JP5995039B2 - Duplex control device abnormality monitoring system and abnormality monitoring method thereof - Google Patents

Description

  The present invention relates to an abnormality monitoring system and an abnormality monitoring method for a redundant control device that monitors an abnormality of a redundant control device in which one control device and at least one input / output device connected thereto via a transmission line are respectively duplexed. In particular, the present invention relates to transmission of status information of an input / output device in a duplex control device and abnormality factor analysis.

  Conventionally, in a control system that requires high reliability, transmission / reception data is mutually monitored between the control device and the input / output device. In this mutual monitoring, for example, the reception data from the other party cannot be received within a certain period of time (fixed period, response monitoring time, etc.), the status information included in the reception data from the other party is abnormally displayed, It is monitored that there is no change in the value of a specific counter or the like included in the received data.

  The mutual monitoring makes it possible for the control device and the input / output device to detect each other's anomaly, transmission line disconnection, and the like. For example, if the data received from the other party cannot be received within a certain time, it can be known that communication interruption due to disconnection of the transmission path or the like has occurred. In addition, the status information in the data received from the other party is monitored, and if the status information does not indicate normality, the cause of the abnormality can be known from the code. Furthermore, if a change in a value such as a specific counter (counted up by software) in the received data from the other party is monitored and it is detected that there is no change, the other party performs normal software processing. You can know that you are not going.

  Furthermore, when even higher reliability is required, the control system is duplicated to provide a main system and a standby system, and control is switched to the standby control apparatus when the main control apparatus is abnormal. At this time, as a method for the standby control device to know the abnormality of the main control device, for example, as shown in FIG. 11, the abnormality of the main control device 901 is transmitted to a dedicated line (that is, a dedicated transmission). And the standby control device 902 via a dedicated line or a transmission line commonly used in a network or a common bus as shown in FIG. A method of mutual monitoring with the system control device 912 is employed. Then, the standby control device that knows the abnormality of the main control device by these methods is supposed to act as a proxy for the system.

  In the duplex system, two circuits in the slave device exchange state information (bit information indicating the health check state) with each other, and the information is duplicated in the master device. Is also known (see Patent Document 1).

JP-A-9-54739

  In the conventional mutual monitoring using the transmission / reception data including the case of the duplex control device shown in FIG. 11 and FIG. 12, the data sent from the other party can be analyzed to know the cause of the abnormality of the other party. There is an advantage.

  However, if data from the other party cannot be received, it cannot be determined whether the cause is a disconnection of the transmission path, a failure in the transmission circuit, or an abnormality that prevents data transmission to the other party. There are drawbacks.

  An object of the present invention is to provide an abnormality monitoring system for a redundant control apparatus and an abnormality monitoring method thereof capable of performing a detailed analysis of an abnormality factor.

  The present invention performs abnormality monitoring for a duplex control device in which one control device and at least one input / output device connected to the control device via a transmission line are duplexed. If one of the control device and at least one input / output device connected to the control device via a transmission path is a main system and the other is a standby system, the description in the claim can be expressed by [ 1) as well as the case of [2] in which the main system and the standby system are reversed, and one of [1] and [2] can be realized, and [1] And the case where both of [2] can be realized.

That is, the present invention is an abnormality monitoring system for a duplexed control device for monitoring an abnormality of a duplexed control device in which one control device and at least one input / output device connected thereto via a transmission line are duplexed,
Received data from the input / output device ([1] main input / output device; [2] standby input / output device) is monitored, and the control device ([1] main control device; [ 2] Execute processing to change the input / output device monitoring information of the own system ([1] main system; [2] standby system) stored in the input / output device monitoring information storage means provided in the standby control device) Input / output device monitoring processing means provided in the control device ([1] main system control device; [2] standby system control device);
Input / output device monitoring information of the own system ([1] main system; [2] standby system) stored in the input / output device monitoring information storage means is transferred to the control device ([1] main system control device; [2] standby). System control device) to the input / output device of the own system ([1] main system; [2] standby system) via a transmission path ([1] main system transmission path; [2] standby system transmission path) Control device ([1] main system control device; [2] standby system control device) or input / output device ([1] main system input / output device; [2] standby system input) Downlink transmission processing means provided in the output device),
Data received from the control device ([1] main control device; [2] standby control device) is monitored, and the input / output device ([1] main input / output device; [2] is monitored based on the monitoring result. ] The local area ([1] main system area; [2] standby system area) of the input / output device status information stored in the input / output device status information storage means provided in the standby input / output device) is changed. State information change processing means provided in an input / output device ([1] primary system input / output device; [2] standby system input / output device) that executes processing;
Input / output device status information storage means ([1] Input / output device status information storage means provided in main input / output device; [2] Input / output device status information storage means provided in standby input / output device) The process of transmitting the input / output device status information stored in the input / output device via the transmission line ([1] transmission process from the primary input / output device to the standby input / output device; [2] A transmission side ([1] main system side; [2] standby system side) or a reception side ([1] standby system side; executing transmission processing from the standby input / output device to the main input / output device). [2] Input / output device transmission processing means provided in the input / output device on the main system side);
Receive data from input / output devices of other systems ([1] main system, ie other system viewed from the standby system; [2] standby system, ie other system viewed from the main system), and based on this monitoring result Other system region of input / output device state information stored in the input / output device state information storage means ([1] Main system region, that is, another system region viewed from the standby system; [2] Standby system region, that is, viewed from the main system And a mutual monitoring processing means between input / output devices provided in the input / output device ([1] standby input / output device; [2] main system input / output device), ,
The input / output device status information stored in the input / output device status information storage means is transferred from the input / output device ([1] standby input / output device; [2] main input / output device) to the local control device ([ 1) input / output device ([1] standby system input / output device; [2] main system control device; [2] main system control device) that executes processing for transmission via a transmission path An upstream transmission processing means provided in an input / output device) or a control device ([1] standby control device; [2] main control device);
I / O device status information included in the received data from the I / O device ([1] standby I / O device; [2] main I / O device) is monitored, and other areas of the I / O device status information ( [1] Main system area, that is, another system area as viewed from the standby system; [2] Standby system area, that is, another system area as viewed from the main system), is stored in the other system ( [1] A control device ([1]) that executes processing for changing I / O device monitoring information of the main system, that is, another system viewed from the standby system; [2] the standby system, that is, another system viewed from the main system) Monitoring information change processing means provided in a standby control device; [2] a main control device);
Input / output device monitoring information of another system ([1] main system, that is, another system viewed from the standby system; [2] standby system, that is, another system viewed from the main system) stored in the input / output device monitoring information storage means ([1] Transmission processing from the standby control device to the main control device; [2] From the main control device to the standby control device) Transmission processing) is provided in a control device on the transmission side ([1] standby system side; [2] main system side) or reception side ([1] main system side; [2] standby system side). Transmission processing means between control devices;
Received data from a control device of another system ([1] standby system, that is, another system viewed from the main system; [2] main system, that is, another system viewed from the standby system) is monitored and included in the received data Other system (because it is information of another system as seen from another system, it eventually corresponds to information of its own system. Therefore, [1] main system, that is, other system as seen from standby system; [2] standby system, That is, the input / output device via the other system ([1] via the standby system; [2] via the main system) stored in the input / output device monitoring information storage means by the input / output device monitoring information of the other system as viewed from the main system A mutual monitoring processing means between control devices provided in a control device ([1] main system control device; [2] standby system control device) that executes processing for changing monitoring information;
I / O device monitoring information stored in the I / O device monitoring information storage means ([1] main system; [2] standby system) and other systems ([1] via standby system; [2] via main system) And an abnormality factor analysis processing means provided in the control device ([1] main system control device; [2] standby system control device) that executes the abnormality factor analysis processing using the input / output device monitoring information of FIG. It is characterized by comprising.

  Here, for “downlink transmission processing means”, “control device ([1] main control device; [2] standby control device) or input / output device ([1] main input / output device; [2 ] “Downlink transmission processing means provided in the standby input / output device” means that the “downlink transmission processing means” provided in the control device transfers the information stored in the control device to the input / output device. In other words, the “downlink transmission processing means” provided in the input / output device may perform the process of acquiring the information stored in the control device. The same applies to the following inventions.

  Further, regarding the “transmission processing means between input / output devices”, “on the transmission side ([1] main system side; [2] standby system side) or on the reception side ([1] standby system side; [2] main system side) “Transmission processing means between input / output devices provided in the input / output device” means that “transmission processing means between input / output devices” provided in the input / output device on the transmission side is connected to the input / output device on the transmission side. The stored information may be transmitted to the input / output device on the reception side, and the "transmission processing means between input / output devices" provided in the input / output device on the reception side is connected to the input / output device on the transmission side. This is to the effect that processing for obtaining stored information may be performed. The same applies to the following inventions.

  Further, regarding the “upstream transmission processing means”, “input / output device ([1] standby input / output device; [2] main input / output device) or control device ([1] standby control device; [2 ] "Uplink transmission processing means provided in the main control device" means that the "uplink transmission processing means" provided in the input / output device transmits the information stored in the input / output device to the control device. In other words, the “uplink transmission processing means” provided in the control device may perform processing for acquiring information stored in the input / output device. The same applies to the following inventions.

  For the “inter-control device transmission processing means”, the control on the “transmission side ([1] standby system side; [2] main system side) or the reception side ([1] main system side; [2] standby system side)” is performed. `` Inter-control device transmission processing means provided in the device '' means that the `` inter-control device transmission processing means '' provided in the transmission-side control device stores information stored in the transmission-side control device, Processing for transmission to the control device on the reception side may be performed, and “inter-control device transmission processing means” provided in the control device on the reception side performs processing for acquiring information stored in the control device on the transmission side. It is a good idea. The same applies to the following inventions.

  In such an abnormality monitoring system for a redundant control device of the present invention, the input / output device monitoring processing means provided in the control device ([1] main system control device; [2] standby system control device) Information indicating the monitoring results of the input / output devices of the system ([1] main system; [2] standby system) is directly obtained. On the other hand, transmission processing from the control device to the own input / output device by the downlink transmission processing means, update processing of the own area of the input / output device status information by the status information change processing means provided in the input / output device, input / output device Transmission processing between input / output devices by inter-transmission processing means, update processing of other areas of input / output device status information by mutual monitoring processing means between input / output devices provided in the input / output devices, input / output devices by upstream transmission processing means From the control device to the own system, update processing of I / O device monitoring information of the other system by the monitoring information change processing means provided in the control device, transmission processing between the control devices by the inter-control device transmission processing means, control By performing update processing of the input / output device monitoring information via the other system in this order by the mutual monitoring processing means between the control devices provided in the device, information indicating the monitoring result of the own input / output device is obtained. From the control device ([1] main system control device; [2] standby system control device) to the own system ([1] main system; [2] standby system) I / O device, other system ([1] standby) System; [2] main system I / O device, and other system ([1] standby system; [2] main system) control device in this order, making a round of control device ([1] main system) System control device; [2] standby system control device), the information indicating the monitoring result of its own input / output device is transmitted via another system ([1] via standby system; [2] main Via the system). Further, information indicating the monitoring result obtained in the middle of the information transmission path via the other system is also transmitted to the control device ([1] main system control device; [2] standby system control device). Come. For this reason, even when data transmission / reception with the input / output device of the own system ([1] main system; [2] standby system) through the transmission line is interrupted, the state of the input / output device of the own system can be known. Thus, the abnormality factor analysis processing means provided in the control device ([1] main system control device; [2] standby system control device) allows the input / output device monitoring information of the own system to be input via the other system. By using the output device monitoring information, it is possible to determine various abnormal factors, and the object is achieved by these.

  In the health check system described in Patent Document 1 described above, two circuits that exchange state information (bit information indicating the health check state) with each other are shared by the two upper control units on the master side. Since it is a circuit provided in one slave device, the health check processing by this system is processing performed in one input / output device. On the other hand, the present invention is directed to a duplex control device in which input / output devices subordinate to each of the duplex control devices (in the above-described Patent Document 1, two higher-order control units) are provided. It is different in that it performs abnormality monitoring.

  In addition, since such a duplexed control device is subject to abnormality monitoring, in the present invention, status information is exchanged between the duplexed input / output devices. However, the health check system described in Patent Document 1 described above is used. In the first place, since slave devices are not duplicated, status information cannot be exchanged between slave devices. For this reason, from Patent Document 1, as in the present invention, by exchanging state information between duplicated input / output devices, an information transmission path via another system is formed and used for abnormality factor analysis. There is no motivation to come up with the idea of doing.

  As specific configurations for analyzing various abnormal factors, the following configurations of <Case 1> to <Case 5> can be given.

  <Case 1: When it is determined that the upload side (upstream transmission line) of the own transmission line is disconnected>

  That is, in the above-described abnormality monitoring system for the redundant control device, when the input / output device monitoring processing unit detects that the received data from the input / output device has been interrupted, the input / output device monitoring of the own system indicating the monitoring result As information, it is configured to execute processing for storing information indicating reception data disruption in the input / output device monitoring information storage means, and the downlink transmission processing means indicates reception data disruption as its own input / output device monitoring information. It is configured to execute processing for transmitting information from the control device to the own input / output device, and the status information change processing means receives the received data as the own input / output device monitoring information in the received data from the control device. If the received data disruption is received from the control device, the local area of the input / output device status information stored in the input / output device status information storage means is received. The inter-input / output device transmission processing means indicates to the input / output device state information storage means that the received data interruption has been received from the control device as input / output device state information. When the information is stored, it is configured to execute a process of transmitting information indicating that the received data disruption has been received from the control device to another input / output device, and the mutual monitoring processing means between the input / output devices If the received data from the input / output device of the other system includes information indicating that the received data interruption has been received from the control device as the input / output device status information, the input / output device status information storage means The other system region of the stored input / output device status information is configured to execute processing for changing to information indicating that the received data interruption has been received from the control device. If the other system area of the input / output device status information stored in the information storage means is information indicating that a reception data interruption has been received from the control device, it indicates that the reception data interruption has been received from the control device. It is configured to execute processing for transmitting information from the input / output device to its own control device, and the monitoring information change processing means is provided in the other system area of the input / output device status information included in the received data from the input / output device. If the received data disruption information is received from the control device, the other input / output device monitoring information stored in the input / output device monitoring information storage means is received from the control device. The inter-control device transmission processing means interrupts the received data from the control device as the other input / output device monitoring information in the input / output device monitoring information storage means. If the information indicating that the received data has been received is stored from the control device, the information indicating that the received data disruption has been received is transmitted to the control device of the other system. If the received data from the control device of the other system includes information indicating that the received data interruption has been received from the control device as the input / output device monitoring information of the other system, the mutual monitoring processing means The input / output device monitoring information via another system stored in the device monitoring information storage means is configured to execute processing to change to information indicating that the received data disruption has been received from the control device, and the abnormality factor analysis processing means is In the input / output device monitoring information storage means, information indicating the reception data interruption is stored as the input / output device monitoring information of the own system, and the reception data interruption from the control device as the input / output device monitoring information via the other system is stored. When information indicating that the communication has been received is stored, the upstream of the local system ([1] main system; [2] standby system) from the local input / output device to the local control device in the transmission path It can be set as the structure which performs the process which judges that the transmission line is disconnected.

  In such a configuration (invention of case 1), the input / output device monitoring processing means provided in the control device ([1] main system control device; [2] standby system control device) As the input / output device monitoring information of the system ([1] main system; [2] standby system), information indicating reception data disruption is created and the input / output device ([1] main system input / output device; [2 ] Indicates that the received data disruption has been received from the control device ([1] main control device; [2] standby control device) by the state information change processing means provided in the standby input / output device). Information is created, and this information passes through the input / output device of the other system ([1] standby system; [2] main system) and the control apparatus of the other system ([1] standby system; [2] main system). Are transmitted to the control device ([1] main system control device; [2] standby system control device) and routed to another system ([1] standby system). (2) Via the main system) I / O device monitoring information is obtained, and by combining these information, the upstream transmission path of the local system ([1] main system; [2] standby system) is disconnected. It becomes possible to judge that it is.

  <Case 2: When it is determined that both the upload side (upstream transmission path) and the download side (downstream transmission path) of the own transmission path are disconnected>

  In the above-described abnormality monitoring system for the redundant control device, when the input / output device monitoring processing unit detects that the data received from the input / output device has been interrupted, it monitors the local input / output device indicating the monitoring result. When information indicating reception data disruption is stored as information in the input / output device monitoring information storage means, and the state information change processing means detects that the reception data from the control device is disrupted Is configured to execute processing for changing the own area of the input / output device status information stored in the input / output device status information storage means to information indicating reception data disruption, and the inter-input / output device transmission processing means includes: If the information indicating the reception data interruption is stored as the input / output device state information in the input / output device state information storage means, the information indicating the reception data interruption is stored in the input / output of the other system. The inter-input / output device mutual monitoring processing means includes information indicating reception data disruption as input / output device status information in the received data from other input / output devices. In this case, the other area of the input / output device status information stored in the input / output device status information storage means is configured to execute processing to change to information indicating reception data disruption. When the other system area of the input / output device status information stored in the input / output device status information storage unit is information indicating the reception data disruption, the information indicating the reception data disruption is transmitted from the input / output device to the own system. The monitoring information change processing means is configured to execute processing to be transmitted to the control device, and the other area of the input / output device status information included in the received data from the input / output device is information indicating reception data disruption. In The other-system input / output device monitoring information stored in the input / output device monitoring information storage means is configured to execute processing for changing the received data disruption information to the inter-control device transmission processing means. When information indicating reception data interruption is stored in the monitoring information storage means as the other system input / output device monitoring information, a process of transmitting information indicating reception data interruption to the other system control device is executed. If the received data from the control device of the other system includes information indicating the reception data interruption as the input / output device monitoring information of the other system, The apparatus monitoring information storage means is configured to execute processing for changing the input / output device monitoring information via another system to information indicating reception data disruption, and the abnormality factor analysis processing means stores the input / output device monitoring information storage. To the means When the information indicating the reception data interruption is stored as the input / output device monitoring information of the own system and the information indicating the reception data interruption is stored as the input / output device monitoring information via the other system, Among them, the upstream transmission path of the own system ([1] main system; [2] standby system) from the own input / output device to the own control device and the own control device to the own input / output device It is possible to perform a process of determining that both of the downlink transmission paths of the own system ([1] main system; [2] standby system) are disconnected.

  In such a configuration (invention of case 2), the input / output device monitoring processing means provided in the control device ([1] main system control device; [2] standby system control device) As the input / output device monitoring information of the system ([1] main system; [2] standby system), information indicating reception data disruption is created and the input / output device ([1] main system input / output device; [2 The state information change processing means provided in the standby input / output device) creates information indicating the reception data disruption as the own region of the input / output device state information, and this information is stored in the other system ([1] The control device ([1] main system control device; [2] main system) via the input / output device of the standby system [[2] main system) and the control device of the other system ([1] standby system; [2] main system); 2] Standby system control device) and monitoring I / O devices via other systems ([1] via standby system; [2] via main system) By combining these pieces of information, the upstream transmission path of the own system ([1] main system; [2] standby system) and the own system ([1] main system; [2] standby system) It is possible to determine that both of the downstream transmission lines are disconnected.

  <Case 3: When determining that the transmission circuit of the local input / output device is faulty>

  In the above-described abnormality monitoring system for the redundant control device, the input / output device is provided with self-diagnosis processing means for executing a process for self-diagnosis of a failure of the transmission circuit provided in the input / output device. When it is detected that the received data from the input / output device has been interrupted, the processing means stores information indicating the reception data disruption as the input / output device monitoring information of the own system indicating the monitoring result. The status information change processing means is configured to execute processing to be stored in the input / output device, and when the failure of the transmission circuit is detected by the self-diagnosis processing means, the input / output device stored in the input / output device status information storage means It is configured to execute processing for changing the own area of the state information to information indicating a transmission circuit failure, and the input / output device transmission processing means is connected to the input / output device state information storage means. When information indicating a transmission circuit failure is stored as status information, the information indicating the transmission circuit failure is transmitted to another input / output device. When the received data from the input / output device of another system includes information indicating the transmission circuit failure as the input / output device status information, the input / output device stored in the input / output device status information storage means It is configured to execute a process of changing the other area of the state information to information indicating a transmission circuit failure, and the upstream transmission processing means includes the other system of the input / output apparatus state information stored in the input / output apparatus state information storage means. When the area is information indicating a transmission circuit failure, the information indicating the transmission circuit failure is configured to be transmitted from the input / output device to the local control device. From the input / output device When the other area of the input / output device status information included in the received data is information indicating a transmission circuit failure, the other input / output device monitoring information stored in the input / output device monitoring information storage means is transmitted. It is configured to execute processing for changing to information indicating a circuit failure, and the inter-control device transmission processing means stores information indicating a transmission circuit failure as input / output device monitoring information of another system in the input / output device monitoring information storage means. In the case where the information indicating the transmission circuit failure is transmitted to the control device of the other system, the mutual monitoring processing means between the control devices is configured to receive data from the control device of the other system. If the information indicating the transmission circuit failure is included as the other-system input / output device monitoring information, the other-system input / output device monitoring information stored in the input / output device monitoring information storage means Change to information indicating The abnormality factor analysis processing means stores the information indicating the reception data disruption as its own input / output device monitoring information in the input / output device monitoring information storage means, and the input through the other system. When information indicating a transmission circuit failure is stored as the output device monitoring information, it is determined that the transmission circuit of the input / output device of the own system ([1] main system; [2] standby system) has failed. It can be set as the structure which performs a process.

  In the case of such a configuration (invention of case 3), the input / output device monitoring processing means provided in the control device ([1] main system control device; [2] standby system control device) As the input / output device monitoring information of the system ([1] main system; [2] standby system), information indicating reception data disruption is created and the input / output device ([1] main system input / output device; [2 When the transmission circuit failure is detected by the self-diagnosis processing means provided in the standby input / output device, the input / output device ([1] main input / output device; [2] standby system input) The status information change processing means provided in the output device) creates information indicating a transmission circuit failure as its own region of the input / output device status information, and this information is stored in another system ([1] standby system; [2 ] Via the input / output device of the main system and the control device of the other system ([1] standby system; [2] main system) As input / output device monitoring information transmitted to the control device ([1] main system control device; [2] standby system control device) via other systems ([1] via the standby system; [2] via the main system) Thus, by combining these pieces of information, it is possible to determine that the transmission circuit of the input / output device of the own system ([1] main system; [2] standby system) has failed.

  <Case 4: When determining whether the local I / O device is out of control or reset>

  Further, in the above-described abnormality monitoring system for the redundant control device, the input / output device monitoring processing means detects its own input / output device indicating the monitoring result when it detects that the received data from the input / output device is interrupted. As information, it is configured to execute processing for storing information indicating reception data disruption in the input / output device monitoring information storage means, and the inter-input / output device mutual monitoring processing means receives received data from other input / output devices. When it is detected that the interruption has occurred, the other area of the input / output device status information stored in the input / output device status information storage means is configured to execute processing to change to information indicating other system monitoring abnormality, The upstream transmission processing means, when the other system area of the input / output device status information stored in the input / output device status information storage means is information indicating the other system monitoring abnormality, displays information indicating the other system monitoring abnormality. , The monitoring information change processing means is configured to execute processing for transmission from the output device to the local control device, and the other system area of the input / output device status information included in the received data from the input / output device is abnormal for other system monitoring. If the information is the information indicating that the other system I / O device monitoring information stored in the I / O device monitoring information storage means is changed to the information indicating the other system monitoring abnormality, the control is performed. When the information indicating the other system monitoring abnormality is stored in the input / output device monitoring information storage means as the other system input / output device monitoring information, the inter-device transmission processing means stores the information indicating the other system monitoring abnormality, It is configured to execute processing to be transmitted to the control device of the other system, and the mutual monitoring processing means between the control devices indicates the other system monitoring abnormality as the input / output device monitoring information of the other system to the received data from the control device of the other system. If the information shown is included The input / output device monitoring information storage means stores the other-system input / output device monitoring information to be changed to information indicating other-system monitoring abnormality, and the abnormality factor analysis processing means includes the input / output device. When the monitoring information storage means stores information indicating reception data disruption as its own input / output device monitoring information, and information indicating other system monitoring abnormality as input / output device monitoring information via another system May be configured to execute processing for determining that the input / output device of the own system ([1] main system; [2] standby system) is runaway or reset, or other abnormality.

  In such a configuration (invention of case 4), the input / output device monitoring processing means provided in the control device ([1] main system control device; [2] standby system control device) As the input / output device monitoring information of the system ([1] main system; [2] standby system), information indicating reception data disruption is created and the input / output device ([1] standby system input / output device; [2 The information indicating the other system monitoring abnormality ([1] main system monitoring abnormality; [2] standby system monitoring abnormality) is created by the mutual monitoring processing means between the input / output devices provided in the main input / output device). This information passes through the control device ([1] standby control device; [2] main control device) to which the input / output device that created this information is subordinate. System control device; [2] standby system control device) via other system ([1] standby system; [2] main (Via)), it is obtained as I / O device monitoring information, and by combining these information, runaway or reset of the I / O device of the own system ([1] main system; [2] standby system) or reset or other abnormality It becomes possible to judge.

  <Case 5: When determining that the download side (downstream transmission line) of the transmission line of the own system is disconnected>

  In the case 5, unlike the cases 1 to 4, the abnormality factor is determined without using the information transmission path via the other system. Therefore, in order to clarify the information flow, [1], The case of [2] will be described in detail.

That is, in the abnormality monitoring system of the redundant control device described above,
The state information change processing means ([1] state information change processing means provided in the primary input / output device; [2] state information change processing means provided in the standby input / output device) is connected to the control device ([ 1) main control device; [2] standby control device), it is detected that the input / output device status information stored in the input / output device status information storage means is The system area ([1] main system area; [2] standby system area) is configured to execute a process of changing to information indicating the disruption of received data,
The upstream transmission processing means ([1] primary upstream transmission processing means; [2] standby upstream transmission processing means) is a local area of the input / output device status information stored in the input / output device status information storage means ( When [1] main system area; [2] standby system area) is information indicating reception data interruption, information indicating reception data interruption is input to an input / output device ([1] main input / output device). And [2] the standby input / output device) to the local control device ([1] main control device; [2] standby control device).
The monitoring information change processing means ([1] monitoring information change processing means provided in the main control device; [2] monitoring information change processing means provided in the standby control device) is connected to the input / output device ([1 ] I / O device of main system; [2] I / O device status information included in received data from standby I / O device) is monitored, and its own area ([1] main system area) And [2] standby system area) also executes processing for changing the input / output device monitoring information of the own system ([1] main system; [2] standby system) stored in the input / output device monitoring information storage means, When the own system area ([1] main system area; [2] standby system area) of the input / output device status information is information indicating the interruption of the received data, the own data stored in the input / output device monitoring information storage means is stored. Input / output device monitoring information for the system ([1] main system; [2] standby system) Force device; [2] is configured to perform a process of changing the information indicating the reception of the received data interruption from the input and output device) of the standby system,
The abnormality factor analysis processing means stores the input / output device ([1] main system input / output as input / output device monitoring information of its own system ([1] main system; [2] standby system) in the input / output device monitoring information storage means. Apparatus; [2] When information indicating that reception data interruption has been received from the standby system input / output device) is stored, the local system ([1] main system; [2] standby system) ) Control device to the own system ([1] main system; [2] standby system) I / O device ([1] main system; [2] standby system) downlink transmission line is disconnected It can be set as the structure which performs the process judged to be.

  In such a configuration (invention of case 5), state information change processing means ([1] state information change processing means provided in the main input / output device; [2] standby input / output device) The status information change processing means provided in the information is generated to indicate information indicating the interruption of the received data, and this information is the control device ([1] master control device to which the input / output device that created this information is subordinate. [2] Standby system control device), and I / O device monitoring information of the own system ([1] main system; [2] standby system) is obtained. It is possible to determine that the downstream transmission path of the main system; [2] standby system) is disconnected.

  Therefore, for other abnormal factors, it is possible to make a determination using the information transmission path via the other system, but do not use the information transmission path via the other system as in this case. It is also possible to determine the cause of the abnormality.

  Further, as an abnormality monitoring method for the duplexing control apparatus realized by the above-described abnormality monitoring system for the duplexing control apparatus of the present invention, the following abnormality monitoring method for the duplexing control apparatus of the present invention can be cited.

That is, the present invention is an abnormality monitoring method for a duplexing control device for monitoring an abnormality of a duplexing control device in which one control device and at least one input / output device connected thereto via a transmission line are duplexed,
The input / output device monitoring processing means provided in the control device ([1] main system control device; [2] standby system control device) is connected to the input / output device ([1] main system input / output device; [2]. Received data from a standby input / output device) is monitored, and input / output device monitoring information provided in a control device ([1] main control device; [2] standby control device) based on the monitoring result Executing processing for changing the input / output device monitoring information of the own system ([1] main system; [2] standby system) stored in the storage means;
Provided in the control device ([1] main system control device; [2] standby system control device) or input / output device ([1] main system input / output device; [2] standby system input / output device) The downlink transmission processing means transmits the input / output device monitoring information of the own system ([1] main system; [2] standby system) stored in the input / output device monitoring information storage means to the control device ([1] main system control). Transmission path ([1] main transmission path; [2] standby system) from the device; [2] standby control apparatus) to the input / output device of the own system ([1] main system; [2] standby system) Execute the process to transmit via the transmission path)
The state information change processing means provided in the input / output device ([1] main system input / output device; [2] standby system input / output device) is connected to the control device ([1] main system control device; [2]. Received data from the standby control device) is monitored, and the input / output device provided in the input / output device ([1] main system input / output device; [2] standby system input / output device) based on the monitoring result A process of changing the own system area ([1] main system area; [2] standby system area) of the input / output device status information stored in the status information storage means;
Transmission processing means between input / output devices provided in an input / output device on the transmission side ([1] main system side; [2] standby system side) or reception side ([1] standby system side; [2] main system side) Are input / output device status information storage means ([1] input / output device status information storage means provided in the primary input / output device; [2] input / output device status information storage provided in the standby input / output device. A process of transmitting the input / output device status information stored in the means) between the input / output devices via the transmission path ([1] a transmission process from the primary input / output device to the standby input / output device; 2] Execute transmission processing from the standby input / output device to the main input / output device)
The mutual monitoring processing means between the input / output devices provided in the input / output device ([1] standby system input / output device; [2] main system input / output device) is connected to another system ([1] main system, ie standby system). [2] The received data from the input / output device of the standby system, that is, the other system viewed from the main system) is monitored, and the input data stored in the input / output device status information storage means based on the monitoring result Execute processing to change another system area of the output device status information ([1] main system area, that is, another system area viewed from the standby system; [2] standby system area, that is, another system area viewed from the main system). ,
Provided in the input / output device ([1] standby system input / output device; [2] main system input / output device) or control device ([1] standby system control device; [2] main system control device) The upstream transmission processing unit automatically transmits the input / output device state information stored in the input / output device state information storage unit from the input / output device ([1] standby input / output device; [2] main input / output device). A process of transmitting via a transmission path to a system control device ([1] standby system control device; [2] main system control device),
The monitoring information change processing means provided in the control device ([1] standby system control device; [2] main system control device) is the input / output device ([1] standby system input / output device; [2] main system). The input / output device status information included in the received data from the system input / output device) is monitored, and the other system region of the input / output device status information ([1] main system region, that is, the other system region viewed from the standby system; 2] Other system stored in the input / output device monitoring information storage means by the standby system area, that is, another system area viewed from the main system ([1] Main system, that is, other system viewed from the standby system; [2] Execute processing to change I / O device monitoring information of the standby system, that is, the other system as seen from the main system)
Transmission processing means between control devices provided in the control device on the transmission side ([1] standby system side; [2] main system side) or reception side ([1] main system side; [2] standby system side) Input / output device monitoring information of another system ([1] main system, that is, another system viewed from the standby system; [2] standby system, that is, another system viewed from the main system) stored in the input / output device monitoring information storage means ([1] Transmission processing from the standby control device to the main control device; [2] From the main control device to the standby control device) Transmission processing)
The mutual monitoring processing means between the control devices provided in the control device ([1] main system control device; [2] standby system control device) is another system ([1] standby system, ie, other as viewed from the main system). System; [2] Since the received data from the control device of the main system, that is, the other system as viewed from the standby system, is monitored, the other system included in this received data (the information of the other system as viewed from the other system, Therefore, it corresponds to the information of the own system, so: [1] main system, that is, other system as viewed from the standby system; [2] standby system, that is, other system as viewed from the main system). , Executing processing for changing the input / output device monitoring information stored in the input / output device monitoring information storage means via the other system ([1] via the standby system; [2] via the main system),
The abnormality factor analysis processing means provided in the control device ([1] main control device; [2] standby control device) is connected to the own system ([1] main control device stored in the input / output device monitoring information storage means). The abnormal cause analysis processing is executed using the input / output device monitoring information of the system; [2] standby system) and the input / output device monitoring information via another system ([1] via the standby system; [2] via the main system). It is characterized by this.

  In such an abnormality monitoring method for a duplexing control apparatus of the present invention, the actions and effects obtained by the above-described abnormality monitoring system for a duplexing control apparatus of the present invention can be obtained as they are, thereby achieving the object.

  Also, in the abnormality monitoring method for the duplexing control apparatus of the present invention, the cases 1 to 5 can be adopted as in the case of the abnormality monitoring system for the duplexing control apparatus of the present invention described above.

  As described above, according to the present invention, transmission is performed between duplicated input / output devices, and an information transmission path via another system is formed. Because the control device can obtain the status information of its own input / output device, detailed analysis of the cause of the abnormality can be performed even if data transmission / reception with the own input / output device via the transmission line is interrupted. There is an effect that can be done.

1 is an overall configuration diagram of an abnormality monitoring system for a redundant control device according to an embodiment of the present invention. The figure of the flowchart which shows the flow of a process when the upload side of the transmission line of the main system of the said embodiment is disconnected. The figure of the flowchart which shows the flow of a process when both the upload side and download side of the transmission line of the main system of the said embodiment are disconnected. The figure of the flowchart which shows the flow of a process when the transmission circuit of the main input / output device of the said embodiment fails. The figure of the flowchart which shows the flow of a process in the case of runaway, reset, etc. of the main input / output device of the said embodiment. The figure of the flowchart which shows the flow of a process when the download side of the transmission line of the main system of the said embodiment is disconnected. The figure which shows an example of the correspondence table for abnormality factor analysis of the said embodiment. The block diagram which shows the modification of this invention. The block diagram which shows another modification of this invention. The block diagram which shows another modification of this invention. The block diagram which shows a prior art example. The block diagram which shows another prior art example.

  An embodiment of the present invention will be described below with reference to the drawings. FIG. 1 shows the overall configuration of an abnormality monitoring system 10 for a redundant control device according to this embodiment. 2 shows a process flow when the upload side of the main transmission line is disconnected, and FIG. 3 shows a process flow when both the upload side and the download side of the main transmission line are disconnected. FIG. 4 shows a processing flow when the transmission circuit of the main input / output device fails, FIG. 5 shows a processing flow when the main input / output device runs out of control or resets, and FIG. The flow of processing when the download side of the main transmission line is disconnected is shown in the flowcharts. Furthermore, FIG. 7 shows an example of a correspondence table for analyzing abnormal factors.

  <Overall configuration>

  In FIG. 1, an abnormality monitoring system 10 for a duplexed control device includes a duplexed main control device 20A and a standby control device 20B, and a duplexed main input / output device 60A and a standby system. And an input / output device 60B. Note that these two sets of “control device and input / output device subordinate to it” have a configuration that can be either a main system or a standby system, but as shown here, Give an explanation.

  The main control device 20A and the main input / output device 60A are connected by the downstream transmission line 1D and the upstream transmission line 1U, and the standby control device 20B and the standby input / output device 60B are connected to the downstream transmission line. 2D and the upstream transmission line 2U are connected. Further, the control devices 20A and 20B are connected by transmission lines 3L and 3R, and the input / output devices 60A and 60B are connected by transmission lines 4L and 4R.

  The transmission paths 1D and 1U, the transmission paths 2D and 2U, the transmission paths 3L and 3R, and the transmission paths 4L and 4R provided at these four connection locations are respectively configured by dedicated lines in the state shown in FIG. However, the transmission path installation mode of the present invention is not limited to this, and for example, in order to reduce the equipment cost, the main input / output device 60A and the standby input / output device 60B. The transmission paths 4L and 4R between the two may be configured by dedicated lines, while the remaining three connection locations may be shared by the transmission bus.

  The main control unit 20A includes a processing unit 30A that executes various processes related to abnormality monitoring, an input / output unit monitoring information storage unit 40A that stores input / output unit monitoring information necessary for the abnormality monitoring process, and an input to the main unit. A transmission circuit 50A for performing transmission with the output device 60A and a transmission circuit 51A for performing transmission with the standby control device 20B are provided.

  Similarly, the standby control device 20B includes a transmission circuit 50B for performing transmission between the processing means 30B, the input / output device monitoring information storage means 40B, and the standby input / output device 60B. A transmission circuit 51B for performing transmission to and from the control device 20A.

  The processing means 30A and 30B are constituted by a microprocessor, one or a plurality of programs that define the operation procedure, a main memory (for example, SDRAM), etc., and input / output device monitoring processing means 31A and 31B, and downlink transmission processing Means 32A, 32B, monitoring information change processing means 33A, 33B, inter-control device transmission processing means 34A, 34B, inter-control device mutual monitoring processing means 35A, 35B, and abnormal factor analysis processing means 36A, 36B, respectively. It is configured to include.

  The input / output device monitoring information storage means 40A and 40B are constituted by, for example, SRAM, etc. <Own> input / output device monitoring information 41A and 41B indicating the monitoring results of the own input / output devices 60A and 60B, and their own <Other system> Input / output device monitoring information 42A and 42B indicating the monitoring results of the other system input / output devices 60B and 60A when viewed from the system to which the system belongs, and the other system when viewed from the system to which the system belongs. <Via other system> input / output device monitoring information 43A and 43B indicating the monitoring results of the own input / output devices 60A and 60B obtained in this manner are stored.

  The main input / output device 60A includes a processing unit 70A for executing various processes relating to abnormality monitoring, an input / output device state information storage unit 80A for storing input / output device state information necessary for abnormality monitoring processing, and a main system input / output device 60A. A transmission circuit 90A for performing transmission with the control device 20A and a transmission circuit 91A for performing transmission with the standby input / output device 60B are provided.

  Similarly, the standby input / output device 60B includes a processing unit 70B, an input / output device state information storage unit 80B, a transmission circuit 90B for performing transmission between the standby control device 20B, a main system A transmission circuit 91B for performing transmission to and from the input / output device 60A.

  The processing means 70A and 70B are constituted by a microprocessor, one or a plurality of programs that define the operation procedure, a main memory (for example, SDRAM), and the like, and between the state information change processing means 71A and 71B and the input / output devices. Transmission processing means 72A, 72B, I / O unit mutual monitoring processing means 73A, 73B, upstream transmission processing means 74A, 74B, and self-diagnosis processing means 75A, 75B are included.

  The input / output device status information storage means 80A and 80B are composed of, for example, SRAM and the like, and input / output device status information <own system> areas 81A and 81B indicating status information about the own input / output devices 60A and 60B. And input / output device status information <other system> areas 82A and 82B indicating status information about the other input / output devices 60B and 60A, respectively.

  The transmission circuits 50A, 50B, 51A, 51B, 90A, 90B, 91A, and 91B are, for example, a bus LSI or a transmission board on which a plurality of components are mounted on a printed circuit board.

  <Detailed Configuration of Processing Units 30A and 30B of Control Devices 20A and 20B>

  The input / output device monitoring processing means 31A and 31B have the same function although the main system and the standby system are reversed. The input / output device monitoring processing means 31A on the main system side monitors the data received from the input / output device 60A on the main system, and the <own system> input stored in the input / output device monitoring information storage means 40A based on this monitoring result. The process of changing the output device monitoring information 41A is executed.

  More specifically, when the input / output device monitoring processing unit 31A on the main system side detects that the received data from the main input / output device 60A has been interrupted, the <own system> input / output device monitoring information is displayed. As 41A, a process of storing “reception data disruption” in the input / output device monitoring information storage unit 40A is executed. The input / output device monitoring processing means 31B on the standby side also has a mirror relationship in which the main system and the standby system are inverted, but the same is true.

  The downlink transmission processing means 32A and 32B have the same function although the main system and the standby system are inverted. The downstream transmission processing unit 32A on the main system side transmits the <own system> input / output device monitoring information (for example, “received data disruption”) stored in the input / output device monitoring information storage unit 40A from the main control device 20A. A process of transmitting to the main input / output device 60A via the downstream transmission path 1D (always transmitting in the present embodiment) is executed. Specifically, the information delivery method by constant transmission is, for example, a method of always transmitting via a network (including a transmission bus) (that is, via the network to the transmission circuit 90A of the main input / output device 60A). A method in which the processor of the main input / output device 60A reads the transmitted information from the transmission circuit 90A), or an I / F memory for directly reading / writing data from / to the main input / output device 60A (For example, an SRAM or the like) may be provided (not shown), data may be repeatedly written to the I / F memory, and read by the processor of the main input / output device 60A. The downstream transmission processing means 32B on the standby side also has a mirror relationship in which the main system and the standby system are inverted, but the same is true.

  The downlink transmission processing means in the present invention may be provided in the input / output devices 60A and 60B on the reception side (information supply destination) instead of the control devices 20A and 20B on the transmission side (information supply source). In this case, for example, a method of repeatedly reading information stored in the memories in the control devices 20A and 20B from the input / output devices 60A and 60B via the transmission bus can be employed.

  The monitoring information change processing means 33A and 33B have the same function although the main system and the standby system are reversed. The monitoring information change processing unit 33A on the main system side monitors the input / output device status information included in the reception data from the main input / output device 60A, and in the case 5 (see FIG. 6), the received data In the case of case 1 to case 4, the <own system> input / output device monitoring information 41A stored in the input / output device monitoring information storage means 40A is changed by the input / output device status information <own system> area included in the 2 to 5, the input / output device monitoring information storage unit 40A stores the input / output device status information <other system> area included in the received data. The process of changing the stored <other system> input / output device monitoring information 42A is executed. More specifically, as shown in case 5 (see FIG. 6), the monitoring information change processing unit 33A on the main system side sets the input / output device state information <own system> area included in the received data to “received data”. If it is “disruption”, a process of storing “reception of“ received data disruption ”from the input / output device” as <own system> input / output device monitoring information 41A is executed in the input / output device monitoring information storage means 40A.

  The monitoring information change processing unit 33B on the standby side monitors the input / output device status information included in the received data from the standby input / output device 60B. In case 5 (see FIG. 6 for the main system and the standby system). In the state in which the input / output device status information <own system> included in the received data is used, the <own system> input / output device monitoring stored in the input / output device monitoring information storage means 40B is used. In addition to changing the information 41B, as in the case 1 to case 4 (see FIG. 2 to FIG. 5), the input / output device monitoring information storage means by the input / output device status information <other system> area included in the received data The process of changing the <other system> input / output device monitoring information 42B stored in 40B is executed. More specifically, the monitoring information change processing unit 33B on the standby side, as in case 1 (see FIG. 2), sets the input / output device state information <other system> area included in the received data to “control device”. "Received data interruption" is stored in the input / output device monitoring information storage means 40B as <other system> input / output device monitoring information 42B. As in case 2 (see FIG. 3), when the input / output device status information <other system> area is “received data disruption”, the input / output device monitoring information storage means 40B stores <other system>. “Reception data disruption” is stored as the output device monitoring information 42B, and when the input / output device status information <other system> area is “transmission circuit failure” as in case 3 (see FIG. 4), Output device monitoring information storage means 4 In B, “transmission circuit failure” is stored as <other system> input / output device monitoring information 42B, and as in case 4 (see FIG. 5), the input / output device status information <other system> area is “other system”. When it is “monitoring abnormality”, a process of storing “other system monitoring abnormality” in the input / output device monitoring information storage unit 40B as <other system> input / output device monitoring information 42B is executed.

  The above-described input / output device monitoring processing means 31A and 31B detect the presence / absence of reception from the input / output devices 60A and 60B, whereas the monitoring information change processing means 33A and 33B include the input / output devices 60A and 60B. The difference is that the process of detecting the contents of the input / output device status information included in the received data from the computer is executed.

  The inter-control device transmission processing means 34A and 34B have the same function although the main system and the standby system are reversed. The inter-control device transmission processing means 34B on the standby side transfers the <other system> input / output device monitoring information 42B stored in the input / output device monitoring information storage means 40B from the standby control device 20B to the main control device 20A. The transmission process is performed through the transmission path 3L (always transmitting in the present embodiment). Specifically, the information delivery method by constant transmission is, for example, a method of always transmitting via a network (including a transmission bus) (that is, a network to the transmission circuit 51A of the main controller 20A on the receiving side). The method of reading the information transmitted via the processor of the main controller 20A on the receiving side from the transmission circuit 51A), or directly reading / writing the information on the main controller 20A on the receiving side between the devices. A method may be used in which an I / F memory (such as SRAM) is provided (not shown), data is repeatedly written to the I / F memory, and is read by the processor of the main controller 20A on the receiving side. . The transmission processing means 34A between the control devices on the main system side also has a mirror relationship in which the main system and the standby system are reversed.

  The transmission processing means between control devices in the present invention may be provided in the control devices 20A and 20B on the reception side (information supply destination), not on the control devices 20B and 20A on the transmission side (information supply source). In this case, for example, it is possible to adopt a method of repeatedly reading information stored in the memories in the control devices 20B and 20A on the transmission side from the control devices 20A and 20B on the reception side via the transmission bus.

  The mutual monitoring processing means 35A and 35B between the control devices have the same function although the main system and the standby system are reversed. The mutual monitoring processing means 35A between the control devices on the main system side monitors received data from the standby control device 20B, and <other system> input / output device monitoring information (standby control device 20B included in the received data). Since it is the information of the other system as viewed from the end, it corresponds to the information of the main system after all.) <Via other system> I / O device monitoring information 43A (standby system) stored in the input / output device monitoring information storage means 40A The process of changing the information) indicating the monitoring result of the main input / output device 60A obtained via the communication is executed.

  More specifically, the mutual monitoring processing means 35A between the control devices on the main system side, as in case 1 (see FIG. 2), is included in the received data from the standby control device 20B. When the input / output device monitoring information is “received“ received data disruption ”from the control device”, the input / output device monitoring information storage means 40A stores the “from other system” as the input / output device monitoring information 43A. "Received data disruption" received "is stored, and when <other system> input / output device monitoring information is" received data disruption "as in case 2 (see FIG. 3), the input / output device monitoring information is stored. The means 40A stores “reception data disruption” as <input via other system> input / output device monitoring information 43A, and <other system> input / output device monitoring information is “transmitted” as in case 3 (see FIG. 4). When it was a “circuit failure” In the output device monitoring information storage means 40A, “transmission circuit failure” is stored as <other system> input / output device monitoring information 43A, and <other system> input / output device as in case 4 (see FIG. 5). When the monitoring information is “other system monitoring abnormality”, a process of storing “other system monitoring abnormality” in the input / output device monitoring information storage unit 40A as <input via other system> input / output device monitoring information 43A is executed. The mutual monitoring processing unit 35B between the control devices on the standby side also has a mirror relationship in which the main system and the standby system are reversed, but is the same.

  The abnormality factor analysis processing means 36A and 36B have the same function although the main system and the standby system are reversed. The abnormality cause analysis processing unit 36A on the main system side uses <own system> input / output device monitoring information 41A and <via other system> input / output device monitoring information 43A stored in the input / output device monitoring information storage unit 40A. Thus, the abnormality factor analysis process is executed according to the abnormality factor analysis correspondence table shown in FIG.

  More specifically, the abnormality cause analysis processing unit 36A on the main system side, as in case 1 (see FIG. 2), is stored in the input / output device monitoring information storage unit 40A. If the monitoring information 41A is “reception data disruption” and <via other system> input / output device monitoring information 43A “receives“ reception data disruption ”from the control device”, the upload side of the main transmission path (Uplink transmission line 1U) is determined to have been disconnected, and as in case 2 (see FIG. 3), <Own> input / output device monitoring information 41A is “received data disruption” and <other system Via> If the input / output device monitoring information 43A is “received data disruption”, it is determined that both the upload side (upstream transmission path 1U) and the download side (downstream transmission path 1D) of the main transmission path are disconnected, As in case 3 (see Figure 4) If <own system> input / output device monitoring information 41A is “received data disruption” and <via other system> input / output device monitoring information 43A is “transmission circuit failure”, the input / output device 60A of the main system It is determined that the transmission circuit 90A has failed, and as in case 4 (see FIG. 5), the <own system> input / output device monitoring information 41A is "received data disruption" and <via other system> input If the output device monitoring information 43A is “another system monitoring error”, it is determined that the main input / output device 60A is out of control or reset, and as in case 5 (see FIG. 6), <own system If the input / output device monitoring information 41A is “received“ received data disruption ”from the input / output device”, a process of determining that the download side of the main transmission line (downlink transmission line 1D) is disconnected is executed. The abnormality factor analysis processing unit 36B on the standby side also has a mirror relationship in which the main system and the standby system are inverted, but the same is true.

  7 may be described in a program constituting the abnormality factor analysis processing means 36A and 36B, and is stored in a memory provided in the control devices 20A and 20B. May be.

  <Detailed Configuration of Processing Units 70A and 70B of Input / Output Devices 60A and 60B>

  The state information change processing means 71A and 71B have the same function although the main system and the standby system are reversed. The state information change processing means 71A on the main system side monitors the received data from the main control device 20A (detects the presence / absence of reception and the contents of the input / output device monitoring information included in the received data). Based on this monitoring result, the process of changing the input / output device status information <own system> area 81A stored in the input / output device status information storage means 80A is executed.

  More specifically, the state information change processing means 71A on the main system side uses the <own system> input / output device to receive data from the main control device 20A as in the case 1 (see FIG. 2). When “reception data disruption” is included as the monitoring information, “received“ reception data disruption ”from the control device” is entered in the input / output device state information storage unit 80A as the input / output device state information <own system> area 81A. When it is detected that the received data from the main control device 20A is interrupted as in the case 2 (see FIG. 3) and the case 5 (see FIG. 6), the input / output device state information is stored. In the storage unit 80A, “received data interruption” is stored as the input / output device state information <own system> area 81A, and a failure of the transmission circuit 90A is detected by self-diagnosis as in case 3 (see FIG. 4). Sometimes The output device status information storing unit 80A, executes a process of storing the "transmission circuit failure" as input and output device status information <autologous> region 81A. The status information change processing means 71B on the standby system side also has a mirror relationship in which the main system and the standby system are inverted, but is the same.

  The inter-input / output device transmission processing means 72A and 72B have the same functions, although the main system and the standby system are inverted. The input / output device transmission processing means 72A on the main system side transfers the input / output device status information <own system> area 81A stored in the input / output device status information storage means 80A from the main input / output device 60A to the standby system. The process of transmitting to the input / output device 60B via the transmission path 4R is executed. Specifically, for example, the information delivery method by this transmission is provided with an I / F memory (for example, SRAM) for directly reading and writing between devices in the standby input / output device 60B on the receiving side. (Not shown), a method of repeatedly writing to the I / F memory and reading it by the standby input / output device 60B may be used, or it may be transmitted constantly via a network (including a transmission bus). (Ie, a method in which the processor of the standby input / output device 60B on the receiving side reads out the information transmitted from the transmission circuit 91B to the transmission circuit 91B of the standby input / output device 60B on the receiving side). Good. The standby-system-side I / O device transmission processing means 72B also has a mirror relationship in which the main system and the standby system are reversed.

  Note that the transmission processing means between input / output devices in the present invention is provided not in the input / output devices 60A and 60B on the transmission side (information supply source) but in the input / output devices 60B and 60A on the reception side (information supply destination). In this case, for example, a method of repeatedly reading information stored in the memories in the input / output devices 60A and 60B on the transmission side from the input / output devices 60B and 60A on the reception side via the transmission bus is adopted. be able to.

  The mutual monitoring processing means 73A and 73B between the input / output devices have the same functions, although the main system and the standby system are reversed. The standby input / output device mutual monitoring processing means 73B monitors received data from the main input / output device 60A (detection of presence / absence of reception and detection of contents of input / output device state information included in the received data). Based on this monitoring result, processing for changing the input / output device status information <other system> area 82B stored in the input / output device status information storage means 80B is executed.

  More specifically, as shown in case 1 (see FIG. 2), the standby input / output device mutual monitoring processing unit 73B adds the input / output device status to the received data from the main input / output device 60A. When the information includes “Received“ Reception data disruption ”from the control device”, the input / output device status information storage unit 80B stores “Received data from the control device as the input / output device status information <other system> area 82B”. If “disconnection” is stored, and the received data includes “reception data disruption” as input / output device state information, as in case 2 (see FIG. 3), the input / output device state information is stored. The means 80B stores “reception data disruption” as the input / output device state information <other system> area 82B, and “transmits” to the reception data as input / output device state information as in case 3 (see FIG. 4). circuit When "failure" is included, the "transmission circuit failure" is stored in the input / output device status information storage means 80B as the input / output device status information <other system> area 82B. In case 4 (see FIG. 5) As described above, when it is detected that the received data from the main input / output device 60A has been interrupted, the input / output device status information storage means 80B sets the input / output device status information <other system> area 82B as "other system monitoring error. ”Is stored. The mutual monitoring processing unit 73A between the input / output devices of the main system also has a mirror relationship in which the main system and the standby system are reversed.

  Upstream transmission processing means 74A and 74B have the same function, although the main system and the standby system are inverted. The upstream transmission processing means 74A on the main system side uses the input / output device status information <own system> area 81A stored in the input / output device status information storage means 80A as in the case 5 (see FIG. 6). Transmission is performed from the input / output device 60A of the system to the control device 20A of the main system via the upstream transmission path 1U (always transmitting in this embodiment), and in the case of case 1 to case 4 (the main system in FIGS. 2 to 5) And the standby system), the input / output device status information <other system> area 82A stored in the input / output device status information storage means 80A is transferred from the main input / output device 60A to the main. A process of transmitting to the system control device 20A via the upstream transmission line 1U (always transmitting in the present embodiment) is executed.

  The upstream transmission processing means 74B on the standby system side is stored in the input / output device state information storage means 80B as in case 5 (in the state where the main system and the standby system are reversed in FIG. 6). The input / output device state information <own system> area 81B is transmitted from the standby input / output device 60B to the standby control device 20B via the upstream transmission path 2U (in this embodiment, always transmitted), and the case As in the case of 1 to 4 (see FIGS. 2 to 5), the input / output device status information <other system> area 82B stored in the input / output device status information storage unit 80B is replaced with the standby input / output device 60B. To the standby control device 20B via the upstream transmission line 2U (always transmitting in this embodiment).

  Specifically, the information delivery method by constantly transmitting the upstream transmission processing means 74A, 74B is, for example, a method of constantly transmitting via a network (including a transmission bus) (that is, the control device 20A on the receiving side). 20B may be a method in which the processor of the receiving control devices 20A and 20B reads the information transmitted to the 20B transmission circuits 50A and 50B from the transmission circuits 50A and 50B), or the receiving control devices 20A and 20B. In addition, an I / F memory (for example, SRAM) for directly reading and writing between the devices is provided (not shown), and the I / F memory is repeatedly written, and this is transmitted to the control device 20A on the receiving side. A method of reading by the processor 20B may be used.

  The upstream transmission processing means in the present invention may be provided in the control devices 20A and 20B on the receiving side (information supply destination) instead of the input / output devices 60A and 60B on the transmitting side (information supply source). In this case, for example, information stored in the memories in the input / output devices 60A and 60B on the transmission side (information supply source) is transferred from the control devices 20A and 20B on the reception side (information supply destination) via the transmission bus. Thus, a method of repeatedly reading can be employed.

  The self-diagnosis processing means 75A and 75B execute processing for self-diagnosis of a failure of the transmission circuits 90A and 90B provided in the input / output devices 60A and 60B. More specifically, the self-diagnosis processing means 75A and 75B, for example, if the transmission circuits 90A and 90B are configured by a bus LSI, the contents of the status register in the bus LSI are input to the input / output devices 60A and 60B. The process of constantly monitoring, the process of constantly monitoring the state of the error output terminal of the bus LSI, the process of monitoring whether the busy period of the bus LSI is within the expected range, etc. are executed.

  <Flow of abnormality monitoring processing>

  In the present embodiment as described above, the abnormality monitoring process by the abnormality monitoring system 10 of the redundant control apparatus is performed as follows. In the following, only the flow of processing for analyzing the abnormality of the main system using information via the standby system as shown in FIGS. The abnormality monitoring system 10 according to the present embodiment analyzes a process in a mirror relationship in which the main system and the standby system are reversed in FIGS. 2 to 6, that is, an abnormality in the standby system using information via the main system. It is possible to execute the processing in the case of doing so.

  <Case 1: Processing flow when determining that the upload side (upstream transmission line 1U) of the main transmission line is disconnected>

  In FIG. 2, in the main control device 20A, the input / output device monitoring processing means 31A monitors the received data from the main input / output device 60A transmitted via the upstream transmission line 1U. At this time, if the upstream transmission line 1U is disconnected, the input / output device monitoring processing means 31A cannot receive the data even after a lapse of a certain period of time, and thus an abnormality (the received data from the main input / output device 60A is interrupted). (Step S1), and the <own system> input / output device monitoring information 41A stored in the input / output device monitoring information storage means 40A is changed from "normal" to "received data disruption" (step S2). ).

  Subsequently, the <own system> input / output device monitoring information 41A stored in the input / output device monitoring information storage unit 40A by the downstream transmission processing unit 32A is downloaded from the main control device 20A to the main input / output device 60A. Since it is always transmitted via the transmission line 1D, “reception data disruption” is transmitted to the main input / output device 60A as the updated <own system> input / output device monitoring information 41A (step S3).

  In the main input / output device 60A, the status information change processing means 71A monitors the received data from the main control device 20A, and the received data is “received data disruption” as <own system> input / output device monitoring information. "" Is included (step S4), the input / output device status information <own system> area 81A stored in the input / output device status information storage means 80A is changed from "normal" to "from the control device" The received data interruption “change” is changed to “received” (step S5).

  Subsequently, the input / output device transmission information processing unit 72A receives “received data interruption from the control device” as the input / output device state information <own system> area 81A stored in the input / output device state information storage unit 80A. Is transmitted from the main input / output device 60A to the standby input / output device 60B via the transmission line 4R (step S6).

  In the standby input / output device 60B, the reception data from the main input / output device 60A is monitored by the inter-input / output device mutual monitoring processing means 73B. When it is detected that "received reception data disruption" is included (step S7), the input / output device status information <other system> area 82B stored in the input / output device status information storage unit 80B is set to "normal". To "Receive" Reception data disruption "from the control device" (step S8).

  Subsequently, the input / output device state information <other system> area 82B stored in the input / output device state information storage unit 80B by the upstream transmission processing unit 74B is transferred from the standby input / output device 60B to the standby control device 20B. Since it is always transmitted via the upstream transmission path 2U, “Received data interruption from control device” is input to the standby control device 20B as the updated input / output device status information <other system> area 82B. It is transmitted (step S9).

  In the standby control device 20B, the monitoring information change processing means 33B monitors the input / output device status information included in the received data from the standby input / output device 60B, and the received data includes the input / output device status information < When it is detected that “reception of“ received data disruption ”from the control device” is included as the “other system” area (step S10), the <other system> input / output stored in the input / output device monitoring information storage means 40B The device monitoring information 42B is changed from “normal” to “received“ received data disruption ”from the control device” (step S11).

  Subsequently, the <other system> input / output device monitoring information 42B stored in the input / output device monitoring information storage means 40B by the inter-control device transmission processing means 34B is transferred from the standby control device 20B to the main control device 20A. Since it is constantly transmitted via the transmission line 3L, “received“ received data disruption ”from the control device” is transmitted to the main control device 20A as the <other system> input / output device monitoring information 42B after the update. (Step S12).

  In the main control device 20A, the inter-control device mutual monitoring processing means 35A monitors the received data from the standby control device 20B, and the received data is sent to the “control device” as <other system> input / output device monitoring information. When “received reception data disruption” is detected (step S13), the <input via other system> input / output device monitoring information 43A stored in the input / output device monitoring information storage means 40A “Normal” is changed to “Receiving“ received data interruption ”from the control device” (step S14).

  After that, in the main control device 20A, the <own system> input / output device monitoring information 41A stored in the input / output device monitoring information storage means 40A and the <via other system> input / output device by the abnormality factor analysis processing means 36A. Using the monitoring information 43A, the abnormality factor analysis process is executed according to the abnormality factor analysis correspondence table shown in FIG. 7 (step S15). In this case 1, the <own system> input / output device monitoring information 41A stored in the input / output device monitoring information storage means 40A is "received data disruption" and <via other system> input / output device monitoring information 43A. Is “received“ received data disruption ”from the control device”, so it is determined that the upload side (upstream transmission line 1U) of the main transmission line is disconnected according to the correspondence table for analysis of abnormal factors in FIG. To do.

  <Case 2: When determining that both the upload side (upstream transmission path 1U) and the download side (downstream transmission path 1D) of the main transmission path are disconnected>

  In FIG. 3, in the main control device 20A, the input / output device monitoring processing means 31A monitors the received data from the main input / output device 60A transmitted via the upstream transmission line 1U. At this time, if the upstream transmission line 1U is disconnected, the input / output device monitoring processing means 31A cannot receive the data even after a lapse of a certain period of time, and thus an abnormality (the received data from the main input / output device 60A is interrupted). (Step S21), and the <own system> input / output device monitoring information 41A stored in the input / output device monitoring information storage means 40A is changed from "normal" to "received data disruption" (step S22). ).

  Subsequently, the <own system> input / output device monitoring information 41A stored in the input / output device monitoring information storage unit 40A by the downstream transmission processing unit 32A is downloaded from the main control device 20A to the main input / output device 60A. Since it is always transmitted via the transmission line 1D, “reception data disruption” is transmitted to the main input / output device 60A as the updated <own system> input / output device monitoring information 41A (step S23). However, since the downstream transmission line 1D is also disconnected, this information does not reach the main input / output device 60A.

  In the main input / output device 60A, the status information change processing means 71A monitors the received data from the main control device 20A. At this time, if the downlink transmission line 1D is disconnected, data cannot be received even after a lapse of a certain time, so an abnormality (the reception data from the main control device 20A has been interrupted) is detected (step S24). Then, the input / output device status information <local> area 81A stored in the input / output device status information storage means 80A is changed from "normal" to "received data disruption" (step S25). It should be noted that the “received data disruption” that is the updated input / output device state information <own system> area 81A stored in the input / output device state information storage means 80A is transmitted by the continuous transmission function of the upstream transmission processing means 74A. Although it is transmitted to the main control apparatus 20A via the path 1U, the upstream transmission path 1U is also disconnected, and thus does not reach the main control apparatus 20A.

Subsequently, the input / output device state information <own system> area 81A stored in the input / output device state information storage unit 80A by the inter-input / output device transmission processing means 72A
“Reception data disruption” is transmitted from the main input / output device 60A to the standby input / output device 60B via the transmission line 4R (step S26).

  In the standby input / output device 60B, the reception data from the main input / output device 60A is monitored by the inter-input / output device mutual monitoring processing means 73B. ”Is detected (step S27), the input / output device status information <other system> area 82B stored in the input / output device status information storage means 80B is changed from“ normal ”to“ received data disruption ”. (Step S28).

  Subsequently, the input / output device state information <other system> area 82B stored in the input / output device state information storage unit 80B by the upstream transmission processing unit 74B is transferred from the standby input / output device 60B to the standby control device 20B. Since it is constantly transmitted via the upstream transmission path 2U, “received data disruption” is transmitted to the standby control device 20B as the updated input / output device status information <other system> area 82B (step S29). .

  In the standby control device 20B, the monitoring information change processing means 33B monitors the input / output device status information included in the received data from the standby input / output device 60B, and the received data includes the input / output device status information < When it is detected that “reception data disruption” is included in the “other system> area (step S30), the <other system> input / output device monitoring information 42B stored in the input / output device monitoring information storage means 40B is“ “Normal” is changed to “Reception data disruption” (step S31).

  Subsequently, the <other system> input / output device monitoring information 42B stored in the input / output device monitoring information storage means 40B by the inter-control device transmission processing means 34B is transferred from the standby control device 20B to the main control device 20A. Since it is constantly transmitted via the transmission line 3L, “reception data disruption” is transmitted to the main controller 20A as the updated <other system> input / output device monitoring information 42B (step S32).

  In the main control device 20A, the inter-control device mutual monitoring processing means 35A monitors the received data from the standby control device 20B, and the received data is received as <other system> input / output device monitoring information as “received data”. When it is detected that "disruption" is included (step S33), the <input via other system> input / output device monitoring information 43A stored in the input / output device monitoring information storage means 40A is changed from "normal" to "received data disruption". To "" (step S34).

  After that, in the main control device 20A, the <own system> input / output device monitoring information 41A stored in the input / output device monitoring information storage means 40A and the <via other system> input / output device by the abnormality factor analysis processing means 36A. Using the monitoring information 43A, the abnormality factor analysis process is executed according to the abnormality factor analysis correspondence table shown in FIG. 7 (step S35). In this case 2, the <own system> input / output device monitoring information 41A stored in the input / output device monitoring information storage means 40A is "received data disruption" and <via other system> input / output device monitoring information 43A. Is “received data disruption”, the upload side (upstream transmission path 1U) and the download side (downstream transmission path 1D) of the main transmission path are in accordance with the correspondence table for analysis of the cause of abnormality in FIG. Judge that it was disconnected.

  <Case 3: When determining that the transmission circuit of the main input / output device is faulty>

  In FIG. 4, in the main control device 20A, the input / output device monitoring processing means 31A monitors the received data from the main input / output device 60A transmitted via the upstream transmission line 1U. At this time, if the transmission circuit 90A of the main input / output device 60A is out of order, the input / output device monitoring processor 31A cannot receive data even after a lapse of a certain time. (Reception data from 60A has been interrupted) is detected (step S41), and the <own system> input / output device monitoring information 41A stored in the input / output device monitoring information storage means 40A is changed from "normal" to "received data disruption". To "" (step S42).

  Subsequently, the <own system> input / output device monitoring information 41A stored in the input / output device monitoring information storage unit 40A by the downstream transmission processing unit 32A is downloaded from the main control device 20A to the main input / output device 60A. Since it is constantly transmitted via the transmission line 1D, “reception data disruption” is transmitted to the main input / output device 60A as the updated <own system> input / output device monitoring information 41A (step S43). However, since the transmission circuit 90A of the main input / output device 60A is out of order, this information does not reach the main input / output device 60A.

  In the main input / output device 60A, when the state information change processing means 71A detects a failure in the transmission circuit 90A by the self-diagnosis by the self-diagnosis processing means 75A (step S44), the input / output device state information storage means 80A The stored input / output device state information <own system> area 81A is changed from “normal” to “transmission circuit failure” (step S45). When the self-diagnosis by the self-diagnosis processing unit 75A cannot detect a failure in the transmission circuit 90A, the status information change processing unit 71A monitors the received data from the main control unit 20A. If the transmission circuit 90A of the output device 60A is out of order, data cannot be received even after a lapse of a certain time, so that an abnormality (the reception data from the main control device 20A has been interrupted) is detected, and the input / output device The input / output device status information <own system> area 81A stored in the status information storage means 80A is changed from “normal” to “received data disruption”, which is the same as in the case 2 described above.

Subsequently, the input / output device state information <own system> area 81A stored in the input / output device state information storage unit 80A by the inter-input / output device transmission processing means 72A
“Transmission circuit failure” is transmitted from the main input / output device 60A to the standby input / output device 60B via the transmission line 4R (step S46).

  In the standby input / output device 60B, the reception data from the main input / output device 60A is monitored by the inter-input / output device mutual monitoring processing means 73B. ”Is detected (step S47), the input / output device status information <other system> area 82B stored in the input / output device status information storage means 80B is changed from“ normal ”to“ transmission circuit failure ”. (Step S48).

  Subsequently, the input / output device state information <other system> area 82B stored in the input / output device state information storage unit 80B by the upstream transmission processing unit 74B is transferred from the standby input / output device 60B to the standby control device 20B. Since it is always transmitted via the upstream transmission line 2U, “transmission circuit failure” is transmitted to the standby control device 20B as the updated input / output device status information <other system> area 82B (step S49). .

  In the standby control device 20B, the monitoring information change processing means 33B monitors the input / output device status information included in the received data from the standby input / output device 60B, and the received data includes the input / output device status information < When it is detected that “transmission circuit failure” is included in the “other system> area (step S50), the <other system> input / output device monitoring information 42B stored in the input / output device monitoring information storage means 40B is“ “Normal” is changed to “Transmission circuit failure” (step S51).

  Subsequently, the <other system> input / output device monitoring information 42B stored in the input / output device monitoring information storage means 40B by the inter-control device transmission processing means 34B is transferred from the standby control device 20B to the main control device 20A. Since it is constantly transmitted via the transmission line 3L, “transmission circuit failure” is transmitted to the main controller 20A as the <other system> input / output device monitoring information 42B after the update (step S52).

  In the main control device 20A, the inter-control device mutual monitoring processing means 35A monitors the received data from the standby control device 20B, and the received data is sent to the “transmission circuit” as <other system> input / output device monitoring information. When it is detected that "failure" is included (step S53), the <transmission> I / O device monitoring information 43A stored in the input / output device monitoring information storage means 40A is changed from "normal" to "transmission circuit failure". To "" (step S54).

  After that, in the main control device 20A, the <own system> input / output device monitoring information 41A stored in the input / output device monitoring information storage means 40A and the <via other system> input / output device by the abnormality factor analysis processing means 36A. Using the monitoring information 43A, an abnormality factor analysis process is executed according to the abnormality factor analysis correspondence table shown in FIG. 7 (step S55). In case 3, the <own system> input / output device monitoring information 41A stored in the input / output device monitoring information storage means 40A is "received data disruption", and <via other system> input / output device monitoring information 43A. Is a “transmission circuit failure”, it is determined that the transmission circuit 90A of the main input / output device 60A has failed according to the correspondence table for analysis of abnormal factors in FIG.

  <Case 4: When discriminating runaway or reset of the main system I / O device>

  In FIG. 5, in the main control device 20A, the input / output device monitoring processing means 31A monitors received data from the main input / output device 60A transmitted via the upstream transmission line 1U. At this time, if the main input / output device 60A has runaway, has been reset, or other similar transmission disturbance factors have occurred, the input / output device monitoring processing means 31A causes a certain period of time to elapse. However, since the data cannot be received, an abnormality (the reception data from the main input / output device 60A has been interrupted) is detected (step S61), and the “own system” stored in the input / output device monitoring information storage means 40A is detected. The input / output device monitoring information 41A is changed from “normal” to “received data disruption” (step S62).

  Subsequently, the <own system> input / output device monitoring information 41A stored in the input / output device monitoring information storage unit 40A by the downstream transmission processing unit 32A is downloaded from the main control device 20A to the main input / output device 60A. Since it is always transmitted via the transmission line 1D, “reception data disruption” is transmitted to the main input / output device 60A as the updated <own system> input / output device monitoring information 41A (step S63). However, since the main input / output device 60A is in a state of runaway or reset, this information does not reach the main input / output device 60A.

  Since the main input / output device 60A is in a state of runaway or reset, the status information change processing means 71A monitors the received data from the main control device 20A, or the self-diagnosis processing means 75A transmits the transmission circuit. No process can be performed, including the process of self-diagnosis of 90A failure.

  In the standby input / output device 60B, the inter-input / output device mutual monitoring processing means 73B monitors the received data from the main input / output device 60A transmitted via the transmission line 4R. At this time, if the main input / output device 60A is in a state such as runaway or reset, the mutual monitoring processing means 73B between the input / output devices cannot receive data even after a predetermined time has passed. ) Is detected (step S64), and the input / output device status information <other system> area 82B stored in the input / output device status information storage means 80B is changed from "normal" to "other system monitoring error" (step S65). ).

  Subsequently, the input / output device state information <other system> area 82B stored in the input / output device state information storage unit 80B by the upstream transmission processing unit 74B is transferred from the standby input / output device 60B to the standby control device 20B. Since it is always transmitted via the upstream transmission path 2U, “other system monitoring abnormality” is transmitted to the standby control apparatus 20B as the updated input / output device status information <other system> area 82B (step S66). ).

  In the standby control device 20B, the monitoring information change processing means 33B monitors the input / output device status information included in the received data from the standby input / output device 60B, and the received data includes the input / output device status information < When it is detected that “other system monitoring abnormality” is included as the other system> area (step S67), the <other system> input / output device monitoring information 42B stored in the input / output device monitoring information storage means 40B is “Normal” is changed to “other system monitoring abnormality” (step S68).

  Subsequently, the <other system> input / output device monitoring information 42B stored in the input / output device monitoring information storage means 40B by the inter-control device transmission processing means 34B is transferred from the standby control device 20B to the main control device 20A. Since it is constantly transmitted via the transmission line 3L, “other system monitoring error” is transmitted to the main control apparatus 20A as the <other system> input / output device monitoring information 42B after the update (step S69).

  In the main control unit 20A, the inter-control unit mutual monitoring processing means 35A monitors the received data from the standby control unit 20B, and this received data is set as <other system> input / output device monitoring information as "other system". When it is detected that "monitoring abnormality" is included (step S70), the <input via other system> input / output device monitoring information 43A stored in the input / output device monitoring information storage means 40A is changed from "normal" to "other system". Change to “monitoring abnormality” (step S71).

  After that, in the main control device 20A, the <own system> input / output device monitoring information 41A stored in the input / output device monitoring information storage means 40A and the <via other system> input / output device by the abnormality factor analysis processing means 36A. Using the monitoring information 43A, the abnormality factor analysis process is executed according to the abnormality factor analysis correspondence table shown in FIG. 7 (step S72). In case 4, the <own system> input / output device monitoring information 41A stored in the input / output device monitoring information storage means 40A is "received data disruption" and <via other system> input / output device monitoring information 43A. Is “another system monitoring error”, it is determined that the main input / output device 60A is out of control, reset, or the like, according to the correspondence table for the error factor analysis in FIG.

  <Case 5: When determining that the download side of the main transmission line (downlink transmission line 1D) is disconnected>

  In FIG. 6, in the main input / output device 60A, the status information change processing means 71A monitors the received data from the main control device 20A transmitted via the downlink transmission path 1D. At this time, if the downlink transmission line 1D is disconnected, data cannot be received even after a lapse of a certain time, and therefore an abnormality (the reception data from the main control device 20A has been interrupted) is detected (step S81). The input / output device status information <own system> area 81A stored in the input / output device status information storage means 80A is changed from "normal" to "received data disruption" (step S82).

  Subsequently, the input / output device state information <local> area 81A stored in the input / output device state information storage unit 80A by the upstream transmission processing unit 74A is transferred from the main input / output device 60A to the main control device 20A. Since it is always transmitted via the upstream transmission line 1U, “received data disruption” is transmitted to the main control device 20A as the updated input / output device state information <own system> area 81A (step S83). .

  In the main control device 20A, the monitoring information change processing means 33A monitors the input / output device status information included in the received data from the main input / output device 60A, and the received data includes the input / output device status information < When it is detected that “reception data disruption” is included in the “own system” area (step S84), the “own system” input / output device monitoring information 41A stored in the input / output device monitoring information storage means 40A is “ “Normal” is changed to “Receiving“ received data interruption ”from the input / output device” (step S85).

  After that, in the main control device 20A, the <own system> input / output device monitoring information 41A stored in the input / output device monitoring information storage means 40A and the <via other system> input / output device by the abnormality factor analysis processing means 36A. Using the monitoring information 43A, an abnormality factor analysis process is executed according to the abnormality factor analysis correspondence table shown in FIG. 7 (step S86). In this case 5, since the <own system> input / output device monitoring information 41A stored in the input / output device monitoring information storage means 40A is “received“ received data disruption ”from the input / output device”, < Via other system> Regardless of the contents of the input / output device monitoring information 43A, it is determined that the download side (downstream transmission path 1D) of the transmission line of the main system is disconnected according to the correspondence table for analysis of abnormal factors in FIG.

  According to this embodiment, there are the following effects. In other words, the abnormality monitoring system 10 of the redundant control device performs transmission processing between the input / output devices 60A and 60B to form an information transmission path via the other system, so that information indicating the abnormality of the own system is transmitted to the other system. Since the data can be acquired via the transmission line, even if data transmission / reception with the local input / output device via the transmission line is interrupted, the status of the local input / output device can be known. By using the output device monitoring information in combination with the <via other system> input / output device monitoring information, various abnormality factors can be determined in detail. For this reason, even if data transmission / reception with the local input / output device via the transmission line is interrupted, the cause is a disconnection of the transmission line, a failure of the transmission circuit, or an abnormality that prevents data transmission to the other party. Can be determined, and the true cause of communication interruption can be left as RAS information.

  For example, as shown in FIG. 7, even if the result of direct monitoring by the main control device 20A (<own system> I / O device monitoring information) is the same as "received data disruption", <via other system> I / O device monitoring By analyzing the cause of the abnormality in combination with the information, "transmission line (both sides) disconnection", "uplink transmission line (upload side) disconnection", "I / O device transmission circuit failure", "I / O device runaway The cause of the abnormality can be determined like “/ reset”.

  Further, in the abnormality monitoring system 10 of the redundant control device, the main control device 20A and the main input / output device 60A subordinate thereto, the standby control device 20B, and the subordinate input / output device 60B subordinate thereto. Has the same abnormality monitoring function that only reverses the main system and the standby system, so by acquiring information indicating abnormality of the main system via the standby system, In addition to being able to perform abnormality factor analysis, it is also possible to perform standby factor abnormality factor analysis by acquiring the reverse flow, that is, information indicating standby system abnormality via the main system. it can. For example, even when the upstream transmission line 2U (upload side) from the standby input / output device 60B to the standby control device 20B is disconnected, the status information is the processing flow of case 1 described in FIG. Since it only flows in the reverse direction, disconnection of the upstream transmission line 2U (upload side) can be detected in the same manner.

  Furthermore, as in case 5 shown in FIG. 6, depending on the abnormality factor, the abnormality factor can be determined without using the information transmission path via the other system. As in cases 1 to 4, a more detailed abnormality factor analysis can be performed by combining with determination using an information transmission path via another system.

  Note that the present invention is not limited to the above-described embodiment, and modifications and the like within a scope where the object of the present invention can be achieved are included in the present invention.

  For example, in the above-described embodiment, “one control device and one input / output device subordinate thereto” is duplexed. However, duplexing is obtained by duplicating a plurality of input / output devices subordinate to one control device. The present invention may be applied to a control device. For example, as shown in FIG. 8, an abnormality monitoring system 200 for a duplex control device in which “one control device and three input / output devices subordinate thereto” are duplexed. In this case, as shown in FIG. 8, the main control device 210 and the main first input / output device 221, the second input / output device 222, and the third input / output device 223 subordinate thereto. Are connected to each other via a transmission path, and the standby control device 230 and the standby first input / output device 241, the second input / output device 242, and the third input / output device 243, which are subordinate thereto, are respectively connected to the transmission path. Connect with In addition, the control devices 210 and 230 are connected by a transmission line, and the first input / output devices 221 and 241, the second input and output devices 222 and 242, and the third input and output devices 223 and 243 are connected by a transmission line. Just connect.

  8 is a configuration in which the transmission is not shared by the bus, the transmission may be shared in order to reduce the equipment cost. For example, the abnormality monitoring system for the duplexing control apparatus shown in FIG. As in 300, a transmission path between the main control device 310 and the subordinate first input / output device 321, the second input / output device 322, and the third input / output device 323 is connected to the main control device 310. A transmission path between the standby control device 330 and the standby first input / output device 341, the second input / output device 342, and the third input / output device 343, which are subordinate thereto. May be shared by the standby transmission bus 360.

  Further, for example, as in the abnormality monitoring system 400 of the duplexing control device shown in FIG. 10, in addition to sharing with the main transmission bus 450 and the standby transmission bus 460, between the first input / output devices 421 and 441 The transmission paths between the second input / output devices 422 and 442 and between the third input / output devices 423 and 443 may be shared by the transmission bus 470 for mutual monitoring of the input / output devices.

  As described above, the abnormality monitoring system and the abnormality monitoring method of the redundant control device according to the present invention are used for, for example, transmission of status information of the input / output device and analysis of abnormal factors in the redundant control device that requires high reliability. Suitable for

1D, 2D Downstream transmission path 1U, 2U Uplink transmission path 3L, 3R, 4L, 4R Transmission path 10, 200, 300, 400 Duplexing controller abnormality monitoring system 20A, 20B, 210, 230, 310, 330, 410, 430 Control devices 31A, 31B Input / output device monitoring processing means 32A, 32B Downstream transmission processing means 33A, 33B Monitoring information change processing means 34A, 34B Inter-control device transmission processing means 35A, 35B Inter-control device mutual monitoring processing means 36A, 36B Abnormal factor Analysis processing means 60A, 60B, 221 to 223, 241 to 243, 321 to 323, 341 to 343, 421 to 423, 441 to 443 Input / output devices 71A and 71B State information change processing means 72A and 72B Inter-input / output device transmission processing Means 73A, 73B I / O unit mutual monitoring processing means 74 , 74B upstream transmission processing unit 75A, 75B self processing unit 90A, 90B transmission circuit

Claims (12)

An abnormality monitoring system for a duplexed control device for monitoring an abnormality of a duplexed control device in which one control device and at least one input / output device connected thereto via a transmission line are duplexed,
Monitor the received data of uplink transmission from the input / output device, and provide the control device with information indicating that the data cannot be received , or the information indicating that the input / output device status information as the received data has received reception data interruption Executes processing to change own system I / O device monitoring information stored in the received I / O device monitoring information storage means to information indicating reception data interruption or information indicating reception data interruption from the input / output device Input / output device monitoring processing means provided in the control device;
Executing the process of transmitting the local input / output device monitoring information stored in the input / output device monitoring information storage means from the control device to the local input / output device via the transmission path; A downlink transmission processing means provided in a device or the input / output device;
The received data of the downlink transmission from the control device is monitored, and the input / output device monitoring information which is the received data is information indicating that the received data is interrupted, or the data cannot be received or due to abnormality due to self-diagnosis or the input / output device Information indicating that reception data interruption has been received from the control device, information indicating transmission data interruption, or a transmission circuit in the local area of the input / output device state information stored in the input / output device state information storage means provided in State information change processing means provided in the input / output device for executing processing for changing to information indicating failure ;
The input / output device state information stored in the input / output device state information storage means is transmitted to the input / output device on the transmission side or the reception side for executing a process of transmitting the input / output device state information between the input / output devices via a transmission path. An input / output device transmission processing means provided;
Information or received data indicating that the received data of the I / O device transmission from the other I / O device is monitored and that the received I / O device status information is received data interruption from the control device. Information indicating discontinuity or information indicating transmission circuit failure, or other data area of the input / output device status information stored in the input / output device status information storage means due to an abnormality in which data cannot be received, is received data from the control device. Between the input / output devices provided in the input / output device that executes processing for changing the information indicating that the interruption has been received, the information indicating the reception data interruption, the information indicating the transmission circuit failure, or the information indicating the other system monitoring abnormality Mutual monitoring processing means;
Executing the process of transmitting the input / output device status information stored in the input / output device status information storage means from the input / output device to the control device of its own system via the transmission path, or Uplink transmission processing means provided in the control device;
The received data of the upstream transmission from the input / output device is monitored, and the other input / output device stored in the input / output device monitoring information storage means by the other area of the input / output device status information which is the received data The control for executing the process of changing the monitoring information to information indicating reception data interruption, information indicating reception data interruption received from the control device, information indicating a transmission circuit failure, or information indicating other system monitoring abnormality Monitoring information change processing means provided in the apparatus;
The control device on the transmission side or the reception side that executes processing for transmitting the other-system input / output device monitoring information stored in the input / output device monitoring information storage means between the control devices via a transmission path Transmission processing means between control devices provided in
The received data of the transmission between the control devices from the control device of the other system is monitored, and the other input / output device monitoring information which is the received data is passed through the other system stored in the input / output device monitoring information storage means Executing the process of changing the input / output device monitoring information to information indicating reception data disruption received from the control device, information indicating reception data disruption, or information indicating transmission circuit failure or other system monitoring abnormality , Mutual control processing means between control devices provided in the control device;
Provided in the control device for executing an abnormality factor analysis process using the input / output device monitoring information of the own system and the input / output device monitoring information via the other system stored in the input / output device monitoring information storage means. An abnormality monitoring system for a redundant control device, comprising: an abnormality factor analysis processing means. The input / output device monitoring processing means includes:
When it is detected that the reception data of uplink transmission from the input / output device has been interrupted, the input / output device monitoring information of the own system indicating the result of the monitoring, information indicating the reception data disruption, It is configured to execute processing to be stored in the device monitoring information storage means,
The downlink transmission processing means includes
As the input / output device monitoring information of the own system, the information indicating the reception data disruption is configured to execute a process of performing downlink transmission from the control device to the input / output device of the own system,
The state information change processing means
Fill before downlink transmission of the received data from the controller, wherein when the own system was the information indicating the reception data interruption as input and output device monitoring information is stored in the input-output device state information storage means It is configured to execute a process of changing the own area of the output device status information to information indicating that reception data disruption has been received from the control device,
The input / output device transmission processing means includes:
The input / output device status information is periodically transmitted to the input / output device of another system,
When the input / output device state information storage means stores information indicating that reception data interruption has been received from the control device as the input / output device state information, the reception data interruption has been received from the control device. Is configured to execute processing for transmitting information indicating that to the input / output device of another system,
The mutual monitoring processing means between the input / output devices is
If the received data input and output device between the transmission from the input-output device of the other system was the information indicating the reception of the received data interruption from the control device as the output device state information, the input It is configured to execute a process of changing the other system area of the input / output device status information stored in the device status information storage means to information indicating that reception data interruption has been received from the control device,
The upstream transmission processing means includes
If the other system area of the input / output device status information stored in the input / output device status information storage unit is information indicating that the received data interruption has been received from the control device, the information is received from the control device. Information indicating that data disruption has been received is configured to execute processing to transmit from the input / output device to the control device of the own system,
The monitoring information change processing means
The received data of the uplink transmission from the input and output device, if the other system areas of the input and output device status information is information indicating the reception of the received data interruption from the control device, the input device monitoring The other-system input / output device monitoring information stored in the information storage means is configured to execute processing for changing to information indicating that reception data interruption has been received from the control device,
The inter-control device transmission processing means includes:
When the information indicating that the received data interruption is received from the control device is stored as the other-system input / output device monitoring information in the input / output device monitoring information storage means, the received data interruption from the control device is stored. Is configured to execute a process of transmitting information indicating that it has been received to the control device of another system,
The control device mutual monitoring processing means,
Receiving data of the control unit between the transmission from the control device of the other system is, when was the information indicating the reception of the received data interruption from the control device as output device monitoring information of the other system, the entering The input / output device monitoring information via the other system stored in the output device monitoring information storage means is configured to execute a process of changing to information indicating that reception data interruption has been received from the control device,
The abnormality factor analysis processing means includes:
In the input / output device monitoring information storage means, information indicating the reception data disruption is stored as the local input / output device monitoring information, and the received data from the control device is input / output device monitoring information via the other system. When the information indicating that the interruption has been received is stored, the uplink transmission path of the own system from the input / output device of the own system to the control apparatus of the own system is disconnected in the transmission path The abnormality monitoring system for a redundant control device according to claim 1, wherein the determination processing is configured to be executed. The input / output device monitoring processing means includes:
When it is detected that the reception data of uplink transmission from the input / output device has been interrupted, the input / output device monitoring information of the own system indicating the result of the monitoring, information indicating the reception data disruption, It is configured to execute processing to be stored in the device monitoring information storage means,
The state information change processing means
When it is detected that the reception data of the downlink transmission from the control device has been interrupted, the local area of the input / output device state information stored in the input / output device state information storage means indicates reception data disruption It is configured to execute processing to change to information,
The input / output device transmission processing means includes:
The input / output device status information is periodically transmitted to the input / output device of another system,
When the information indicating the reception data interruption is stored as the input / output device state information in the input / output device state information storage unit, the information indicating the reception data interruption is transmitted to the input / output device of another system. It is configured to execute the transmission process,
The mutual monitoring processing means between the input / output devices is
Receive data input and output device between the transmission from the input-output device of another system, wherein when was the information indicating the reception data interruption as input and output device state information, the input-output device state information storage means storing The other region of the input / output device status information is configured to execute processing to change to information indicating the reception data disruption,
The upstream transmission processing means includes
When the other area of the input / output device state information stored in the input / output device state information storage means is information indicating the reception data interruption, the information indicating the reception data interruption is It is configured to execute processing to transmit from the device to the control device of its own system,
The monitoring information change processing means
When the uplink transmission reception data from the input / output device is information indicating that the other data area of the input / output device status information indicates the reception data disruption, it is stored in the input / output device monitoring information storage means The other-system input / output device monitoring information is configured to execute processing for changing to information indicating the reception data disruption,
The inter-control device transmission processing means includes:
When the information indicating the reception data disruption is stored as the other input / output device monitoring information in the input / output device monitoring information storage unit, the information indicating the reception data disruption is stored in the control of the other system. It is configured to execute processing to be transmitted to the device,
The control device mutual monitoring processing means,
Receiving data of the control unit between the transmission from the control device of the other system is, when a was the information indicating the reception data interruption as input and output device monitoring information of the other system, the input-output device monitoring information storage unit The stored input / output device monitoring information via the other system is configured to execute processing for changing the received data to information indicating disruption,
The abnormality factor analysis processing means includes:
In the input / output device monitoring information storage means, information indicating the reception data interruption is stored as the input / output device monitoring information of the own system, and the reception data interruption is indicated as the input / output device monitoring information via the other system When the information is stored, the upstream transmission path from the local input / output device to the local control apparatus in the transmission path and the local input from the local control apparatus. The abnormality monitoring system for a duplex control apparatus according to claim 1, wherein a process for determining that both of the downlink transmission paths of the own system to the output device are disconnected is executed. The input / output device is provided with a self-diagnosis processing means for executing a process for self-diagnosis of a failure of the transmission circuit provided in the input / output device,
The input / output device monitoring processing means includes:
When it is detected that the reception data of uplink transmission from the input / output device has been interrupted, the input / output device monitoring information of the own system indicating the result of the monitoring, information indicating the reception data disruption, It is configured to execute processing to be stored in the device monitoring information storage means,
The state information change processing means
When a failure of the transmission circuit is detected by the self-diagnosis processing means, the own area of the input / output device status information stored in the input / output device status information storage means is changed to information indicating a transmission circuit failure. It is configured to execute the process to
The input / output device transmission processing means includes:
The input / output device status information is periodically transmitted to the input / output device of another system,
When the information indicating the transmission circuit failure is stored as the input / output device state information in the input / output device state information storage means, the information indicating the transmission circuit failure is transmitted to the input / output device of another system. It is configured to execute the transmission process,
The mutual monitoring processing means between the input / output devices is
Receive data input and output device between the transmission from the input-output device of another system, wherein when was the information indicating the transmission circuit failure as output device state information, the input-output device state information storage means storing The other region of the input / output device status information is configured to execute processing to change to information indicating the transmission circuit failure,
The upstream transmission processing means includes
When the other system area of the input / output device state information stored in the input / output device state information storage means is information indicating the transmission circuit failure, the information indicating the transmission circuit failure is It is configured to execute processing to transmit from the device to the control device of its own system,
The monitoring information change processing means
When the uplink transmission reception data from the input / output device is information indicating that the other system area of the input / output device status information indicates the transmission circuit failure, the data is stored in the input / output device monitoring information storage means. The other system I / O device monitoring information is configured to execute processing to change to information indicating the transmission circuit failure,
The inter-control device transmission processing means includes:
When the information indicating the transmission circuit failure is stored as the other system input / output device monitoring information in the input / output device monitoring information storage unit, the information indicating the transmission circuit failure is stored in the control of the other system. It is configured to execute processing to be transmitted to the device,
The control device mutual monitoring processing means,
Receiving data of the control unit between the transmission from the control device of the other system is, when a was the information indicating the transmission circuit failure as input and output device monitoring information of the other system, the input-output device monitoring information storage unit The stored input / output device monitoring information via the other system is configured to execute processing for changing to information indicating the transmission circuit failure,
The abnormality factor analysis processing means includes:
In the input / output device monitoring information storage means, information indicating the reception data interruption is stored as the input / output device monitoring information of the own system, and the transmission circuit failure is indicated as the input / output device monitoring information via the other system 2. The duplex control according to claim 1, wherein when information is stored, a process for determining that the transmission circuit of the input / output device of the own system is faulty is executed. 3. Equipment abnormality monitoring system. The input / output device monitoring processing means includes:
When detecting that the reception data from the input device is disrupted, the as input device monitoring information of the own system showing the results of monitoring, the information indicating the reception data interruption, the input device monitoring information It is configured to execute processing to be stored in the storage means,
The mutual monitoring processing means between the input / output devices is
When it is detected that the received data from the input / output device of another system is interrupted, the other system area of the input / output device status information stored in the input / output device status information storage means It is configured to execute processing to change to information indicating
The upstream transmission processing means includes
If the other system area of the input / output device status information stored in the input / output device status information storage means is information indicating the other system monitoring abnormality, the information indicating the other system monitoring abnormality is It is configured to execute processing to transmit from the entry output device to the control device of the own system,
The monitoring information change processing means
Receiving data upstream transmission from the input-output device, wherein, when the other system areas of the input and output device status information is information indicating the other system monitoring error is stored in the input-output device monitoring information storage unit The other-system input / output device monitoring information is configured to execute processing to change to information indicating the other-system monitoring abnormality,
The inter-control device transmission processing means includes:
When the information indicating the other system monitoring abnormality is stored as the other system input / output device monitoring information in the input / output device monitoring information storage unit, the information indicating the other system monitoring abnormality is stored in the other system. It is configured to execute processing to be transmitted to the control device,
The control device mutual monitoring processing means,
Receiving data of the control unit between the transmission from the control device of the other system is, when the said is information indicating the other system monitoring error as input and output device monitoring information of the other system, the input-output device monitoring information storage unit Is configured to execute processing for changing the other-system input / output device monitoring information stored in to the information indicating the other-system monitoring abnormality,
The abnormality factor analysis processing means includes:
In the input / output device monitoring information storage means, information indicating the reception data disruption is stored as the own input / output device monitoring information, and the other system monitoring abnormality is detected as the input / output device monitoring information via the other system. 2. The duplex control according to claim 1, wherein when the information to be stored is stored, a process of determining that the device body of the input / output device of the own system is abnormal is executed. Equipment abnormality monitoring system. The state information change processing means
When it is detected that the data received from the control device has been interrupted, the local area of the input / output device status information stored in the input / output device status information storage means is changed to information indicating reception data disruption. It is configured to execute the process to
The upstream transmission processing means includes
When the local area of the input / output device state information stored in the input / output device state information storage means is information indicating the reception data interruption, the information indicating the reception data interruption is It is configured to execute processing to transmit from the device to the control device of its own system,
The monitoring information change processing means
The input / output device status information which is received data from the input / output device is monitored, and the own input / output device stored in the input / output device monitoring information storage means by the own region of the input / output device status information If the local area of the input / output device status information is information indicating the interruption of the received data, the local system stored in the input / output device monitoring information storage means is also executed. The input / output device monitoring information is configured to execute processing for changing the received data disruption information to the information indicating that the input / output device has been received,
The abnormality factor analysis processing means includes:
When the input / output device monitoring information storage unit stores information indicating that reception data interruption has been received from the input / output device as the local input / output device monitoring information, The duplexing according to claim 1, wherein a process for determining that the own downlink transmission path from the control device of the system to the input / output device of the own system is disconnected is executed. Control device abnormality monitoring system. An abnormality monitoring method for a duplexed control apparatus for monitoring an abnormality of a duplexed control apparatus in which one control apparatus and at least one input / output device connected thereto via a transmission line are duplexed,
The input / output device monitoring processing means provided in the control device monitors the reception data of the upstream transmission from the input / output device, and the data cannot be received , or the input / output device status information as the received data is received data. Based on the information indicating that the interruption is received, the local input / output device monitoring information stored in the input / output device monitoring information storage means provided in the control device is received from the information indicating the received data interruption or the input / output device. Execute processing to change to information indicating that the data disruption has been received ,
Downlink transmission processing means provided in the control device or the input / output device transmits the input / output device monitoring information of the own system stored in the input / output device monitoring information storage means from the control device to the input of the own system. Execute processing to transmit to the output device via the transmission path,
Status information change processing means provided in the input / output device monitors received data for downlink transmission from the control device, and the input / output device monitoring information as the received data indicates information indicating reception data disruption, or data Due to an abnormality that cannot be received or due to an abnormality due to self-diagnosis , the local area of the input / output device status information stored in the input / output device status information storage means provided in the input / output device is received from the control device. Execute processing to change to information indicating that the data has been received, information indicating that the received data has been disrupted, or information indicating that the transmission circuit has failed ,
A transmission processing unit between input / output devices provided in the input / output device on the transmission side or the reception side transmits the input / output device state information stored in the input / output device state information storage unit between the input / output devices. Execute the process of transmitting through the transmission path,
The inter-input / output device mutual monitoring processing means provided in the input / output device monitors the received data of the transmission between the input / output devices from the other input / output devices, and the input / output device status information is the received data Is stored in the input / output device state information storage means due to information indicating that reception data interruption has been received from the control device, information indicating reception data interruption, information indicating transmission circuit failure, or an abnormality in which data cannot be received . The other system area of the input / output device status information is changed to information indicating that reception data interruption has been received from the control apparatus, information indicating reception data interruption, information indicating transmission circuit failure, or information indicating other system monitoring abnormality. Execute the process to
Uplink transmission processing means provided in the input / output device or the control device transfers the input / output device status information stored in the input / output device status information storage means from the input / output device to the control device of its own system. Performing a process of transmitting through the transmission path;
The monitoring information change processing means provided in the control device monitors the reception data of the uplink transmission from the input / output device, and the input / output device by the other area of the input / output device status information which is the received data Other system input / output device monitoring information stored in the monitoring information storage means, information indicating reception data disruption, information indicating reception data disruption received from the control device, information indicating transmission circuit failure, or other system monitoring Execute processing to change to information indicating an abnormality ,
The inter-control device transmission processing means provided in the control device on the transmitting side or the receiving side transmits the other input / output device monitoring information stored in the input / output device monitoring information storage means between the control devices. Execute the process of transmitting through the transmission path,
The inter-control device mutual monitoring processing means provided in the control device monitors the reception data of the inter-control device transmission from the control device of the other system, and the input / output device monitoring information of the other system that is the received data. , Input / output device monitoring information via another system stored in the input / output device monitoring information storage means, information indicating that reception data disruption has been received from the control device, information indicating reception data disruption, transmission circuit failure or Execute processing to change to information indicating abnormal monitoring of other systems ,
The abnormality factor analysis processing means provided in the control device uses the own input / output device monitoring information and the other input / output device monitoring information stored in the input / output device monitoring information storage means. An abnormality monitoring method for a redundant control device, characterized by executing an abnormality factor analysis process. The input / output device monitoring processing means
When it is detected that the reception data of uplink transmission from the input / output device has been interrupted, the input / output device monitoring information of the own system indicating the result of the monitoring, information indicating the reception data disruption, Execute processing to be stored in the device monitoring information storage means,
The downlink transmission processing means is
As the input / output device monitoring information of the own system, information indicating the reception data disruption is executed from the control device to the input / output device of the own system,
The state information change processing means
Fill before downlink transmission of the received data from the controller, wherein when the own system was the information indicating the reception data interruption as input and output device monitoring information is stored in the input-output device state information storage means Execute processing to change the local area of the output device status information to information indicating that the received data disruption has been received from the control device,
The transmission processing means between the input / output devices is
The input / output device status information is periodically transmitted to the input / output device of another system,
When the input / output device state information storage means stores information indicating that reception data interruption has been received from the control device as the input / output device state information, the reception data interruption has been received from the control device. Execute processing to transmit information indicating that to the input / output device of the other system,
The mutual monitoring processing means between the input / output devices,
If the received data input and output device between the transmission from the input-output device of the other system was the information indicating the reception of the received data interruption from the control device as the output device state information, the entering Executing the process of changing the other system area of the input / output device status information stored in the output device status information storage means to information indicating that the received data disruption has been received from the control device;
The uplink transmission processing means is
If the other system area of the input / output device status information stored in the input / output device status information storage unit is information indicating that the received data interruption has been received from the control device, the information is received from the control device. Executes a process of transmitting information indicating that data disruption has been received from the input / output device to the control device of its own system,
The monitoring information change processing means
The received data of the uplink transmission from the input and output device, if the other system areas of the input and output device status information is information indicating the reception of the received data interruption from the control device, the input device monitoring Executing the process of changing the other-system input / output device monitoring information stored in the information storage means to information indicating that reception data disruption has been received from the control device;
The inter-control device transmission processing means,
When the information indicating that the received data interruption is received from the control device is stored as the other-system input / output device monitoring information in the input / output device monitoring information storage means, the received data interruption from the control device is stored. Execute the process of transmitting information indicating that it has been received to the control device of another system,
The control device mutual monitoring processing means,
Receiving data of the control unit between the transmission from the control device of the other system is, when was the information indicating the reception of the received data interruption from the control device as output device monitoring information of the other system, the entering Executing the process of changing the input / output device monitoring information via the other system stored in the output device monitoring information storage means to information indicating that reception data interruption has been received from the control device;
The abnormality factor analysis processing means is
In the input / output device monitoring information storage means, information indicating the reception data disruption is stored as the local input / output device monitoring information, and the received data from the control device is input / output device monitoring information via the other system. When the information indicating that the interruption has been received is stored, the uplink transmission path of the own system from the input / output device of the own system to the control apparatus of the own system is disconnected in the transmission path The abnormality monitoring method for a duplex control apparatus according to claim 7, wherein a determination process is executed. The input / output device monitoring processing means
When it is detected that the reception data of uplink transmission from the input / output device has been interrupted, the input / output device monitoring information of the own system indicating the result of the monitoring, information indicating the reception data disruption, Execute processing to be stored in the device monitoring information storage means,
The state information change processing means
When it is detected that the reception data of the downlink transmission from the control device has been interrupted, the local area of the input / output device state information stored in the input / output device state information storage means indicates reception data disruption Execute processing to change to information,
The transmission processing means between the input / output devices is
The input / output device status information is periodically transmitted to the input / output device of another system,
When the information indicating the reception data interruption is stored as the input / output device state information in the input / output device state information storage unit, the information indicating the reception data interruption is transmitted to the input / output device of another system. Execute the process to transmit,
The mutual monitoring processing means between the input / output devices,
Receive data input and output device between the transmission from the input-output device of another system, wherein when was the information indicating the reception data interruption as input and output device state information, the input-output device state information storage means storing Executing the process of changing the other region of the input / output device status information to the information indicating the reception data disruption,
The uplink transmission processing means is
When the other area of the input / output device state information stored in the input / output device state information storage means is information indicating the reception data interruption, the information indicating the reception data interruption is Execute processing to transmit from the device to the control device of its own system,
The monitoring information change processing means
When the uplink transmission reception data from the input / output device is information indicating that the other data area of the input / output device status information indicates the reception data disruption, it is stored in the input / output device monitoring information storage means Executing the process of changing the other-system input / output device monitoring information to information indicating the reception data disruption,
The inter-control device transmission processing means,
When the information indicating the reception data disruption is stored as the other input / output device monitoring information in the input / output device monitoring information storage unit, the information indicating the reception data disruption is stored in the control of the other system. Execute processing to transmit to the device,
The control device mutual monitoring processing means,
Receiving data of the control unit between the transmission from the control device of the other system is, when a was the information indicating the reception data interruption as input and output device monitoring information of the other system, the input-output device monitoring information storage unit Executing the process of changing the stored input / output device monitoring information via the other system to information indicating the reception data disruption,
The abnormality factor analysis processing means is
In the input / output device monitoring information storage means, information indicating the reception data interruption is stored as the input / output device monitoring information of the own system, and the reception data interruption is indicated as the input / output device monitoring information via the other system When the information is stored, the upstream transmission path from the local input / output device to the local control apparatus in the transmission path and the local input from the local control apparatus. The abnormality monitoring method for a duplex control apparatus according to claim 7, wherein a process of determining that both of the downlink transmission paths of the own system to the output device are disconnected is executed. The input / output device monitoring processing means
When it is detected that the reception data of uplink transmission from the input / output device has been interrupted, the input / output device monitoring information of the own system indicating the result of the monitoring, information indicating the reception data disruption, Execute processing to be stored in the device monitoring information storage means,
Self-diagnosis processing means provided in the input / output device,
Performing a process of self-diagnosis of a failure in a transmission circuit provided in the input / output device;
The state information change processing means
When a failure of the transmission circuit is detected by the self-diagnosis processing means, the own area of the input / output device status information stored in the input / output device status information storage means is changed to information indicating a transmission circuit failure. Execute the process to
The transmission processing means between the input / output devices is
The input / output device status information is periodically transmitted to the input / output device of another system,
When the information indicating the transmission circuit failure is stored as the input / output device state information in the input / output device state information storage means, the information indicating the transmission circuit failure is transmitted to the input / output device of another system. Execute the process to transmit,
The mutual monitoring processing means between the input / output devices,
Receive data input and output device between the transmission from the input-output device of another system, wherein when was the information indicating the transmission circuit failure as output device state information, the input-output device state information storage means storing The other region of the input / output device state information is changed to information indicating the transmission circuit failure,
The uplink transmission processing means is
When the other system area of the input / output device state information stored in the input / output device state information storage means is information indicating the transmission circuit failure, the information indicating the transmission circuit failure is Execute processing to transmit from the device to the control device of its own system,
The monitoring information change processing means
When the uplink transmission reception data from the input / output device is information indicating that the other system area of the input / output device status information indicates the transmission circuit failure, the data is stored in the input / output device monitoring information storage means. Executing the process of changing the other system input / output device monitoring information to information indicating the transmission circuit failure;
The inter-control device transmission processing means,
When the information indicating the transmission circuit failure is stored as the other system input / output device monitoring information in the input / output device monitoring information storage unit, the information indicating the transmission circuit failure is stored in the control of the other system. Execute processing to transmit to the device,
The control device mutual monitoring processing means,
Receiving data of the control unit between the transmission from the control device of the other system is, when a was the information indicating the transmission circuit failure as input and output device monitoring information of the other system, the input-output device monitoring information storage unit Executing the process of changing the stored input / output device monitoring information via the other system to information indicating the transmission circuit failure;
The abnormality factor analysis processing means is
In the input / output device monitoring information storage means, information indicating the reception data interruption is stored as the input / output device monitoring information of the own system, and the transmission circuit failure is indicated as the input / output device monitoring information via the other system 8. The method for monitoring an abnormality of a duplexing control device according to claim 7, wherein when information is stored, a process of determining that a transmission circuit of the input / output device of the own system is out of order is executed. . The input / output device monitoring processing means
When detecting that the reception data from the input device is disrupted, the as input device monitoring information of the own system showing the results of monitoring, the information indicating the reception data interruption, the input device monitoring information Execute processing to be stored in the storage means,
The mutual monitoring processing means between the input / output devices,
When it is detected that the received data from the input / output device of another system is interrupted, the other system area of the input / output device status information stored in the input / output device status information storage means Execute the process to change the information to indicate
The uplink transmission processing means is
If the other system area of the input / output device status information stored in the input / output device status information storage means is information indicating the other system monitoring abnormality, the information indicating the other system monitoring abnormality is Execute the process of transmitting from the entry output device to the control device of its own system,
The monitoring information change processing means
Receiving data upstream transmission from the input-output device, wherein, when the other system areas of the input and output device status information is information indicating the other system monitoring error is stored in the input-output device monitoring information storage unit The other system I / O device monitoring information is changed to information indicating the other system monitoring abnormality,
The inter-control device transmission processing means,
When the information indicating the other system monitoring abnormality is stored as the other system input / output device monitoring information in the input / output device monitoring information storage unit, the information indicating the other system monitoring abnormality is stored in the other system. Execute processing to transmit to the control device;
The control device mutual monitoring processing means,
Receiving data of the control unit between the transmission from the control device of the other system is, when the said is information indicating the other system monitoring error as input and output device monitoring information of the other system, the input-output device monitoring information storage unit Executing the process of changing the input / output device monitoring information via the other system stored in to information indicating the other system monitoring abnormality,
The abnormality factor analysis processing means is
In the input / output device monitoring information storage means, information indicating the reception data disruption is stored as the own input / output device monitoring information, and the other system monitoring abnormality is detected as the input / output device monitoring information via the other system. The abnormality monitoring method for a duplex control apparatus according to claim 7, wherein when the information to be stored is stored, a process of determining that the apparatus main body of the input / output apparatus of the own system is abnormal is executed. . The state information change processing means
When it is detected that the data received from the control device has been interrupted, the local area of the input / output device status information stored in the input / output device status information storage means is changed to information indicating reception data disruption. Execute the process to
The uplink transmission processing means is
When the local area of the input / output device state information stored in the input / output device state information storage means is information indicating the reception data interruption, the information indicating the reception data interruption is Execute processing to transmit from the device to the control device of its own system,
The monitoring information change processing means
The input / output device status information which is received data from the input / output device is monitored, and the own input / output device stored in the input / output device monitoring information storage means by the own region of the input / output device status information If the local area of the input / output device status information is information indicating the interruption of the received data, the local system stored in the input / output device monitoring information storage means is also executed. Executing the process of changing the input / output device monitoring information to information indicating that the received data interruption has been received from the input / output device,
The abnormality factor analysis processing means is
When the input / output device monitoring information storage unit stores information indicating that reception data interruption has been received from the input / output device as the local input / output device monitoring information, The abnormality monitoring of the duplex control apparatus according to claim 7, wherein a process of determining that the own downlink transmission path from the control apparatus of the system to the input / output apparatus of the own system is disconnected is executed. Method.

Images