FI121718B - Control system for controlling a piston engine - Google Patents

Description

PISTON ENGINE CONTROL SYSTEM

Field of the Invention The present invention relates to a system for controlling a piston engine. In particular, the invention relates to a control system comprising I / O elements and a communication bus between I / O elements.

10 Background and state of the art

In the prior art, electronics are commonly used in control systems. The use of electronics is common in small piston engines. However, the use of electronics 15 is not so simple on larger engines. In large piston engines, the importance of electronic control is growing. Electrical control can improve engine performance, reduce emissions and reduce fuel consumption. Thus, the use of electronics in connection with large motors 20 is increasing. Although the use of electronics in smaller piston engines has been widespread, its application to larger engines is not straightforward. The main difference is that larger motors are often used in applications where reliability is essential and essential. For example, such applications may be in a ship propulsion where a malfunction of the engine may result in a "dead state" or unmanned ship, that is, in a worst case scenario, which can be fatal.

30 Therefore, electronics and programmable systems used in large motors are usually designed in a durable manner for good reliability. One way to achieve such reliability is through so-called redundancy, in which the necessary core operations are placed in two identical units. By one unit 2 failures, control is transferred to another unit and control is not interrupted. Typically, these types of standby redundancy systems are used, for example, in process automation, where process security is based, for example, on programmable logic. This redundancy architecture requires a considerable amount of synchronization information to keep the certifying unit up to date with the information of the first unit. Quite commonly, a high-speed bus is used here, for example, via optical media 10, to transmit synchronization information fast enough.

Figure 1 illustrates a prior art system using two identical units. The second is a safety unit 12 which is used when the main unit 11 is in a fault state. 15 The safety unit must be continuously updated via line 6 to ensure uninterrupted control of the piston engine. Therefore, a large amount of synchronization information is required. Such dual systems are expensive. Thus, only the CPU 11 and the bus 13 generally have duplicates 12, 14 to prevent one of the communication channels from being affected by the control task.

The field device interfaces, i.e. I / O elements 15-18, have no security units in such control systems. CPUs 11, 12 denote a central control element. Two CPUs are used to provide redundancy. I / O means input-25 / output elements 15-18 which can measure or control the corresponding process values (since the redundancy on the actuator side, for example, is very process dependent).

Disadvantages of the Prior Art

One general weakness of the redundancy apparatus described above is that system design becomes relatively expensive, since redundancy means, for example, duplicating processors and other control elements 35. Another weakness is that in order to reduce the cost 3, the input / output elements are often not duplicated and the residual functionality in these cases is not fully verified. A typical structure can thus be described as shown in Figure 1. One reason 5 to maintain this control architecture is that it is easy to create control nodes for these types of systems, because logic can assume that the main control element CPU is always available.

Brief Description of the Invention

The object of the invention is to provide a more reliable and fault tolerant motor control. The invention is based on a new architecture of a piston engine control control system. The control system comprises I / O elements 25 -28, 35-38, 45-48, and communication bus 23, 24, 33, 34, 43, 44 between I / O elements. Each I / O element is arranged to transfer any physical a reading for any I / O element to control any physical output of any I / O element 20, and to monitor the states of the other I / O elements. At least one of the I / O elements comprises at least one control module 29, 39, 49 for controlling the system and at least one of the I / O elements comprises at least one security control module 210, 310 dedicated to a particular control module which controls the system in case of a control module failure.

Significant advantages can be achieved by the invention. A more reliable and fault tolerant control system 30 may be provided. Motor control can be easily dimensioned to meet system design requirements using distributed devices rather than a large centralized device. The invention relates to a distributed architecture in which the main control is preferably divided into several modules.

4

The modules can be placed in the I / O units as desired. The modules are preferably software.

List of patterns 5

The invention is illustrated by reference to the following figures:

Figure 1 illustrates the structure of the prior art solution, 10

Figures 2-4 illustrate various embodiments of the system of the present invention, and

Figure 5 illustrates the structure of an I / O module 15 according to the present invention.

Detailed description of the figures

Figure 2 shows a system 20 including I / O elements 20, 25, 26, 27, 28 ... n, where n is a positive integer.

System 20 further comprises buses 23 and 24. The first bus 23 is for normal operation. The second bus 24 is a security bus used in the event of a malfunction on the first bus. The I / O element 25 comprises 25 control modules 29 which perform the functions of the main control. The I / O elements 25, 26-28 have means for processing physical output signals based on the control signals of the control module. Therefore, they also have means for receiving control signals over the bus. The I / O-30 elements 25, 26, 27, 28 ... n also have means for transforming the physical inputs into a form understood by the control module 29 and means for transferring them through the bus. In order to secure the system, another I / O element, for example element 26, includes a safety control module 210. If the control module 29 does not function, the main control function can be transferred to the safety control module 210.

The input / output elements 25, 26, 27, 28 ... n are capable of independent operation. They can also be controlled by the control module 29 or the safety control module 210. Dynamic redundancy is achieved by allowing any input / output element 26, 27 ... 28 + to fail while maintaining the essential control function. In the example of Figure 2, the single control module 29 performs the functions of the master control. If the I / O element 25 is malfunctioning or has a severe malfunction, the main control functions may be transferred to the safety control modules 210.

Since the input / output elements 25, 26, 27, 28 ... n are capable of independent operation, any of the input / output elements may include a control module. In Figure 2 and other systems of the invention disclosed herein, the main control is located on at least one I / O element instead of a large centralized device. If the I / O element 25 performing the 20 main controls were to fail, the entire control would not stop because another I / O element 26 containing the safety control module could continue the main control functions.

Figure 3 shows a system 30 including I / O elements 35, 36, 37, 38 ... n, where n is a positive integer.

The system 30 further comprises buses 33 and 34. Here, the I / O element 36 includes a control module. The control module includes a master control as a single control module 39. The I / O-30 elements 35, 36 ... 38 + n have means for processing physical output signals based on the control signals of the control module 39. They also have means for receiving control signals via the bus. The I / O elements 35, 36, 37, 38 ... n also have means 35 for transforming the physical inputs into a shape understood by the control module 39 and means for transferring them through the bus.

The underlying I / O element carrier (preferably software) 5 is capable of transferring any physical reading to any input / output element via the bus, and any physical output control can be controlled by any of the input / output elements 35-38. is well handled in a different input / output element as compared to the system of Figure 10 2, e.g. It can be said that the main control can be made independent of the location of the execution in the sense that it can be performed on any input / output element 35, 36 ... 38 + n, where 15 is a control module. The same applies to the security control module 310, which is located in the I / O module 38 in the embodiment of Figure 3.

Figure 4 shows a system 40 including I / O elements 45, 46, 47, 48 ... n, where n is a positive integer. The system 40 further comprises buses 43 and 44. Here, the I / O elements 45 and 47 comprise control modules such that the main system control is divided into three control modules 49, 410, 411. Unit 45 includes control module 49 and unit 47 comprises control modules 410 and 411. The I / O elements 45, 46 ... 25 48 have means for implementing physical output signals based on the control signals of the control modules. They also have means for receiving control signals via the bus. The I / O elements 45, 46, 47, 48 also have means for converting the physical inputs to a form understood by the control modules and means for transmitting them through the bus.

According to the system of Fig. 4, the implementation of the master control is not implemented solely in one control module, but is divided into different I / O elements 45, 47 comprising 35 control modules to optimize system performance.

7

Thus, some of the main control is implemented by the I / O element 45 control module 49 and the other two parts are implemented by the I / O element 47 control modules 410, 411. The I / O element 46 includes security control modules 412, 413, 414.

The security control modules may also be located on a plurality of I / O elements, for example, module 414 may alternatively be located on the I / O element 48.

The number of control modules in Figure 4 may be less than or greater than three, but three is a suitable number for purposes of illustration. Also, the division of the control modules into I / O elements may be different from that shown herein.

In the system of Figure 4, each I / O element 45, 46, ..., 48 is aware of the state of all other I / O elements 45, 46, ..., 48 via bus communication. Each I / O element 45, 46, ..., 48 has a redundancy function which, based on the state of the other elements, is capable of deciding whether the control module is considered active or inactive.

In the event that the I / O element or control module fails, the inactive safety control module will be activated. Each I / O element is also able to detect activation of the security control module according to the decision.

25

The system of Figure 4, regardless of location, creates redundancy because it has the means to cause the I / O elements 45, 46, ..., 48 to detect the malfunction of any other I / O element 45, 46, ..., 48 and to activate an inactive security control module. 30 necessary control. For example, in the event of an I / O element 47 hardware or program malfunctioning, the system is able to activate the I / O element 46 security control module, thereby being able to maintain substantially uninterrupted operation up to I / O element 47 until complete failure.

8

In embodiments of the invention, the structure of the control logic module is such that all necessary state information is transmitted along the communication bus to the security control module.

5 The internal spaces of the control modules shall remain the same as those of the safety control modules.

The inventive architecture allows the main control to be separated into separately implemented blocks, preferably 10 software modules. The underlying (software) platform is capable of transmitting any physical reading to any input / output element via the bus, and the control of any physical output can be controlled by any input / output element.

15

The malfunction of any I / O element causes the other elements to detect a malfunction and the redundancy function (automatically) activates the safety control to perform the necessary control.

20 The implementation of the master control does not need to be performed in one control module only, but can be separated into different control modules. The modular design can facilitate the design of the redundancy control because the structure remains the same whether it is a single control or a redundancy control.

Motor control can easily be dimensioned to meet the requirements of system control using distributed devices rather than a large centralized device.

Redundancy can be achieved by dividing the control modules so that in the event of a single I / O module malfunctioning, each control module included therein has a security module in another module. When the I / O element malfunctions, the system level 40 is also supported by the detection thereof and thus the system 40 activates a corresponding security control module 9 to perform the same control as the failed module.

The invention comprises the division of tasks of the CPU (ref. 11, 12 in Figure 1) 5 into I / O elements capable of independent operation. The I / O elements must be capable of driving the control modules. This is not possible with prior art I / O elements.

10 All I / O elements are controlled by the control logic module (s). At least one, preferably all, I / O elements includes a control module and at least one I / O element includes a safety control module. Their changes are controlled by the redundancy logic that is contained in each I / O element.

15

The system-level operation below monitors which I / O elements are active and which control modules are active and gives commands for inactive safety control modules to initiate control when the I / O element that executes the active control modules ceases to function or fails. The implementation does not necessarily have to be performed on just one I / O element, but can be separated on multiple elements.

An example of an embodiment of the I / O element 70 is shown in Figure 5. The I / O element 70 is arranged to transfer any physical reading to any I / O element, to control any physical output from any I / O element, and to follow states of other I / O elements.

30 Physical readings refer to signals from field devices through field device interface 76. Control of any physical output means control signals to field devices through the field device interface. At least one of the system I / O elements comprises at least one control module 74 for controlling the system and at least one of the I / O elements 10 comprises at least one security control module 75 for controlling a system in case of a control module malfunction.

The embodiment of Figure 5 includes at least one external interface 71. The I / O element is arranged to transfer information to and from other I / O element (s), the information including at least state changes in the I / O element (s) and the control signal (s). The monitoring module 72 is arranged to monitor the states of the other I / O elements, taking into account at least the state change information as input information. In this text, the internal state of the I / O element can be understood to include states of interface signals 76 of field devices.

The redundancy module 73 is arranged to detect if there is a fault and, in response to the fault detection, to transfer the functions of the control module 74 to the safety control module.

The control module 74 is arranged to process (change) information of the other I / O elements of the (bus) 20, to modify its internal state accordingly, and to provide the corresponding motor control command (s). The safety control module 75 is arranged to perform at least the same control tasks as the corresponding control module in response to the control module fault signal 25 from the redundancy module.

The I / O element of Figure 5 has interface / surfaces to the field devices 76, similar to prior art I / O elements.

30

The redundancy module 73 may optionally be provided to control partially or completely the functions of the control module in response to the overload of the control module.

35 11

Figure 5 illustrates one way of implementing the I / O element 70 of the invention. It may be advantageous for the modules described above to be passed by the transport platform 77 which handles the transfer tasks. The transfer tasks refer to transmitting and receiving communication via the off-line interface 71 and the field device interface 76. The platform 77 also handles communication between the modules. There are other ways to implement the invention, for example, the functions of the redundancy module 73 can be assigned to substrate 77. The combination of substrate and modules is easy to fabricate. Another solution may be to use only the modules without any platform. Implementing the invention through programs is not the only solution. Specific circuits, such as ASIC (Application Specific

Integrated Circuit) circuits.

15

The functions of the control modules and the safety control modules can be divided into essential and non-essential functions. The essential functions shall comprise at least the functions necessary for the continued operation of the engine. The redundancy module 73 is arranged to prioritize the essential functions when assigning the task (s) to the security module (s) with task signal (s).

It is preferable to implement the above modules with at least one programmable processor for each I / O element containing the control module, arranged to calculate the new internal state of the I / O element and the possible module output (s) in response to input from the bus and its current internal state.

30

It is preferred that the software platform be used to control the I / O elements. The platform can transfer any reading of field devices to any I / O element and control any output from any I / O element.

35 12

It is preferred that the system of the invention comprises computer readable equipment arranged to perform master control on a plurality of control modules disposed in more than one I / O element of the certified one. Some 5 ways to place control modules in more than one certified I / O element are shown in the examples in the figures. Any of the modules described above can be computer readable.

The system has some predetermined logic which 10 indicates which security control module (s) will be placed in which control element in case a particular control element or control module fails completely.

The same functionality could also be utilized, with some additional logic 15, to distribute the system load dynamically, since an overloaded control module could voluntarily request a second control element security control module to take over some of the tasks. Thus, the system load could be dynamically maintained at 20 acceptable levels.

Having described above certain embodiments of the invention, it will now be apparent to those skilled in the art that other embodiments containing the operating modes of the invention may be used. Thus, the invention should not be limited to certain embodiments, but should be limited to the scope of the following claims.

30 PATENT CLAIMS

A control system for controlling a piston engine, the system comprising I / O elements (25-28, 35-38, 45-48,70) and a communication bus (33, 35 34, 23, 24, 43, 44) connected to the I / O elements. ), characterized in that each I / O element

Claims (10)

Control system according to claim 1, characterized in that the security module (75) is arranged to perform the same control functions as the corresponding control module (74) in response to the control module error signal from the redundancy module (73). Control system according to claim 2, characterized in that the control module (s) (74) is arranged to receive status information of other I / O elements, to modify its internal state accordingly and to transmit corresponding motor control command (s). Control system 25 according to one of claims 1 to 3, characterized in that the I / O element (s) (25 - 28, 35 - 38, 45 - 48, 70) comprises / comprises a monitoring module (72) arranged to / states of other I / 0 element (s), taking into account at least state change information as its input data. 30 Control system according to one of claims 1 to 4, characterized in that the i / o element (s) comprises / comprises a redundancy module (73) arranged to monitor whether there is a fault and in response to the fault transfer the control module (s) functions to the security module (s). . Control system according to claim 5, characterized in that the redundancy module (73) is arranged to select the control module fault signal to the security module (75) in response to an overload of the control module (74). Control system 10 according to any one of claims 1 to 6, characterized in that it comprises the substrate means (77) on which the modules are located, which handles the inter-module data transmission and transmission functions for transmitting and receiving communication via bus and I / O element field device interface (76). . 15 Control system according to one of Claims 1 to 7, characterized in that the computer-readable equipment is arranged to perform main control in a plurality of control modules disposed in more than one I / O element (25-28,35-38,45-20,48,70). (74). A control system according to any one of claims 1 to 8, characterized in that the bus interface (71) of each I / O element (70) is arranged to transfer information to and from the other I / O element (s). element (s), the information including at least the state changes of the I / O element (s) and the control signal (s). Control system 30 according to any one of claims 1 to 9, characterized in that at least one programmable processor for each I / O element (70) containing the control module (74) is arranged to calculate a new internal state of the I / O element (70) and / possible module output (s) in response to input from the bus and its current internal state.