JP2004341645A - Automatic-recovery distributed control system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To increase the reliability of a control system whose overall function is realized by a combination of a plurality of control systems. <P>SOLUTION: In an engineering system networking the control systems 111 to 114, remote I/Os 121 to 124 and controlled objects 131 to 134, electric circuit boards with stem cell properties (stem cell components 141 and 142) are connected in advance to the network. Information about each control system is given to the other control systems. If any control system fails, the associated remote I/O or the other control systems detect the failure. Either stem cell component, given the information about the failed control system, automatically changes (regenerates) into the control system. The overall system can be thus automatically recovered. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to improving the reliability of a distributed control system in which the entire function is realized by a combination of a plurality of control systems.
[0002]
[Technical background]
In a system in which the entire function is realized by a combination of a large number of control systems (for example, a sequence control system, etc.), conventionally, when measures are taken by multiplexing the system in order to improve the reliability of the system (for example, water supply and Public facilities plant). However, in a general manufacturing system or the like, it is rare that all control systems are multiplexed due to a cost problem or the like. Therefore, when a failure occurs in each control system, it is necessary to individually deal with the restoration of each control system.
Further, a system has been developed which automatically detects which control system has an abnormality and automatically repairs the system. For example, Patent Document 1 proposes the following technology in order to improve the reliability of a functional device (control system) using an FPGA (Field Programmable Gate Array). Here, the FPGA is an electronic circuit such as a programmable LSI or the like, and is a conventional technique used in, for example, Patent Document 2.
The functional device according to the invention of Patent Document 1 includes a functional circuit unit, a failure detection unit, a definition processing unit, and an internal memory, and stores layout pattern definition information for realizing the function of the functional circuit unit in the internal memory (and the external memory). Backup). The failure detection unit detects a failure and determines a failure area. In accordance with the information, the definition processing unit reads out layout pattern definition information that can avoid the failure area from the memory, and redefines the functional circuit unit according to the layout pattern definition information. Thus, even when the functional device is in service or in operation, the function of the device can be self-repaired.
[0003]
[Patent Document 1]
JP-A-9-62528
[Patent Document 2]
JP-A-10-92943
[0004]
[Problems to be solved by the invention]
However, even if the conventional technique of Patent Document 1 is used, the following problem remains. First, repair may not be possible depending on the location of the failure. For example, there is a case where the internal memory and the external memory storing the layout pattern definition information cannot be accessed. Further, since the external memory is dedicated to the purpose of backing up the layout pattern definition information, if a failure occurs in the external memory, the external memory may not be able to be repaired or the entire system may malfunction. .
[0005]
[Means for Solving the Problems]
In order to solve the above-mentioned problems, the present invention provides a plurality of control systems including at least one stem cell operating as a backup control system, which are connected to each other via a network, and a control system controlled by each of the control systems. An automatic restoration distributed control system comprising a remote I / O for connecting a target and a control system, wherein the remote I / O can be connected to any of the control systems, and , An input / output means for transmitting a control signal from the control system and a feedback from the control object, and an abnormality detection means for detecting an abnormality of the control system controlling the control object via at least the remote I / O The control system controls the control target via the remote I / O; an abnormality detection unit that detects abnormality of at least one of the control systems; A reproducing means for causing the control system to detect an abnormality in the control system as a whole, either in the remote I / O or the control system, and when the remote I / O or the control system detects an abnormality in the control system. The detected remote I / O or the control system notifies the stem cell and the remote I / O connected to the control system in which the abnormality has been detected, and the control means of the notified stem cell uses a reproducing means. It is the same as the control means of the abnormal control system, wherein the input / output means of the remote I / O which has received the notification stops the connection with the abnormal control system and connects with the notified stem cell. It is an automatic restoration distributed control system.
Further, the remote I / O and the control system have a memory storing a signal pattern from the control system, and the abnormality detection means of the control system and the remote I / O transmits the control signal to the controller. An abnormality of the control system may be detected by comparing the signal pattern with a signal pattern stored in the memory.
The stem cell further has a memory storing information of all control systems, and the reproducing means of the stem cells obtains, from the memory, information of the control system in which an abnormality is detected by the abnormality detecting means. However, the control means may have the same function as the control means of the abnormality control system.
The control system further includes a memory storing information of at least one control system other than the self, and the memory of the control system stores information of all control systems as a whole, Wherein the reproducing means obtains, from the memory of the control system, information of the control system in which the abnormality is detected by the abnormality detecting means, and has its own control means having the same function as the control means of the abnormality control system. May be characterized. At this time, the reproducing means of the control system further transmits, to at least one control system other than its own, information to be used as its own control means to another control system, and receives the information of the received control system. The reproducing means may store the information in a memory storing information of the control system. Further, the reproduction means of the control system may periodically transmit information to be used as its own control means to another control system.
[0006]
BEST MODE FOR CARRYING OUT THE INVENTION
The present invention has the following features in order to solve the above-described problems of the related art. First, in an engineering system in which the whole function is realized by a combination of multiple control systems, when a certain control system fails, it is seen in the process of regenerating organisms to reproduce the function of the failed control system. What is equivalent to "stem cells" is introduced as a reserve for the control system. In other words, one or more “electrical circuit boards (boards) having stem cell properties” (hereinafter referred to as “stem cell components”), which usually do not have any specific characteristics (functions), are added to the system in advance through a network. If the respective control systems fail, a mechanism for automatically changing the stem cell component to the failed control system (hereinafter referred to as “regeneration”) is constructed. Thereby, the function of the whole system can be maintained.
Hereinafter, an embodiment of the automatic restoration distributed control system of the present invention will be described in detail with reference to the drawings.
[0007]
<System configuration>
First, the system configuration of the present embodiment will be described. In the system of this embodiment, all control targets are controlled by each control system via a network and a remote I / O (hereinafter, also simply referred to as “I / O”). The control systems (including the stem cell component) are also connected to each other via a network such as Ethernet (registered trademark).
FIG. 1 shows an example of a network connection mode. FIG. 1 shows an example of the connection mode, and other various cases are conceivable. Other examples will be described later.
[0008]
In FIG. 1, a control target 1 131 to a control target 4 134 respectively include a control system 1 111 to a control system 4 via an I / O (remote I / O) 1 121 to an I / O (remote I / O) 4 124. 114 is connected. Thereby, each control target can be controlled from each control system.
Here, the connection between each I / O and each control system is shown as a connection between the black circle 150 on the I / O side and the black circle 150 on the control system side. A black circle 150 on the I / O side is a “control unit for exchanging signals between a control system and a control target” which is one of components in the I / O (shown by an input / output control unit 310 in FIG. 3). ) Means connection. Further, a black circle 150 on the control system side is from a “circuit unit for exchanging signals with the target I / O” (shown by an input / output circuit unit 260 in FIG. 2) which is one of the components in the control system. Means connection.
Similarly to the control system, the black circle 150 shown in each stem cell component is one of the components in the stem cell component, “a circuit section that exchanges signals with the target I / O” (shown by 260 in FIG. 2). Connection. As shown in FIG. 1, the black circle 150 on the stem cell component side and each control system are connected via a network. Thereby, for example, when the control system fails and the stem cell component functions as a substitute for the control system, signals can be exchanged with the target I / O.
[0009]
On the other hand, in FIG. 1, the control system 1 111 to the control system 4 114 and the stem cell component 1 141 to the stem cell component 2 142 are network-connected to each other between the white circles 160. The open circle 160 indicates a connection from a “control unit for realizing reproduction” (indicated by a reproduction control unit 240 in FIG. 2), which is one of components in the control system and the stem cell component. . Thus, for example, when the stem cell component functions as a substitute for the failed control system, signals can be exchanged with the target I / O. In FIG. 1, the control system 1 111 to the control system 4 114, the stem cell 1 141, and the stem cell 2 142 are shown by a double network connection. However, in this embodiment, the network connection may be a single or more network connection. As the number of network connections increases, the system can be more resistant to failure such as disconnection of the network.
[0010]
As described above, the internal components of the control system, stem cell components, and remote I / O are shown in FIGS. Next, each internal component will be described with reference to these drawings.
[0011]
<Internal configuration of control system, stem cell component and remote I / O>
The control system and stem cell components consist of internal components as shown in FIG. Note that the components shown in FIG. 2 are merely examples, and other variations are also possible.
Inside each control system (including the stem cell component) 200, the functional circuit unit 210 is configured by an FPGA and is a circuit for controlling a control target. The circuit definition memory unit 220 stores information for defining the FPGA circuit of the function circuit unit 210. In the present embodiment, it is outside the functional circuit unit 210, but may be inside the functional circuit unit 210. The circuit control unit 230 is a control unit for selecting a definition circuit from the circuit definition memory unit 220 and rewriting the FPGA circuit of the function circuit unit 210.
The reproduction control section 240 includes an abnormal signal detection section. The abnormal signal detection unit detects an abnormality of at least one control system by comparing the abnormality with an abnormal signal pattern stored in the abnormal signal pattern detection memory unit 270. Then, when the remote I / O unit or the like detects an abnormality, “reproduction” is realized.
The reproduction control unit 240 exchanges signals with other control systems, stem cell components, and remote I / O, as described above with reference to FIG.
Further, as described later, each control system (including the stem cell component) transmits circuit definition information and data of a control system other than itself to the circuit definition memory unit 220 and the data storage memory unit 250 in order to realize “reproduction”. Holding. The reproduction control unit 240 has information indicating which control system holds its circuit definition information and data.
The reproduction control unit 240 can be configured using an FPGA, a microprocessor, or the like, like the functional circuit unit 210. If the abnormality signal detector detects an abnormality in a plurality of control systems, the probability of detecting an abnormality increases even if any one of the control systems fails.
[0012]
The data storage memory unit 250 stores data necessary for realizing the functions of the FPGA of the functional circuit unit 210.
The input / output circuit unit 260 exchanges input / output signals with the target remote I / O based on the result of the target control executed by the FPGA of the functional circuit unit 210.
The abnormal signal pattern detection memory unit 270 stores a detection pattern for detecting an abnormal signal.
In the present embodiment, “abnormality of the control system” includes all cases where any one of these functions in the control system becomes abnormal. In other words, if there is any abnormality in any part of the control circuit board, which is a functional unit, the abnormality is detected and processed as a control function abnormality.
Note that a large-capacity storage medium such as a hard disk may be used for the circuit definition memory unit 220, the data storage memory unit 250, and the abnormal signal pattern detection memory unit 270.
[0013]
On the other hand, the remote I / O includes internal components as shown in FIG.
Inside the remote I / O 300, the input / output control unit 310 exchanges signals between the control system and the control target. The input / output control unit 310 communicates with each control system and control target. The abnormality detection unit 320 detects an abnormality signal from at least a control system that controls a control target via the remote I / O. Of course, an abnormal signal of another control system may be detected. The abnormal signal pattern detection memory unit 330 stores an abnormal signal pattern, and the abnormal detection unit 320 detects an abnormality of a signal from the control system using the stored abnormal signal pattern.
The specific role of these components in the system of the present embodiment will be described later in detail.
[0014]
In the system of the present embodiment, each control system, stem cell component, and remote I / O always transmit packets to each other using the above-described network. As a result, it is possible to constantly monitor each other's state.
This constant monitor is configured so that any one (including a plurality) of other control systems, stem cell components, and remote I / Os can detect an abnormality of a certain control system. Further, an abnormality of an output signal for controlling each control system by each control system can be detected even when there is no output. That is, even if any of the functions performed by each control system becomes abnormal, the abnormality is detected.
[0015]
The stem cell component obtains information on the abnormality detected in this manner, gives the information to the remote I / O corresponding to the control system in which the abnormality is detected, and sends the information to the remote I / O from the abnormality control system. Of the control system to realize the same control function as that of the failure control system by using the FPGA as described later. Perform "reproduction" to control.
The following (method 1) to (method 4) show a method of constructing a control circuit for performing "regeneration" by the stem cell component.
[0016]
<How to build a control circuit>
(Method 1)
As the simplest method, the circuit definition memory unit 220 of the stem cell component holds circuit definition information for constructing all the control circuits of each control system, and information on which control system is abnormal is obtained. Thereafter, a method of constructing a necessary control circuit based on the circuit definition information is described.
However, depending on the type of the function of the control system, it may be necessary to store changing data in the data storage memory unit 250 for a short period or a long period in order to realize the function. In some cases, it is necessary to change the circuit pattern of the FPGA depending on the input data. In such a case, each control system holds data required by the control system in the data storage memory unit 250 or the circuit definition memory unit 220. The simplest method for enabling the stem cell component to be changed to any control system is to hold all of the data of each control system in the data storage memory unit 250 and the circuit definition memory unit 220 of the stem cell component. That is.
However, for example, when the circuit definition memory unit 220 of the stem cell component is a large-capacity storage medium such as a hard disk, it is possible to hold all data in the stem cell component. In some cases, memory is required, which is difficult in practice.
Assuming such a case, the following methods (method 2) to (method 4) can be employed.
[0017]
(Method 2)
The control system n always transfers the contents of the data storage memory unit 250 of the control system (control system n) of the number n to the control system n + 1, and also stores the contents in the data storage memory unit 250 of the control system n + 1. At the same time, the contents of the data storage memory unit 250 of all control systems as a whole system are stored in any control system other than the self. In the control system n, if the circuit pattern of the FPGA is rewritten, the circuit pattern information is always transferred to the control system n + 1, and the circuit pattern definition information is transferred to the circuit definition memory unit 220 of the control system n + 1. (Or data storage memory unit 250). This transfer is realized by the reproduction control unit 240 of each control system.
As a result, unless the control system n and the control system n + 1 fail simultaneously at the same time, if the control system n becomes abnormal, the stem cell component refers to the memory of the control system n + 1 to have the function of the control system n. And the function can be restored.
Of course, in order to realize this, roughly speaking, each control system requires twice the amount of memory (M) of the control system that requires the maximum amount of memory, which is necessary for the entire system. The maximum memory capacity is 2M × N (N is the number of control systems). However, as in the above (method 1), an M × N memory is temporarily mounted on the stem cell component, and the amount of memory can be reduced compared to preparing a plurality of stem cell components in advance.
[0018]
(Method 3)
In the above (method 2), the reproduction control unit 240 always transfers the memory content of the control system n to the control system n + 1 and the control system n-1, and the data storage memory unit 250 of all the control systems as a whole system. If any two control systems other than the self control system have the same contents at the same time, even if two adjacent control systems fail, recovery is possible, and the reliability of the entire system is improved. Further increase. However, the memory required for the control system requires a maximum of 3M × N for the entire system. In addition, by further increasing the number of control systems at all times, the reliability of the entire system can be further increased. Here, rules such as the number of control systems at the transfer destination and the control system to which the system is to be transferred may be determined according to the system.
[0019]
(Method 4)
In order to save the memory of the entire system, the reproduction control unit 240 of each control system has a function of monitoring the amount of the vacant data storage memory unit 250 of the other control system. As a result, a control system that needs to transfer a large amount of data can select a control system with a sufficient memory to transfer the contents of the memory. If necessary, the transfer destination is dynamically determined according to the available memory space of each transfer destination control system, such as dividing the data and transferring it to the memories of multiple control systems. Is also possible. Also in this method, similarly to the above (method 1) to (method 3), the contents of the data storage memory unit 250 of all the control systems as a whole system are assigned to any control system other than the self.
In this method, each control system is not restricted by the rule of number as described in n above, and each control system has a data for reconstructing a self-control system with respect to another (single or plural) control systems. To transfer. In addition, each control system and stem cell component uses the reproduction control unit 240 to know which control system has data of which other control system.
By utilizing such dynamic memory allocation, for example, when only two specific control systems require a large amount of memory (M) and other control systems do not require much memory, for example, In (method 1), the stem cell component and any two other control systems (including other stem cell components among a plurality) may have M amount of memory (or if the above data division is performed, Any other two control systems forming the group for transferring the divided data need only have a total memory amount of M in each group.) It is possible to further reduce.
[0020]
In this way, each control system transfers information for forming its own control system to another (single or plural) control system and holds it. At this time, as described above, information (single or plural) of all the control systems in the entire system is held in any control system other than the own. In the above-mentioned (method 2) to (method 4), it is necessary for each control system to know which control system the self holds, and as described above, the reproduction of each control system is performed. The control unit 240 knows this.
When a certain control system malfunctions or is destroyed, the stem cell component refers to the stored information and changes (regenerates) to a component having the function of the control system. To recover.
[0021]
Hereinafter, a method in which the control system controls the control target, a method of detecting an abnormality in the control system, and a flow of system recovery when an abnormality occurs in the system of the present embodiment will be specifically described using the system configuration shown in FIG. 1 as an example.
[0022]
<Specific example of control method>
First, a specific example of a control method will be described with reference to FIG. 1 as an example of a process in which the control system 2 112 controls the control target 2 132 through the I / O 2 122.
In the present embodiment, it is assumed that data (signal) is exchanged by packets using, for example, a technique using Fast Ethernet and UDP / IP. The technology using the Fast Ethernet and the UDP / IP is a conventional technology. For example, Yasutaka Fujimoto and Takashi Sekiguchi "Fault-tolerant control by distributed programmable controllers" (Proceedings of the 2001 IEEJ Electronics, Information and Systems Conference) It is shown in I).
(1) The input / output circuit unit 260 of the control system 2 112 broadcasts all destinations (the reproduction control unit 240 and the input / output circuit unit 260 of each control system including stem cells, and the input / output control unit of each remote I / O). 310), and sends the packet via the network.
(2) The I / O 2 122 selects only the packet of the control system 2 112 as the transmission source, and passes the data to the control target 2 132. At this time, the abnormality detection unit 320 of the I / O2 122 detects an abnormality as to whether the data (signal) from the control system 2 112 is within the allowable range of the signal pattern. If an abnormality is detected, the I / O2 122 broadcasts all the destinations (the reproduction control unit 240 and the input / output circuit unit 260 of each control system including the stem cells, and the input / output control unit of each remote I / O). The packet is sent to 310), and abnormal information of the control system 2112 is transmitted.
[0023]
(3) The control target 2 132 returns information (signal) for feedback to the I / O 2 122 as necessary. Here, regarding the operation of the I / O2 122, the following two cases (a) and (b) are considered.
(A) The I / O2 122 sends a signal from the control target 2 132 as a packet to the input / output circuit 260 of the control system 2 112.
(B) The I / O2 122 broadcasts all the destinations (the reproduction control unit 240 and the input / output circuit unit 260 of each control system and the input / output control unit 310 of each remote I / O) to the control target 2 The signal from 132 is sent in a packet. The input / output circuit unit 260 of the control system 2 112 selects a packet whose transmission source is I / O2 122.
Note that by executing the above (b), it is possible to recognize the abnormality of the I / O2 122 and the control target 2 132 from a unit other than the control system 2112. Is better. Therefore, which of (a) and (b) should be adopted may be determined by the system.
(4) The signal passed to the input / output circuit unit 260 of the control system 2 112 is processed by the functional circuit unit 210 of the control system 2 112.
(5) The signal processed by the functional circuit unit 210 of the control system 2 112 is passed to the input / output circuit unit 260 of the control system 2 112.
[0024]
By repeating the above (1) to (5), the control system 2 112 exchanges data with the control target 2 132 by packet through the I / O 2 122, and controls the control target 2 132.
In addition, the functional circuit unit 210 of the control system 2 112 receives various kinds of input information (for example, time control, manual control, and other control signals from other control objects as necessary) in addition to the feedback signal from the I / O 2 122 described above. Information, etc.), and passes a signal to the input / output circuit 260 of the control system 2112.
In addition, when there is no problem in the execution operation of the control system, the functions of the input / output circuit unit 260 and the reproduction control unit 240 of each control system (including the stem cell component) can be provided in one component.
[0025]
<Specific example of abnormality detection method>
In the present embodiment, in addition to the above-described abnormality detection by the remote I / O, the following abnormality detection method is employed.
[0026]
(1) In the case of a system in which all control systems are constantly operating
In this case, as described above, the input / output circuit unit 260 of each control system broadcasts all destinations (the reproduction control unit 240 and the input / output circuit unit 260 of each control system and stem cell component, and the remote I / O of each remote I / O). The packet is sent to the input / output control unit 310), whereby the reproduction control unit 240 of each control system also recognizes the source and the signal content of the signal from other than the control target. The reproduction control unit 240 of each control system recognizes an abnormality of the signal (a signal is interrupted or an abnormality is found in a signal pattern) with respect to a signal from all control systems or a signal from one or more specific control systems. ) Is provided.
Note that an abnormal signal pattern detection memory unit 270 is provided to identify an abnormal signal pattern. The abnormal signal pattern detecting memory unit 270 is an abnormal signal pattern detecting memory (memory for determining what kind of signal pattern is regarded as abnormal) corresponding to each control system. At this time, an abnormality of each control system is detected by any of the other control system (single or plural) and the stem cell component (single or plural). Further, if necessary, the detection can be performed by remote I / O (single or plural) other than the remote I / O connected to the control target controlled by each control system described above. Thus, it is possible to detect an abnormality in each control system other than the control system.
[0027]
In this way, at least one or more of the above-described control systems, stem cell components, or remote I / Os other than the control system detect an abnormality in each control system as a whole system. How many of them can detect an abnormality in each control system can be determined for each control system or system. The larger the number, the more resistant the system to failure.
The abnormal signal pattern detection memory unit 270 can be replaced with the circuit definition memory unit 220 and the data storage memory unit 250.
[0028]
(2) For a system that does not require constant operation of all control systems
In this case, even if the control signal from each control system is not generated for a long time, it may not be abnormal. In such a system, the reproduction control unit 240 of each control system broadcasts all destinations (the reproduction control unit 240 and the input / output circuit unit 260 of each control system and stem cell component, and the input / output of each remote I / O). A signal for confirming normal operation is transmitted to the control unit 310) at regular time intervals. This packet includes only a signal for causing another control system to recognize that the control system can function normally, and does not have information for actual control. The time interval depends on the control target required by the system, the control operation time, and the like, and is set by the system on a case-by-case basis.
As in the case of (1) above, the reproduction control unit 240 of each control system supplies the signal abnormality from the signal from all the control systems or a signal from a specific (single or plural) control system. An abnormal signal detecting unit for recognizing that the signal pattern is interrupted or that the signal pattern is abnormal) is provided. The abnormal signal pattern detecting memory unit 270 is also the same as the above (1).
[0029]
Note that there are the following two methods (a) and (b) for transmitting a packet signal indicating that the control system can function normally. These methods are also set on a case-by-case basis by the system.
(A) A method of indicating that the function of the reproduction control unit 240 is normal by simply sending a signal packet periodically by the reproduction control unit 240
(B) The reproduction control unit 240 periodically gives a test signal to the functional circuit unit 210, performs an execution operation test of the functional circuit unit 210 of the control system, and confirms that the functional circuit unit 210 is normal. To send a normal signal packet after confirming
[0030]
<Specific example of system recovery flow when a failure occurs>
Next, a specific flow up to system recovery (regeneration) when an abnormality or failure occurs in a certain control system in the system will be described. Here, a case where the control system 2 112 fails in FIG. 1 will be described as an example.
(1) When an abnormality occurs in the control system 2 112, the abnormality is detected by the above-described abnormality detection method by the I / O (remote I / O) 2 122 and one or more other control systems (stem cell components 1 and 2). ) Or, if necessary, by one or more remote I / Os other than the I / O 2122. This abnormality information is transmitted to the stem cell components 1 and 2 (or all control systems including them).
In the present embodiment, as described above, the abnormality of each control system is determined by determining whether each of the other control systems, one of the stem cell components (one or more), and one of the remote I / Os (one or more). Since the detection can be performed, the abnormality can be transmitted to the stem cell component even if an abnormality occurs in any control system. Further, even when the abnormality detection by the I / O2 122 fails, the I / O2 122 is controlled by the control system 2 based on such other control system and abnormality detection information by another I / O.
112 can be recognized.
[0031]
(2) Here, for example, a rule is given in advance that the address of the stem cell component participates in the “reproduction” in ascending order (lower values). In this case, the stem cell component 1 first participates in “regeneration” and changes to the control system 2112.
It should be noted that each stem cell component knows in advance which stem cell component has the lower address before participating in “reproduction” by transmitting and receiving packet signals between the reproduction control units 240 of the respective stem cell components.
(3) As described above, in the present embodiment, the circuit definition information and data of the control system 2112 may be held by the stem cell component 1 in some cases, but (b) other (single or plural) ) May be stored in the memory of the control system.
In the case of (a) above, when the stem cell component 1 holds the circuit definition information and data of the control system 2112 in the circuit definition memory unit 220 and the data storage memory unit 250, the reproduction control unit 240 Know that the information is held. Then, when an abnormality occurs in the control system 2112, the stem cell component 1 forms the functional circuit unit 210 by the circuit control unit 230 using the information.
[0032]
When the other (single or plural) control systems of (b) hold the circuit definition information and the data of the control system 2112, the reproduction control of each control system holding those information is performed. The unit 240 also has information indicating that “the circuit definition information or the data of the control system 2112 is held in the own circuit definition memory unit 220 or the data storage memory unit 250”. The memory for this purpose is provided independently by the reproduction control unit 240, but may be replaced by the circuit definition memory unit 220, the data storage memory unit 250, or the abnormal signal pattern detection memory unit 270.
Then, when an abnormality occurs in the control system 2 112, the reproduction control unit 240 of the stem cell component 1 accesses the reproduction control unit 240 of each control system, and the circuit definition information and data of the control system 2 112 are held. The reproduction control unit 240 of the stem cell component 1 knows which control system has the circuit definition information and data of the control system 2112 in advance, as described later. ), Refer to the circuit definition memory unit 220 and the data storage memory unit 250 of those control systems through the reproduction control unit 240 of the corresponding other control system, and (or read the circuit definition memory unit 220 and data of the stem cell component 1). The contents are copied in advance to the storage memory unit 250 and then used by the circuit control unit 230. Carried out of the formation.
[0033]
In order to realize the above-mentioned “reproduction”, the reproduction control unit 240 of each stem cell component and each control system reads “which circuit definition information or control definition of any control system in its own circuit definition memory unit 220 or data storage memory unit 250. Is data information held? " Regarding “which control system has circuit definition information or information on data”, the reproduction control unit 240 of each stem cell component and each control system determines all of the other stem cell components (or each control system, including that). The packet may be transmitted to the reproduction control unit 240 periodically or whenever there is a change in which control system has the circuit definition information or the information on the data.
Accordingly, all the reproduction control units 240 of the respective stem cell components (or the respective control systems, including the respective control systems) always determine in advance from which stem cell component or the control system the information necessary for reproducing the respective control systems should be read. It becomes possible to grasp.
[0034]
(4) As described above, the functional circuit unit 210 similar to the control system 2 112 and the stem cell component 1 that has obtained the data are broadcast to all destinations (the reproduction control unit 240 and the input / output circuit unit 260 of each control system, and The packet is sent to the input / output control unit 310) of each remote I / O. As described above, this packet is used not only for giving a signal to the I / O2 122 but also for detecting an abnormal signal by another control system or the like.
[0035]
(5) On the other hand, after obtaining information that the control system 2 112 has become abnormal, the I / O 2 122 sends the address of the transmission source of the input signal to be handled from the original control system 2 112 to the stem cell component 1. And the destination for transmitting the signal from the control target 2 132 as a packet is changed to the input / output circuit 260 of the stem cell component 1 (see (3) (a) of the above <Specific Example of Control Method>). Method). Alternatively, a packet is sent to all destinations (the reproduction control unit 240 and the input / output circuit unit 260 of each control system, and the input / output control unit 310 of each remote I / O) (the above-described <specific example of control method>). (3) When the method of (b) is used).
(6) Also, after obtaining the information that the control system 2 112 has become abnormal, the stem cell component 1 determines the source address of the input signal packet to be handled by the input / output circuit unit 260 from the I / O2 122. Set things.
As described above (1) to (6), the system is regenerated by completely replacing the failed control system 2112 with the stem cell component 1.
[0036]
<Example of network connection style>
As described above, various forms of the network configuration of the system according to the present embodiment can be considered in addition to the configuration illustrated in FIG. Further, the numbers of control systems, stem cell components, remote I / Os, and the like are not limited to those in FIG.
Hereinafter, other examples of the network connection mode will be introduced with reference to FIGS. Note that the connection modes listed here are also examples, and other modes are also conceivable.
[0037]
4 to 6, as in FIG. 1, four control systems are connected to four control targets via remote I / O, and the number of stem cell components is two. However, the network configuration is strengthened as compared with FIG. 1, and the system can be restored (reproduced) even when there is a plurality of troubles or breaks in the network line itself. That is, it is possible to improve the reliability with respect to the failure of the network connection. For example, in the case of the network configuration shown in FIG. 4, the system can be restored even when the network between each control system and each control target is disconnected as compared with FIG.
FIG. 7 shows an example in which the network configuration is the same as that in FIG. 1, but the number of control systems and control objects constituting the network is different. In the network of FIG. 7, the number of control systems is five from control system 1 111 to control system 5 115. Further, the control system 4114 controls the controlled object 4a 134a via the I / O 4a 124a and the controlled object 4b 134b via the I / O 4b 124b. Thus, in the present embodiment, the number of control systems, remote I / Os, and control targets is not particularly limited. Also, the number of stem cell components is not limited, but the larger the number, the more robust the system can be against failure.
The actual network configuration to be adopted, or the number of control systems, stem cell components, remote I / Os, and the like can be determined for each individual system according to the purpose and necessity of the system, balance with cost, and the like.
In the above description, the case where an FPGA is used as the functional circuit unit of the control system has been described. However, the functional circuit unit may be configured by a processor and a program. In this case, a program is used as information constituting the functional circuit unit.
[0038]
【The invention's effect】
According to the present invention, in a system in which the entire function is realized by a combination of a large number of control systems, when each of the individual control systems fails or is destroyed, a system in which the failure control system automatically self-heals is provided. In addition to the whole. In particular, self-healing is enabled even if a malfunction occurs in any control system in the system.
As a result, it is possible to avoid a situation in which the self-repair is impossible if the functional part is broken down or destroyed in the entire control system, thereby improving the reliability of the system.
Further, the basic principle proposed in the present invention can be utilized in many practical control systems. For example, control of various plants, control of process systems such as factories, etc., are expected to develop in the future. It can also be used in the field of network home appliances. As an example of application in the field of network home appliances, it is possible to add a function of automatically and automatically recovering automatically when a control base of a specific home appliance out of home appliances connected via a network breaks down.
Further, the method of the present invention is effective not only when a control system failure is assumed, but also as a system automatic recovery method when an artificial system is destroyed. Specifically, when a part of a large-scale system is destroyed due to terrorism or the like, the method of the present invention enables automatic recovery.
[Brief description of the drawings]
FIG. 1 is an example of a system configuration according to an embodiment.
FIG. 2 is an example of internal components of a control system and a stem cell component.
FIG. 3 is an example of internal components of a remote I / O.
FIG. 4 is an example of a network connection mode according to the embodiment.
FIG. 5 is an example of a network connection mode according to the embodiment;
FIG. 6 is an example of a network connection mode according to the embodiment;
FIG. 7 is an example of a network connection mode according to the embodiment;

Claims (6)

A plurality of control systems including at least one stem cell operating as a spare control system connected to each other by a network, and a remote I / O connecting a control target controlled by each control system and the control system; An automatic restoration distributed control system comprising:
The remote I / O can be connected to any of the control systems, and has input / output means for transmitting a control signal from the control system and a feedback transmission from the control object between the control system and the control object; An abnormality detecting means for detecting an abnormality of a control system controlling the control object via the I / O,
The control system includes a control unit that controls the control target via the remote I / O, an abnormality detection unit that detects an abnormality of at least one of the control systems, and a reproduction unit that changes the control unit. And
The abnormality of the control system is detected by either the remote I / O or the control system as a whole, and when the remote I / O or the control system detects the abnormality of the control system, the detected remote I / O is detected. Alternatively, the control system notifies the remote I / O connected to the stem cell and the control system in which the abnormality has been detected, and the control means of the notified stem cell uses the control means of the abnormality control system by a reproducing means. Similarly, the input / output means of the remote I / O that has received the notification stops the connection with the abnormal control system, and connects to the notified stem cell, thereby providing an automatic restoration distributed control system. The automatic restoration distributed control system according to claim 1,
The remote I / O and the control system have a memory storing a signal pattern from the control system,
The abnormality detection means of the control system and the remote I / O detects an abnormality of the control system by comparing the control signal with a signal pattern stored in the memory. Distributed control system. In the automatic restoration distributed control system according to claim 1 or 2,
The stem cells further have a memory storing information of all control systems,
The regenerating means of the stem cell acquires information of a control system in which an abnormality is detected by the abnormality detecting means from the memory, and has its own control means having the same function as the control means of the abnormality control system. Automatic restoration decentralized control system characterized. In the automatic restoration distributed control system according to claim 1 or 2,
The control system further includes a memory storing information of at least one control system other than the control system,
The memory of the control system stores information of all control systems as a whole,
The regenerating means of the stem cell acquires information of a control system in which an abnormality is detected by the abnormality detecting means from a memory of the control system, and has its own control means having the same function as the control means of the abnormal control system. An automatic restoration distributed control system characterized in that: The automatic restoration distributed control system according to claim 4,
The reproducing means of the control system further transmits, to at least one control system other than the self, information to be used as the self control means to another control system,
The automatic restoration / distribution control system according to claim 1, wherein the reproduction means of the control system receives the information and stores the information in a memory storing the information of the control system. The automatic restoration distributed control system according to claim 5,
The automatic restoration decentralized control system, wherein the reproduction means of the control system periodically transmits information to be used as its own control means to another control system.

Images