming the safety of the device, the device ID in the received safety code is compared with the device ID extracted from the setting information held on the data receiving side, and the safety of the setting items of the received data frame And comparing the setting information CRC code in the received safety code with the setting information CRC code generated based on the setting information held on the data receiving side, and the input / output module and the controller A safety code check means for confirming the identity of the setting information held by
A safety system characterized by comprising:

( 6 ) Among the data frames, an input data frame transmitted from the input / output module to the controller has status information of the input / output module,
Output data frame to be transmitted from the controller to the output module, the safety system, characterized (5), wherein further comprising a status information of the controller.

( 7 ) The input / output module has status determination means for determining the status of the input / output module and the status of the controller,
Among the inputs of the status determination unit, the status input unit of the input / output module is asserted and the status of the input / output module is passed to the controller in the input data frame. , Negate the status input part of the controller,
The status determination means is enabled when the status of the controller is received in the output data frame and the status input unit of the controller of the status determination means is asserted by the status ( 5 ) or ( 6 ) The safety system described.

( 8 ) The controller includes status determination means for determining the status of the controller and the status of the input / output module,
Among the inputs of the status determination means, the status input unit of the controller is asserted, and the status of the controller is passed to the input / output module in the output data frame. Negate the status input part of the entry output module,
The status determination unit is enabled when the status of the input / output module is received in the input data frame and the status input unit of the input / output module of the status determination unit is asserted based on the status. The safety system according to any one of ( 5 ) to ( 7 ).

( 9 ) The input / output module passes a fail recovery status informing the failure recovery to the controller in the input data frame,
The controller passes an activation request status requesting activation of the input / output module to the input / output module in the output data frame,
The I / O module passes a startup ready status in the I / O data frame to inform the controller that it is ready to start,
The controller passes a start permission status permitting start to the input / output module in the output data frame,
The safety system according to any one of ( 5 ) to ( 8 ), wherein the input / output module switches from a failsafe operation using failsafe data to a normal operation.

The present invention has the following effects.
By checking the contents of the safety code of the data frame developed on the storage means of the input / output module and the controller, a highly reliable data communication method with a high abnormality detection rate can be realized at low cost.
In addition, data frame reliability is ensured by checking END to END as data on the storage means of the input / output module and controller, so the processing hierarchy until the data is transferred to each other's storage means The communication abnormality detection rate is not affected by the means (physical layer or data link layer).

Hereinafter, the present invention will be described in detail with reference to the drawings.
FIG. 1 is a block diagram showing an embodiment of the present invention.
In FIG. 1, the input / output module 10 converts a signal from the field device 1 into digital data and transmits it to the controller 20, converts the digital data from the controller 20 into an analog signal or a contact signal, and outputs it to the field device 1.
Here, the input module and the output module are described as an integrated input / output module, but the same applies to the case where the input module and the output module have different configurations.

The input / output module 10 establishes an interface with the controller 20 by an internal communication function, and the input / output module 10 and the controller 20 exchange updated data at regular intervals. Through this internal communication, the input / output data generated by the input / output module 10 and the controller 20 are input / output data images on RAMs (Random Access Memory) 11 and 21 mounted on the input / output module 10 and the controller 20, respectively. Be expanded.
The controller 20 can access an arbitrary RAM area of the input / output module 10 using the internal communication function, and the input / output module 10 can access an arbitrary RAM area of the controller 20 using the internal communication function. Is possible.

The input / output data frames 12 and 23 are configured by adding safety codes 122 and 232 to the input / output data 121 and 231.
The input data 121 is input information from the input / output module 10 to the controller 20 and stores, for example, the process amount of the field.
The output data 231 is a setting value from the controller 20 to the input / output module 10 and stores, for example, an operation amount.

FIG. 2 is a diagram showing a frame configuration example of input / output data.
In the input data frame 12, R_CRC 122 a is a CRC (Cyclic Redundancy Check) code for the input data frame 12 and is generated by the input / output module 10. The input / output module 10 transmits the input data frame 12, which is data with the R_CRC 122a, to the controller 20 by internal communication.
The controller 20 expands the received input data frame 22 on the RAM 21 and compares the CRC code attached to the input data frame 22 with the CRC code generated based on the input data frame 22 received on the controller 20 side. Thus, the validity of the received data is confirmed. As a result, the contents of the input data frame 22 are used when the data is normal.
Thereby, it is possible to detect whether the contents of the input data are not changed during the communication.

In the output data frame 23, W_CRC 232a is a CRC code for the output data frame 23 and is generated by the controller 20. The controller 20 transmits the output data frame 23, which is data with the W_CRC 232a, to the input / output module 10 by internal communication.
The input / output module 10 expands the received output data frame 13 on the RAM 11 and generates a CRC code attached to the output data frame 13 and a CRC code generated based on the output data frame 13 received on the input / output module 10 side. And the validity of the received data is confirmed. As a result, the contents of the output data frame 13 are used when the data is normal.
As a result, it is possible to detect whether the contents of the output data are not changed during the communication.

FIG. 3 is a diagram for explaining the operation of the present invention. This figure shows the procedure for confirming the data transmission / reception source.
The setting information 24 is a database in which system operation definitions, input / output module operation definitions, and implementation information are defined, and is determined for each input / output module and each application.
The setting information 24 is created by the controller 20 and downloaded to the input / output module 10 so that the setting information 14 of the controller 20 and the input / output module 10 is equalized.

S_DEVICE_ID 122b and M_DEVICE_ID 232b are device IDs, which store information for the input / output module 10 and the controller 20 to mutually identify the model.
On the data receiving side, the device ID of the received data frame is compared with the device ID set in advance in the setting information 24, 14, and if they match, the contents of the data frame are used, and if they do not match Is not used.

S_CONFIG_CRC 122c and M_CONFIG_CRC 232c are setting information CRC codes, and the CRC codes of the setting information 14 and 24 recognized by the input / output module 10 and the controller 20 are stored.
The S_CONFIG_CRC 122 c that is the CRC of the setting information 14 is generated by the input / output module 10. The controller 20 compares the received S_CONFIG_CRC 222c with the CRC value generated from the setting information 24, and uses the contents of the input data frame 22 if they match, and does not use it if they do not match.

  The controller 20 generates M_CONFIG_CRC 232 c that is a CRC of the setting information 24. The input / output module 10 compares the received M_CONFIG_CRC 132c with the CRC value generated from the setting information 14, and uses the contents of the output data frame 13 when they match, and does not use them when they do not match.

S_BLK_ID 122d and M_BLK_ID 232d are block IDs. Since each input / output data frame is composed of a plurality of blocks, a block number for designating which block is stored.
On the data receiving side, the block ID of the received data frame is compared with the address where the data frame is actually sent, and the contents of the data frame are used if they match, and not used if they do not match.

  As a result, it is possible to confirm that the data transmission source and the data reception source are correctly linked and recognize that they are the same application, and it is possible to prevent erroneous input to the system and erroneous output from the system as a safety system. .

FIG. 4 is a diagram for explaining the operation of the present invention. This figure shows a procedure for confirming data update.
R_UPDATE 122 e is an update counter for the input data frame 12. The input / output module 10 increments R_UPDATE 122e every time the input value is updated. When the controller 20 confirms that the input data has not been updated for a certain period of time, the controller 20 determines that the input data frame has been lost, and determines that the input is abnormal.

W_UPDATE 232 e is an update counter for the output data frame 23. The controller 20 increments W_UPDATE 232e every time the output value is updated. When the input / output module 10 confirms that the output data has not been updated for a certain period of time, the input / output module 10 determines that the output data frame has been lost, and executes necessary fail-safe such as output OFF to the field side.
As a result, it is possible to detect communication abnormalities such as repetition of past data, loss of necessary data, and data delay.

FIG. 5 is a diagram showing another frame configuration example of input / output data.
As the input data frame 12 protected by the safety code 122, information common to the entire module (module collective information) such as SSTR 121a (slave status register) and MDL_STAT 121b (channel common status), CH_STATn 121d (status of each channel), By configuring individual information (channel individual information) such as R_DATAn 121e (input value of each channel) for each channel, immediate access to input data can be easily performed by secure communication.

  In addition, the output data frame 23 protected by the safety code 232 includes information common to the entire module (module batch information) such as MSTR 231a (master status register) and MDL_CTRL 231b (channel common control information), and CH_CTRLn 231d (each channel's information). By configuring individual information (channel individual information) such as control information) or W_DATAn 231e (output value of each channel), immediate access to output data can be easily performed by secure communication.

FIG. 6 is a conceptual diagram of safety communication.
A data frame structure in which a safety code is added to input / output data, and a data communication abnormality can be detected in a safety communication layer that checks the content of the safety code of the data frame developed on the RAM.
Therefore, END to END can be checked as data on the RAM of the input / output module and controller, and the communication error detection rate is affected by the means of the physical layer and data link layer until the data is transferred to the RAM. I will not receive it.

  In the examples so far, data transfer between the input / output module and the controller as safety communication was performed in units of data frames with safety codes, but when transferring large amounts of data such as setting information, A safety code for confirming the safety of data on the data transmission side is added to the data, the data with the safety code is divided and transmitted in order, and the data with the safety code divided on the data reception side is received in the order of reception. The security code on the RAM may be checked by expanding it on the RAM and reconstructing it.

FIG. 7 is a diagram for explaining the operation of immediate access.
The input / output module 10 normally uses the output data frame 13 set from the controller 20, and when the input / output module 10 fails from this state, the input / output module 10 is switched to use the fail-safe data 15 spontaneously.

Thereafter, when the input / output module 10 returns to fail, the RDY 121a1 input part of the status determination means 16 is asserted, and the other input part of the status determination means 16 is negated by the fail return signal. It is.
The RDY 121a1 input unit of the status determination unit 26 is asserted, and the APREQ 121a2 input unit of the status determination units 26 and 27 is also asserted by the fail return signal.
The status determination means 26 is in an invalid state unless there is an activation request 25, and becomes valid when there is an activation request 25.

When the status judging means 26 becomes valid and APACK 231a1 is asserted, the status judging means 16 becomes valid, one input part of the status judging means 17 is asserted, and the ONS 121a3 after a certain time T [ms] when the input / output module is stabilized. Is asserted.
Further, when APACK 231a1 is asserted, APREQ 121a2 is negated, so that status determination means 27 becomes valid and status determination means 26 becomes invalid and APACK 231a1 is negated.

  When the controller 20 confirms that the input / output module 10 is operating normally, it resets the output data frame 23 to a necessary initial value, asserts OUTEN 231a2, and permits the use of the output data frame 13. When the status determination means 17 becomes valid, the fail save data 15 is switched to use of the output data of the output data frame 13, and the input / output module 10 becomes a normal operation.

  Note that the controller 20 negates APACK 231a1 during normal times so that the output does not change suddenly when the input / output module 10 fails again next time.

FIG. 8 is a diagram showing an input / output data frame for immediate access in FIG.
The status of APACK 231a1 and OUTEN 231a2 in FIG. 7 is embedded in the MSTR 231a of the output data frame 23, and the input / output module 10 receives the output data frame 13 and performs processing using the APACK 131a1 and OUTEN 131a2 if there is no abnormality in the data. .
The statuses of RDY 121a1, APREQ 121a2, and ONS 121a3 are embedded in the SSTR 121a of the input data frame 12, and the controller 20 receives the input data frame 22, and performs processing using the RDY 221a1, APREQ 221a2, and ONS 221a3 if there is no abnormality in the data.

These immediate accesses can also be realized by exchanging input / output data frames expanded on the RAM.
In addition, this mechanism can prevent a sudden change in output that causes disturbance to the system when the input / output module fails.
In addition, it is possible to reliably notify the controller that the I / O module has detected a failure even once, and to latch the operation at the time of the failure until the controller gives an instruction. Can do.

It is a block diagram which shows one Example of this invention. It is the figure which showed the example of a frame structure of input-output data. It is operation | movement explanatory drawing of this invention. It is operation | movement explanatory drawing of this invention. It is the figure which showed the example of another frame structure of input-output data. It is a conceptual diagram of safe communication. It is operation | movement explanatory drawing of immediate type | mold access. It is a figure which shows the input-output data frame of the immediate type | mold access of FIG.

Explanation of symbols

10 Input / output module 11 Storage means (RAM)
12 Input data frame 121 Input data 121a-121c Module batch information 121d, 121e Channel individual information 122, 122a-122e Safety code 15 Fail safe data 16, 17, 26, 27 Status judgment means 20 Controller 21 Storage means (RAM)
23 Output data frame 231 Output data 231a to 231c Module batch information 231d and 231e Channel individual information 232 and 232a to 232e Safety code

Claims (9)

In a data communication method of a system consisting of an input / output module and a controller,
The input / output module and the controller have the system setting information by downloading the system setting information created by the controller to the input / output module ,
When transmitting a data frame, the data transmitting side identifies a transmission / reception target extracted from the setting information held by the data transmitting side as a safety code for confirming safety of data and setting items. A data frame including a setting information CRC code generated based on the setting information held on the data transmission side and a CRC code generated based on the data frame to be transmitted, and adding the safety code to the data Produces
The data receiving side expands the received data frame on the storage means, compares the CRC code in the received safety code with the CRC code generated based on the received data frame, and receives the data of the received data frame After confirming the safety of the device, the device ID in the received safety code is compared with the device ID extracted from the setting information held on the data receiving side, and the safety of the setting items of the received data frame And comparing the setting information CRC code in the received safety code with the setting information CRC code generated based on the setting information held on the data receiving side, and the input / output module and the controller A data communication method characterized by confirming the identity of setting information held by . The data transmission side includes, as the safety code, a block ID for confirming the storage location of the data frame on the storage unit of the data transmission side,
Wherein the data receiving side, the block ID in the security code received is compared with the address that has been actually sent, claim, characterized in that to verify the safety of the received data frame set items 1 The data communication method described. The data transmission side includes an update code for confirming that data is updated as the safety code,
3. The data communication method according to claim 1, wherein the data receiving side confirms whether or not the update code in the received safety code is updated, and confirms the safety of the data of the received data frame. . The data communication method according to any one of claims 1 to 3, characterized in that at least one of the individual information for each channel of the bulk information and input and output modules for each input and output module. In a safety system that performs data communication between the input / output module that exchanges signals with the plant and the controller,
The input / output module and the controller are configured to store setting information of the safety system by downloading the setting information of the system created by the controller to the input / output module, respectively.
A device ID that identifies a transmission / reception target extracted from the setting information held by the data transmission side as a safety code for confirming the safety of data and setting items when transmitting a data frame on the data transmission side A data frame including a setting information CRC code generated based on the setting information held on the data transmission side and a CRC code generated based on the data frame to be transmitted, and adding the safety code to the data Data frame generating means for generating
On the data receiving side, the received data frame is expanded on the storage means, the CRC code in the received safety code is compared with the CRC code generated based on the received data frame, and the data of the received data frame After confirming the safety of the device, the device ID in the received safety code is compared with the device ID extracted from the setting information held on the data receiving side, and the safety of the setting items of the received data frame And comparing the setting information CRC code in the received safety code with the setting information CRC code generated based on the setting information held on the data receiving side, and the input / output module and the controller A safety code check means for confirming the identity of the setting information held by
A safety system characterized by comprising: Of the data frames, an input data frame transmitted from the input / output module to the controller has status information of the input / output module,
6. The safety system according to claim 5 , wherein an output data frame transmitted from the controller to the input / output module includes status information of the controller. The input / output module has status determination means for determining the status of the input / output module and the status of the controller,
Among the inputs of the status determination unit, the status input unit of the input / output module is asserted and the status of the input / output module is passed to the controller in the input data frame. , Negate the status input part of the controller,
Receiving a status of the controller in the output data frame, or claim 5, characterized in said status determining means to become effective when the status input section of the controller of the status determination means at said status is asserted 6. The safety system according to 6 . The controller has status determination means for determining the status of the controller and the status of the input / output module,
When the status input unit of the controller is asserted among the inputs of the status determination unit and the status of the controller is passed to the input / output module in the output data frame, Negate the status input part of the entry output module,
The status determination unit is enabled when the status of the input / output module is received in the input data frame and the status input unit of the input / output module of the status determination unit is asserted based on the status. The safety system according to any one of claims 5 to 7 . The input / output module passes a fail return status informing the failure return to the controller in the input data frame,
The controller passes an activation request status requesting activation of the input / output module to the input / output module in the output data frame,
The I / O module passes a startup ready status in the I / O data frame to inform the controller that it is ready to start,
The controller passes a start permission status permitting start to the input / output module in the output data frame,
The safety system according to any one of claims 5 to 8 , wherein the input / output module switches from a fail-safe operation using fail-safe data to a normal operation.

Images