JP2000250770A - Multiplexed instrumentation system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce the size of a multiplexed instrumentation system and to save power by setting only needed circuits on a control board in accordance with the normality/abnormality of A and B dual control systems. SOLUTION: This multiplexed instrumentation system (DO module 1) consists of a ROM-N which stores circuit data that decides the coincidence/ noncoincidence of both signals fetched by DO module controllers 2A and 2B and outputs a coincidence signal, a ROM-A and a ROM-B which store circuit data that respectively output signals from the controllers 2A and 2B, an FPGA 4 selectively sets the circuit data of one of the ROMs and a ROM controlling part 6 which recognizes which of the signals from A and B systems is normal/ abnormal, inputs circuit data to the FPGA from the ROM storing the circuit data of the normal system when noncoincidence is received from the FPGA to which the circuit data of the ROM-N are set and also inputs the circuit data of the ROM-N to the FPGA when the A and B systems are recovered to a normal state.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a multiplexing system in an electrical instrumentation system of an industrial plant.

[0002]

2. Description of the Related Art In an electrical instrumentation of a plant that requires reliability, a failure of one electronic component or a transmission system (a disconnection of a cable, a contact failure, etc.) causes a system down or even if it does not reach that level. In order to prevent the system from malfunctioning, the system is multiplexed with redundancy. As a multiplexing method, there is duplexing, triplicating, or the like. The triple system considers the result that two or more of the three processing results processed in parallel for one control object match as positive, and is applied to a system that requires extremely high reliability. Is done. The duplex system is roughly divided into a dual system and a standby system. In the dual system, the dual system performs the same processing in parallel and checks the processing results. If the two results match, the processing result is regarded as correct. The part where the failure has occurred is extracted, and the processing is continued by separating the failed part. The standby system is composed of an active system that performs online processing and a standby system that normally stands by. If the active system fails, the standby system is switched to the active system and processing is resumed.

Regardless of whether a triple system or a dual system (dual system, standby system) is used, after an abnormality has occurred, the abnormal system is temporarily cut off by separating the abnormal part. The dual system is operated as a single system. Then, after the recovery work, return to the original system.

[0004] Fig. 5 shows an example of a duplex system in a plant for electrical instrumentation (in this example, limited to DO (digital output)), and Fig. 6 shows a DO module in the system.
1 shows a block diagram of FIG. In this duplex system, as shown in FIG. 5, the control signals of the A system and the B system as the upper control devices 9 and the control signals of the respective systems are transmitted in parallel from the respective control devices via the respective communication systems. Multiple DO modules sent 1
And is composed of Here, the control device 9 and the DO module 1 are connected by a network, but may be controlled by a bus connection or directly by a hardware signal without using the network.

[0005] As shown in FIG.
DO which receives an operation command (= control signal) sent from the A system of the control device 9 and produces a digital output corresponding thereto
An operation command sent from the A system of the module controller 2 and the B system of the control device 9 is received, and the B of the DO module controller 2 that generates a digital output corresponding to the operation command is received.
And a determination unit 3 that determines whether the digital outputs of the DO module controllers 2 of both the A and B systems match each other. DO module 1
Produces 16 digital outputs (DO) in response to operation commands from the A and B systems. The DO module controller 2 performs operations independent of the A system and the B system, and the judging unit 3 judges the consistency of the control signals from both systems and reflects it on the final digital output. The DO module controller 2 is generally equipped with a CPU in order to provide a flexible (resistant to specification change) interface with a host device.

[0006] The determining unit 3 for determining the consistency of the outputs from the DO module controllers 2 of both systems is the most important part for producing the final output in the duplex system.
High reliability is required. The determination unit 3 that determines the consistency of the control signals from the multiplex system is often constructed by hardware. This is because a circuit configuration using pure hardware has higher reliability (lower failure rate) than a configuration incorporating a CPU including software.

FIG. 7 shows the configuration of the determination unit 3 in the DO module 1 of the conventional example. The judging unit 3 checks the consistency of the digital outputs (operation commands) of the DO module controllers 2 for both the A and B systems, and when the two operation commands match, outputs the operation command. , An A-system output control circuit 10 for directly outputting an operation command from the A-system DO module controller 2, a B-system output control circuit 10 for directly outputting an operation command from the B-system DO module controller 2, A selector control unit 12 for recognizing which A system or B system is abnormal when receiving a mismatch signal from the heavy system determination circuit 11 and selecting a normal system;
When the two systems match, the output of the double system determination circuit 11 is selected. When the two systems do not match, the output of the normal system selected by the selector control unit 12 is selected. And a selector 13 that outputs the data.

When an operation command from both the A and B systems is determined to be abnormal by the determination circuit, for example, when the DO control module of the B system is abnormal, the selector control unit 12 transmits the signal from the DO control module of the A system of the selector circuit. An operation command is selected, and the selector 13 is selected from the output control circuit 10A.
To the driver 8 that drives the relay via vice versa,
If there is an abnormality in the DO control module of A system,
The selector control unit 12 selects an operation command from the B-system DO control module of the selector circuit and sends it to the driver 8 that drives the relay from the output control circuit 10B via the selector 13.

FIG. 8 shows an example of the configuration of the double system determination circuit 11. FIG. 8 shows a portion that controls one bit (drives one relay). As the simplest consistency check, only two input signals are used. The double system determination circuit generally includes two AND gates that process two input signals A and B and that are connected in parallel to each other, and an inverter (NOT gate) that inverts one input signal with one AND gate. An inverter inverting the other input signal with the other AND gate, a NOR gate receiving the output signals of the two AND gates, and a latch circuit 7 using the output signal of the NOR gate as a gate (G) signal. I have.

[0010] A _- n is DO module controller 2A
B _- n is a signal for controlling the corresponding n-th bit relay contact from the system.
It is a signal for controlling the corresponding n-th bit relay contact from the B system. Here, the signal level “H” is a signal for turning the contact point “ON”, and the signal level “L” is a signal for turning the contact point “OFF”. It is sufficient that the control signal levels of both systems match. The operation of the circuit of FIG. 8 will be described. If the signal levels of the A system and the B system are the same (both 'H' and 'L'), the G (gate) input of the latch circuit 7 becomes the 'H' level, and the signal level from the A system (ie, the B system) Signal level from
Becomes the relay drive signal as it is. Table 1 shows the latch circuit truth values.

[0011]

[Table 1] Since the A and B circuits are operated by independent circuits, the signals from the two circuits do not always match at the change point of the signal level due to a difference in processing time. When the signal levels are different from each other, the G input of the latch circuit 7 is set to 'L' level,
Keep previous value. By adding the latch function, it is possible to ignore a mismatch between operation signals from both controllers when data changes. The occurrence of inconsistency is due to a difference in the processing time of the controllers of both systems, and occurs to a considerable extent. However, if a mismatch occurs in the control signals from both systems beyond the allowable time of the difference, it is regarded as abnormal.

[0012]

As described in the previous section,
A conventional redundant control system includes a circuit that transmits an output via a determination circuit when the system is normal and a normal system when an abnormality occurs in the system (until replacement of a faulty part of the abnormal system is completed). A circuit for transmitting a control signal (backup circuit) is provided in parallel, and there is a problem that the circuit becomes large-scale due to the provision of the circuit. A large-scale circuit leads to an increase in the size of a control board to be mounted, an increase in the size of a power supply due to an increase in current consumption, and an increase in the size of a housing, resulting in an increase in cost. The circuit becomes large because a circuit that does not need to function when the system is abnormal and functions only when the system is normal and another circuit that does not need to function when the system is normal and functions only when the system is abnormal are installed on the control board. Because it is.

It is an object of the present invention to reduce the size of a multiplexed instrumentation system by setting only necessary circuits on a control board according to a normal or abnormal state of two control systems.

[0014]

In order to achieve the above object, a multiplexed instrumentation system according to the present invention judges whether or not both control signals taken from two systems match or not, and outputs a matched control signal. First RO in which circuit data is stored
M and a second ROM storing circuit data for outputting a control signal of a receiving module connected to one of the two systems.
A third ROM storing circuit data for outputting a control signal of a receiving module connected to the other of the two systems;
There is a mismatch between a field programmable gate array (FPGA) in which circuit data stored in one of the first to third ROMs is selectively set and an FPGA in which circuit data of the first ROM is set. , When the signal of the two systems is recognized as normal or abnormal, the circuit data is input to the FPGA from the ROM storing the circuit data of the normal system, and the two systems are restored to normal. When this is recognized, the circuit data of the first ROM is stored in F
And a ROM control unit for inputting to the PGA. Then, in the multiplexed instrumentation system of the present invention, it is preferable to provide a latch circuit on the FPGA output side. In the multiplexed instrumentation system configured as described above, the ROM control unit extracts circuit data from one of the first to third ROMs each time the control signals of the two systems match or mismatch. , By setting it to a field programmable gate array (FPGA)
The required capacity of the PGA can be reduced, and power consumption can be reduced by operating only the minimum necessary circuits. Therefore, the overall multiplexed instrumentation system can be reduced in size and power consumption. In addition, when the latch circuit on the FPGA output side changes the circuit data set in the FPGA,
During the setting change period, the state of the output of the FPGA before the change is maintained to prevent the level change of the FPGA output.

[0015]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of a multiplexed instrumentation system according to the present invention will be described below. FIG. 1 is a diagram showing a configuration of a DO module (DO: digital output) as a multiplexed instrumentation system according to an embodiment of the present invention;
FIG. 5 shows an example of the above-described duplex system in electrical instrumentation of a plant.

The DO module 1 is, as shown in FIG.
When a single control object (not shown) is controlled by the control device 9 having a dual configuration of the A system and the B system, control signals output from the control devices of both systems are input, and the two signals match. The control signal is used as a control signal, and when the two signals do not match, a control device that operates normally is recognized, and a control signal is selected from the control device and transmitted.

As shown in FIG. 1, a DO module 1 as a multiplexed instrumentation system according to the present embodiment is a DO module as a receiving module for receiving a control signal of a control device of A system.
Module controller 2A and DO as another receiving module for taking in control signals of B-system control device
A module controller 2B, a determining unit 3 for verifying the consistency of the control signals received from the DO module controllers 2A and 2B and generating a control signal for driving a relay to be controlled, and a driver 8 for driving the relay
It consists of. Further, as will be described in detail later, the determination unit 3 includes a field programmable gate array (FPG).
A) It comprises four, a plurality of ROMs 5, and a ROM control unit 6. The DO module 1 roughly operates in a normal operation mode N when the control signals of both the A and B systems match and a single system operation mode when the control signals do not match (abnormal). The one-system operation mode includes a one-system operation mode A when the A system is normal and the B system is abnormal, and a one-system operation mode B when the B system is normal and the A system is abnormal. The configuration of the determination unit 3 will be described. FPG
A4 is a device for verifying the consistency of the match / mismatch of the control signals fetched from the DO module controllers 2A and 2B and for setting a circuit according to various operation modes each time. The ROM 5 has three types. First RO
ROM-N which is M is circuit data used in the normal operation mode N, that is, two DO module controllers 2
A and 2B store circuit data for judging the coincidence or non-coincidence of the two control signals taken and outputting the coincident control signals. ROM-A, which is the second ROM, has a single-system operation mode A.
, That is, circuit data for outputting a control signal of the module controller 2A. Third
ROM-B stores circuit data used in the single-system operation mode B, that is, circuit data for outputting a control signal of the module controller 2B. Note that R
The circuit data stored in the OM-N, ROM-A, and ROM-B are the same as those of the conventional DO module 1 shown in FIG.
This corresponds to the output control circuit B system.

The ROM controller 6 sends A, B from the FPGA 4
The consistency of the control signals of both systems is transmitted, and when they match, RO
M-N is selected, which system is abnormal in the case of a mismatch, ROM-A or ROM-B corresponding to the normal system is selected, and the circuit data of the selected ROM is read. Set to FPGA4. The operation of the determination unit 3 will be described. Normal operation mode N after power-on of both A and B systems
Control data stored in ROM-N as FPGA
Set to 4 (configuration). FPGA4
Keeps this state during normal operation, and transmits an abnormality to the ROM control unit 6 when an abnormality occurs in one system.
The ROM control unit 6 recognizes which system has an abnormality and switches to a circuit that processes only the normal system. As a procedure, a configuration command is issued to the FPGA 4 and the corresponding ROM 5 (ROM-B, if the system A is abnormal, ROM-B,
If the B system is abnormal, the circuit configuration inside the FPGA 4 is changed by configuring the circuit data from the ROM-A). This state is maintained in the one-side operation mode A or B. When the two systems return to the normal state after replacing the abnormal part, a configuration command is issued to the FPGA 4 again, and the circuit data in the ROM-N is configured in the FPGA 4. In this way, by resetting (configuring) the circuits in the respective operation modes to the FPGA 4 as necessary, only the minimum necessary circuits operate, and the size and power consumption can be reduced.

Here, the FPGA will be described. F
The PGA device has an architecture similar to a gate array, and has a matrix configuration of logic cells surrounded by input / output pins. The internal connection can be arbitrarily connected by a programmable switch, and an arbitrary circuit can be formed by connecting a desired signal net between logic cells. Internal connection information (ie, circuit diagram) is FPGA4
Supplied from outside. As shown in FIG. 2, a ROM 5 storing the internal connection information is prepared outside the FPGA 4, and when the power is turned on, after a configuration start command is given to the ROM 5 and the FPGA 4, the data in the ROM 5 is stored in the F5.
Send to PGA4 (configuration operation). After the completion of the configuration, the FPGA 4 becomes a circuit for executing a desired operation.

As described above, the circuit of the determination unit 3 is constituted by a field programmable gate array (FPGA), and the circuit corresponding to the operation mode is set (configured) again in the FPGA 4, thereby minimizing the necessary number. The circuit operates, so that a small size and low power consumption can be achieved.

By using a serial bit transfer ROM 5 (8-pin type IC) as the ROM 5 for storing each circuit data of the FPGA 4, the mounting space per ROM can be reduced. Also, since only necessary circuits need to be configured according to the operation mode, there is an advantage that an FPGA 4 (low cost) having a small number of mounted gates can be selected.

Next, a DO module 1 will be described as a multiplexed instrumentation system according to another embodiment of the present invention with reference to FIG. This DO module 1 is obtained by adding a latch circuit 7 to the output side of the FPGA 4 in the DO module 1 of the first embodiment shown in FIG. The configuration and operation of the DO module 1 of the other embodiment are the same as those of the DO module 1 shown in FIG. Here, only the latch circuit 7 will be described. When the control data set in the FPGA 4 is changed, the latch circuit 7 holds the state of the control signal output from the FPGA 4 before the change, so that the DO module 1
This is to prevent malfunctions.

FIG. 4 shows the connection between the FPGA 4 and the latch circuit 7 and the timing at which the mode is switched. The timing indicates the timing when the mode is switched from the dual mode to the single mode in a state where the relay control signal is “L” (relay contact is OFF). Mode switching period (FPGA
The operation of the FPGA 4 is stopped (configuration period for reconfiguring the internal circuits of the FPGA 4) (although it depends on the scale of the number of FPGA 4 gates, but on the order of several hundred msec). FP
Since the input / output pins of the GA 4 are in a high impedance state (signal level is undefined), they are pulled up via a resistor (connect the pins to the power supply Vcc) to determine the signal level.
Alternatively, a pull-down (pin is connected to ground) pin processing is performed. FIG. 4 shows an example of pull-up. Because it becomes high impedance during the configuration period,
The relay is pulled up to a high level and malfunctions (the relay contact is turned on) (note the relay control signal A). On the contrary, when the pull-down is performed, the relay contact is turned off during the configuration period. To prevent such a malfunction, a latch circuit 7 is provided outside the FPGA 4. By maintaining the previous state during the configuration period, malfunction during configuration can be prevented.

[0024]

According to the present invention, the multiplexed instrumentation system is provided with a ROM corresponding to the coincidence / mismatch of the control signals of the two systems and a ROM corresponding to which system is abnormal.
, The circuit data is set in the field programmable gate array, so that only the minimum necessary circuits operate, and the size and power consumption can be reduced.

Further, by connecting a latch circuit to the FPGA output side, when changing the setting of the circuit data, it is possible to prevent a malfunction during the setting change by maintaining the state before the change.

[Brief description of the drawings]

FIG. 1 is a configuration diagram of a multiplexed instrumentation system according to an embodiment of the present invention.

FIG. 2 is a diagram showing a field programmable gate array (FPGA) and a ROM for storing circuit data set in the FPGA.

FIG. 3 is a configuration diagram of a multiplexed instrumentation system according to an embodiment of the present invention.

FIG. 4 is a diagram showing timing for converting circuit data of a field programmable gate array (FPGA).

FIG. 5 is a diagram illustrating a configuration example of a duplex system for redundancy control.

FIG. 6 is a block diagram of a digital output (DO) module of the duplex system shown in FIG. 5;

FIG. 7 is a diagram illustrating an example of a determination circuit in a conventional multiplexed instrumentation system.

FIG. 8 is a diagram illustrating a logical configuration of a determination circuit in the multiplexed instrumentation system.

[Explanation of symbols]

1 Digital output (DO) module 2A, 2B DO module controller 3 Judgment unit 4 Field programmable gate array (
FPGA) 5 ROM 6 ROM control unit 7 Latch circuit 8 Driver

Claims (2)

[Claims] 1. A first ROM in which circuit data for judging the coincidence or non-coincidence of both control signals taken from two systems and outputting a matched control signal is stored, and a receiving module for receiving from one of the two systems. A second ROM storing circuit data for outputting a control signal of the second module, a third ROM storing circuit data for outputting a control signal of a receiving module for receiving from the other of the two systems, A mismatch is received from a field programmable gate array (referred to as an FPGA) in which circuit data stored in one of the third ROMs is selectively set and an FPGA in which circuit data of the first ROM is set. Sometimes, it is recognized which signal of the two systems is normal or abnormal, and the circuit data is input to the FPGA from the ROM storing the circuit data of the normal system, Multiplexing instrumentation systems two systems is characterized in that it is composed of a ROM controller for inputting circuit data to the FPGA of the first ROM to recognize it when it successfully recovered was. 2. The multiplexed instrumentation system according to claim 1, wherein a latch circuit is provided on the FPGA output side.