JPS6136261B2 - - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION The present invention relates to an improvement in a fault diagnosis method in a distributed control system that is effective in an instrumentation control system.

In distributed control systems, there has traditionally been a method for controlling communication between each control station called data freeway, but in concrete commercialized examples, it is necessary to install a management station on the loop. It was hot. In this method, communication is performed via the management station, which is not only disadvantageous in terms of communication efficiency, but also has the disadvantage that the management station becomes an obstacle to reliability.

In recent years, the use of LSI in various devices has progressed, and by using inexpensive microprocessors in control stations, it is becoming possible to realize more efficient and reliable systems. We have not yet reached the establishment of an optimal communication system that covers the entire system, nor have we reached the establishment of a fault diagnosis method that minimizes the effects of a failed control station.

In order to increase the reliability of the system in a highly expandable loop-shaped communication path, it is necessary to minimize the impact of failures at each station on the communication path.
The purpose is to improve the detection rate of processor failures and ensure station isolation.

In the loop communication system, in order to prevent a failure of each control station from affecting the entire communication path, it is necessary to reliably diagnose the failure of each control station. As one diagnostic means, it is effective to use normal operation signals from the microprocessor. In this case, it is necessary to eliminate the possibility that the microprocessor will issue a normal operation signal despite an abnormality.

The possibility of issuing a normal operation signal when the microprocessor is abnormal corresponds to the following phenomena (1) and (3) when the microprocessor is abnormal.

(A) When entering an abnormal loop state (1) When the loop includes a normal signal output section.

(2) When looping in other parts.

(B) When stopped (3) When stopped just before the normal signal is reset.

(4) When stopping in other parts.

Of these, (3) can be avoided by using a circuit that detects changes using an external determination circuit for normal signals. Regarding (1), the possibility can be eliminated by effectively combining the following measures.

(a) Perform a SUM check on the program that includes the normal operation signal output section.

(b) Perform a milestone check in the same loop as above.

(c) Check the time for one round of the loop.

(d) Generate an interrupt at the same time as the normal signal is output.

(e) Make a low-priority task send a normal signal.

(f) Detect a fixed failure to ``1'' or ``0'' on the microprocessor bus by a read-after-write check.

However, (b) is weak when a path can be made that passes through the milestone arrangement. (c) is weak when a bus is created that includes a part that dominates the first round time.

Therefore, it is efficient to detect critical endless loops by combining (a), (d), (e), and (f).

The present invention provides an efficient fault diagnosis method in a distributed control system by combining (a), (d), (e), and (f).

Embodiments of the invention will be described with reference to the drawings. FIG. 1 is an overall configuration diagram of a group of control stations connected by a loop-shaped communication path. A control station 3-1 that controls a single group of functions such as PID control,
3-2,..., 3-N have a microprocessor inside, and the coupling portions 2-1, 2-2,..., 2
-N is connected to the loop-shaped communication path 1.

FIG. 2 is a detailed diagram of the connection between the control station 3 and the communication path 1 for one control station 3. As shown in FIG.

When the station is normal, relay 4 is connected to communication path 1.
The contacts operate to include the control station 3 (the contacts operate downward in the figure). On the other hand, when an abnormality occurs, the contacts of the relay 4 operate so that the communication path 1 bypasses the control station 3 (the contacts operate upward in the figure).

The normal operation signal 6 of the control station 3 is an input signal 7 obtained by the fault detection circuit 5 of the control station 3 via the photocoupler 9 from the communication path 1;
Output signal 8 to communication path 1, and a microcomputer (hereinafter referred to as
Normal operation signal 16 from 10 (referred to as CPU)
Create as input. The normal operation signal 6 is input as a drive signal to the relay 4 and operates the relay contacts. This failure detection circuit 5 is composed of a one-shot altivibrator 50 and AND and OR gates. The main components of the control station 3 are a CPU 10, a communication control LSI 12,
It is composed of an I/O interface LSI 11. The part that feeds back the change signal 17 of the normal operation signal 16 from the CPU 10, which is the core of the present invention, will be explained. The normal operation signal 16 is input to a multi-vibrator (one-shot multivibrator) 50, and if there is a change in the signal within a time interval determined by the time constant of this circuit, the output signal 17 will be in the "1" state. is maintained. This signal is input to the IRQ terminal as an interrupt signal 18 to the CPU 10. Here, if the time constant of the multivibrator 50 that generates the output signal 17 is set to match the period of the normal operation signal 16, the interrupt signal 1 will be generated every time the normal operation signal 16 is output.
8 will be input to the CPU 10.

FIG. 3 shows an example of the software configuration, and FIG.
) is carried out periodically and repeatedly.
During this program, a signal indicating that the CPU 10 is operating normally is output. This output signal is used for the input/output interface as described above.
It becomes the input signal 16 of the station failure detection circuit via the LSI 11. This circuit extracts a change signal 17 of the same signal and returns it to the CPU 10 as an interrupt signal 18.

Figure b in Figure 3 is a program that is started by this interrupt signal 18, and when the number of interrupts related to the CPU normal signal continues n times, the failure of the CPU itself is detected by a read-after-write check, and the normal signal output section Check the SUM of the entire loop of the program including
If there is an abnormality, the CPU 10 will be stopped, but
If there is no abnormality, perform normal processing.

FIG. 4 is a diagram explaining that the content of the invention described in FIGS. 2 and 3 is effective and simple.

Figure b in Figure 4 is a main program corresponding to Figure a in Figure 3, with additional processing for discovering abnormal endless loops in the program. That is, the milestone check C1 in the flow is a part for checking whether the program processing has passed through this part. In addition, in order to improve the responsiveness of interrupt processing, there is a part C2 that normally performs a SUM check, etc. within this routine, and a timer C3 that checks whether the time to complete one round of this routine is included in a certain width.・Includes the reset processing part, etc. For the latter time monitoring, a software timer is required. Figure 4a shows a timer processing routine in which the timing signal 20 from the clock 13 is
Given the NMI end, the CPU 10 wakes up and updates the software timer. Then, the average value of the timing signal 20 over a certain period of time is
If the value is not within a certain range, it is considered abnormal and the CPU
Stop 10. On the main program side, the software timer is reset C3 every time output processing is completed.

Diagram c in FIG. 4 corresponds to diagram b in FIG. 3. In the interrupt handling routine, in the main routine
Determine whether the SUM check etc. have finished, and if not, use an interrupt routine to
Perform SUM check C4, etc., and if there is an abnormality, check the CPU
Stop 10. If it is normal, normal processing is performed.

In FIG. 4B, broken lines a to e list problematic cases where an abnormality occurs in the program and a minor loop occurs. In other words, in either case, SUM check etc. are skipped,
This is a problem because C2 does not detect any abnormality but outputs a normal output signal.

In particular, in the case of a, there is a particular problem in that it is not detected by any of the checks C1, C2, and C3, and in this case it is detected only by C4. This is because in any case of a to e, CPU10
Since the normal output signal is output, the SUM check C4 etc. by the interrupt processing routine is received and it is determined that there is an abnormality.

Since a and b include normal processing blocks in the loop that dominate most of the processing time in the loop, they cannot be detected by time check C3.

Since a and e do not pass milestone check C1, they cannot be detected by milestone check C1.

As explained above, even if more complicated error detection processing is added, some abnormal endless loops remain undetected, but according to this embodiment, unless the interrupt handling mechanism fails, relatively Abnormal endless loops can be detected with a simple configuration.

The present invention provides a self-detection mechanism for a failed control station with a high failure detection rate in a loop communication system that is highly scalable and has no bottlenecks in terms of reliability. It will be done.

(1) When a failure occurs in each station connected to a loop-shaped communication path, it can be reliably handled with a relatively simple configuration.
It is possible to determine whether a failure is due to an abnormality in the CPU itself, and by using this determination signal, it is possible to reliably disconnect the corresponding station from the communication path when a failure is determined.

(2) Therefore, the influence of failure of one station does not spread to the entire system, and system control can be continued despite station failure.

[Brief explanation of the drawing]

FIG. 1 is an explanatory diagram of a group of stations connected by a loop-shaped communication path, which is the object of the present invention, FIG. 2 is an embodiment of the present invention, and FIG. 3 is an embodiment of the software configuration of the present invention. FIG. 4 is an explanatory diagram of the simplicity and effectiveness of the present invention. DESCRIPTION OF SYMBOLS 1...Communication path, 2...Coupling part, 3...Control station, 4...Relay, 5...Failure detection circuit, 10...
CPU.

Claims (1)

[Claims] 1 Consisting of a plurality of control stations each having a microprocessor inside, a communication path for connecting each control station in a loop, and a coupling section for connecting this communication path and each control station, - In a distributed control system in which a processor repeatedly executes a processing program and periodically outputs a signal indicating that it is operating normally during the execution of the processing program, the signal indicating that it is operating normally is output. 1. A fault diagnosis method for a distributed control system, characterized in that an interrupt signal is given to the microprocessor each time the microprocessor is run, and the microprocessor itself is diagnosed with a fault based on the interrupt signal.